"Please pay to this other number": staying safe when you buy or sell on WhatsApp

Buying and selling through WhatsApp, TikTok and Instagram feels personal. You chat with a real person, see real photos, agree a price. That warmth is exactly why it works, and exactly what scammers lean on.

The good news: almost every common trick falls apart against a few simple habits.

If you're buying

Be suspicious of a sudden new payment number. "Our till is down, please send to this number instead" is one of the oldest lines there is. If a shop's payment details change mid-chat, stop and confirm through a channel you already trust, like a call to a number you've used before.

Read the name before you enter your PIN. When you pay with M-Pesa, the confirmation shows who will receive the money. Check that it matches the shop you think you're paying. If it's a different person's name, cancel. That one second is the cheapest protection you have.

For a new seller, prefer pay-on-delivery or a small deposit. There's a reason cash-on-delivery stays popular here: a DHL e-commerce report found nearly three in four Kenyan online shoppers prefer to pay when the goods arrive. For a first order with someone new, paying part now and the rest at your door is fair to both sides.

Look for real history. Reviews and photos from actual buyers, delivery stories, a shop that's been around a while. Brand-new pages with prices far below everyone else's deserve extra caution.

If you're selling

Never ship on a screenshot. Screenshots are easy to fake. Before you hand anything over, check your own M-Pesa messages or balance for the payment. If it isn't there, it hasn't arrived.

Watch for "I sent it by mistake, please send it back." A message claiming someone sent you money by accident, often with a sad story attached, is a classic trick. The "payment" message is usually fake. Don't send anything. If money really was sent in error, the sender can ask Safaricom to reverse it; you don't need to do it yourself.

Know the official channels. Safaricom advises forwarding fake M-Pesa messages to 333, and wrong-transaction reversals go through 456. Safaricom also says its staff will never ask you to visit an agent to process a reversal. Anyone who does is not Safaricom.

Keep your PIN to yourself, always. No real customer, courier, agent or "customer care" caller ever needs your M-Pesa PIN or a one-time code.

Trust is a habit

None of this means being cold to buyers or sellers. It means having a few routines you follow every time, so you don't have to rely on gut feeling when someone is rushing you. Scams need urgency to work. Routines take the urgency away.

What we're building

Fake payment screenshots are one of the reasons we're building ODA: a shop link for people who sell on WhatsApp, TikTok and Instagram. The M-Pesa payment prompt lands on the buyer's own phone, and the order page updates by itself once it's paid, so nobody has to send screenshots back and forth. ODA is still in development; there's a link on its page if you'd like to test it early.

Rules and shortcodes can change. When in doubt, check Safaricom's official channels.

Sources: DHL: cash-on-delivery and trust in Kenya · The Star: what you need to know about M-PESA fraud schemes