Safaricom's AI Now Blocks 94% of M-PESA Fraud in Real Time - Here's What the Other 6% Means for You

Every day, about 150 million transactions move through M-PESA. Salaries, school fees, rent, a fence payment at the local hardware, the Sh200 you send your cousin in Kisumu. And according to Safaricom's chief executive Peter Ndegwa, artificial intelligence now stops 94% of the fraud attempts aimed at that river of money - in real time, before a single shilling moves.

The number came out of Safaricom's fourth annual Cybersecurity Summit, held in Nairobi on 14 October under the theme Harnessing AI, Strengthening Security. It is the clearest picture yet of how the company that operates East Africa's biggest payment rail is fighting a threat environment that is growing at a pace most people have not fully absorbed.

But the more important number in the story is the other one: 6%. The fraud that gets past the machines does not disappear. It lands in the inbox, the SMS feed or the WhatsApp chat of an actual human being. Understanding what that means - and the one habit that closes the gap - is worth more to your wallet than any press release.

What Safaricom actually announced

Speaking at the summit, Ndegwa explained how the 94% figure works: "By using AI, you are able to actually prevent in real time, 94% of any fraud that is about to happen by classifying, by learning about customer behaviour, by learning patterns about where the risk is coming from."

In plain terms: the system watches how millions of Kenyans normally use M-PESA - when they transact, from where, to whom, in what amounts - and flags the transactions that do not fit the pattern. A fraud attempt usually looks slightly wrong in a way that is hard for a person to spot at speed but obvious to a model that has seen millions of examples: an unusual time, an unfamiliar recipient, a transaction cadence that matches known fraud behaviour rather than genuine customer behaviour.

Ndegwa's second point was directed at how technology is built, and it applies well beyond Safaricom: "Cybersecurity is no longer an IT matter. It is a leadership responsibility... Customer protection is not added at the end; it is designed into how we build."

The scale of the threat behind the headline

The summit's context matters as much as the 94%. According to the Communications Authority of Kenya, the National Kenya Computer Incident Response Team - Coordination Centre detected 11.12 billion cyber threat events in the last financial year, up 29% from 8.62 billion the previous year. That is the volume of hostile traffic the country's digital infrastructure absorbs continuously - and it is growing faster than the economy it protects.

Zoom out to the continent and the picture sharpens further. INTERPOL's African Cyberthreat Assessment Report 2026, drawing on data from 36 African member countries, found that AI was linked to 55% of reported cybercrimes across Africa. Cybercrime-related losses in the region rose to $484 million in 2025, up from $192 million in 2024 - a two-and-a-half-times increase in a single year. The World Economic Forum's Global Cybersecurity Outlook 2026 found that 87% of surveyed organisations identified AI-related vulnerabilities as the fastest-growing cyber risk.

The same technology that lets Safaricom block 94% of fraud attempts is, in other words, also making the other 6% more convincing than ever.

Why the machines cannot be the whole answer

Here is the structural reality of fraud defence on a payments platform: the machine can only stop transactions that look wrong. The hardest fraud to catch is the kind where every technical signal looks normal - because it is you, the verified account holder, willingly approving the transaction.

Generative AI has made that scenario dramatically more dangerous. A caller can now sound like a family member. A message can arrive in a style, at a time, referencing details that make it feel authentic. Scammers use these tools to fabricate voices and messages that impersonate relatives, colleagues or officials - the goal is always the same: get you to approve the payment yourself, because a payment you approve is the one the AI will not flag as fraud.

This is why CS for ICT and the Digital Economy William Kabogo told the summit that "today's cybersecurity is no longer just about protecting networks and systems. It is also about protecting people." He called for a national effort spanning government agencies, schools, parents, telcos and technology companies - and pushed for stronger accountability frameworks, including the draft AI and Emerging Technologies Policy and the proposed Artificial Intelligence Bill 2026, which would create the Office of the Kenya AI Commissioner.

The one rule that protects you

Everything above comes down to a single habit that no scam has yet defeated, and it costs nothing:

Real M-PESA alerts never ask for your PIN, an OTP, or money to unlock anything. Verify before you tap.

That rule covers nearly every variant in circulation. The prize-winning message. The account-locked warning. The reversal request from a "wrong send." The caller who needs your code to stop a fraudulent transaction. Any message that creates urgency and asks for a credential or a payment is not from M-PESA - full stop.

Three habits that complete the defence:

• Treat urgent requests as a signal, not a command. Urgency is the tell. A genuine payment waits ten minutes; a fraud cannot.


• Verify on a second channel. If a message or call asks you to send money, hang up and call the person or business back on a number you already have.


• Never share your PIN or an OTP with anyone - not customer care, not Safaricom, not a relative. No legitimate process ever needs them from you.

What to watch next

Three developments will shape how this story evolves:

• The Artificial Intelligence Bill 2026 and the Kenya AI Commissioner. Kenya's legal framework for AI is taking shape, and how it balances innovation with accountability will determine how much responsibility platforms carry for AI-enabled harm.


• Deepfake detection reaching everyday tools. The arms race between generated content and generated-content detectors will decide how easy it is for an ordinary person to verify a voice or video.


• SME security as a market. MSMEs account for about 70% of Kenya's GDP, and Safaricom is packaging enterprise-grade security (managed security operations, secure connectivity) for them. If SME security becomes as normal as SME banking, the whole ecosystem gets harder to attack.

Bottom line

The 94% figure is genuinely good news: AI defence at M-PESA scale is working, and Kenya's payment rail is being hardened by systems that never sleep. But 6% of a very large number is still a very large number - and those attempts are engineered to succeed at the one point no algorithm controls: the moment a person decides to tap send.

The machines have your back. The pause is yours.

Sources: Safaricom press release, 14 October 2026; Impact Newswire/iAfrica.com coverage of the Safaricom Cybersecurity Summit; Communications Authority of Kenya sector statistics; INTERPOL African Cyberthreat Assessment Report 2026; WEF Global Cybersecurity Outlook 2026.