What it is
Phishing is a message designed to trick you into doing something harmful: revealing a password or one-time code, making a payment, or opening a malicious link or attachment. When it arrives by SMS it is called smishing; it also spreads through WhatsApp, social media and phone calls. In Kenya these often imitate a bank, a mobile-money provider, KRA, an employer or a delivery service.
How to recognise it
Pressure and urgency: a warning that your account will be blocked, or a prize that expires soon.
A request for a PIN, password, one-time code or full card details — which a genuine organisation will never ask for.
A link to a lookalike website, a slightly wrong sender address or number, or unexpected attachments.
A message that quotes a real detail about you; knowing your name or recent purchase does not prove who is contacting you.
How to protect yourself
Do not act on the message itself. Open the service using its official app or a web address you type yourself, and verify any request there. Never share a one-time code or approve a sign-in prompt you did not start. Turn on multi-factor authentication so a stolen password is not enough on its own. Our guide on recognising and reporting scams has more.
If you have already responded
If you entered a password, change it immediately from a trusted device and sign out other sessions, starting with your main email. If you shared a code or made a payment, contact your bank or mobile-money provider at once to secure the account and ask about reversal. Keep the message and report it through our reporting guidance.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.