Safaricom Sued Over Failure to Prevent Fraud, Protect Customer Data

Safaricom PLC and its subsidiary, M-Pesa Holding Company Ltd, have been sued by a victim of mobile-money fraud for allegedly failing to safeguard customer data and prevent fraudulent transactions affecting thousands of Kenyan users.

The suit has been filed at the High Court by Paula Rogo, who is pursuing the case both in her personal capacity and on behalf of other M-Pesa users who have lost money through similar schemes.

Rogo wants the court to declare that Safaricom violated her constitutional right to access information under Article 35, as well as the consumer and administrative rights of fraud victims under Articles 46 and 47.

She accuses the telco of failing to protect customer data from unauthorised access, prevent fraudsters, including alleged insiders, from accessing M-Pesa records, provide a dedicated and responsive call centre for fraud cases, implement timely fraud-mitigation and compensation procedures and inform customers of available fraud-redress mechanisms.

According to the court filings, Rogo argues that Safaricom continues to market M-Pesa as a “secure and fast” service while doing little to strengthen protections despite rising cases of increasingly sophisticated fraud targeting millions of users.

How the Fraud Happened

In her affidavit, Rogo recounts that on January 3, 2024, she received a call from an unfamiliar number. When she returned the call, a man identifying himself as Michael Kiptoo claimed to be a Safaricom employee.

To win her trust, the fraudster allegedly sent her messages appearing to originate from Safaricom’s official SMS platform. He also disclosed her M-Pesa balance, recent transactions and frequently contacted numbers, information she believed only Safaricom personnel could access.

Convinced she was speaking to a legitimate staff member “securing” her account, Rogo followed his instructions. She was directed to use the Pochi la Biashara feature, through which KSh119,658 was withdrawn. An additional KSh6,000 M-Shwari loan was taken and stolen, bringing the total loss to KSh125,658.

Throughout the call, the fraudster assured her not to reveal her PIN, a tactic she says increased his credibility. Suspicion only arose when his tone became hostile, prompting her to hang up.

Struggle to Seek Help

Realising she had been defrauded, Rogo attempted to reverse the transactions by texting Safaricom’s 456 reversal line, only to find it works exclusively for person-to-person transfers.

She then tried contacting the company through WhatsApp but received no assistance.

Rogo says she called Safaricom customer care nine times before managing to speak to a representative, roughly 40 minutes after discovering the theft. By then, the money had already been withdrawn, making recovery impossible.

She claims the customer service agent could not answer key questions about potential compensation, the pursuit of perpetrators or Safaricom’s mitigation measures.

Despite filing a police report and making multiple follow-ups, Rogo says Safaricom has taken no meaningful action for nearly a year, contradicting the telco’s public promises on customer safety.

Vulnerable Customers

The petition notes that Safaricom is fully aware that many M-Pesa users, especially the unbanked, semi-literate and low-income population, remain highly vulnerable to fraud. Even tech-savvy customers, the filings say, struggle to detect increasingly sophisticated scams, some of which appear to involve insider knowledge.

Rogo argues that Safaricom has not invested adequately in fraud-prevention infrastructure, despite M-Pesa’s critical role in Kenya’s digital economy.

What the Suit Seeks

Rogo wants the High Court to issue several declarations and mandatory orders, including:

• A finding that Safaricom violated constitutional rights under Articles 35, 46 and 47
• An order requiring Safaricom to publish annual reports on M-Pesa fraud cases, losses and investigation outcomes
• Establishment of dedicated, responsive fraud-reporting channels
• Compensation of victims using clear, transparent procedures
• Mandatory investigation and prosecution of fraudsters, with regular updates to victims
• Implementation of improved fraud-prevention systems within 180 days

She is also seeking compensation for the KSh125,658 lost, along with general damages for violation of her rights.

Safaricom has not yet filed its response to the petition.