Safaricom Fires 118 Staff in $7.3M Fraud Purge

The comparative data illustrates the tension between expanding business volume and maintaining internal security. While Safaricom succeeded in cutting total fraud incidents by eighty-two percent across the organization, it fell short of its internal ninety percent reduction target. The fact that employee dismissals rose from 113 to 118 confirms that bad actors remain persistent. Recovering forty-six percent of reported customer losses represents progress over historical standards, yet leaves more than half of stolen consumer balances unrecovered. The commercial imperative to clean up payment pipelines reflects operational priorities we tracked when Airtel Money posted strong annual revenue despite regional currency headwinds.

The Cyber Frontline: 1.25 Billion Intrusion Attempts

Internal employee misconduct represents only one flank of the battlefield confronting Safaricom security engineers. The sustainable business audit revealed the immense volume of external digital assaults directed at the network core.

During the financial year, Safaricom security operations centers monitored approximately 1.25 billion cyber intrusion attempts, conducting formal forensic investigations into more than 130,000 distinct security events. Transnational cyber syndicates, operating automated botnets and distributed denial-of-service tools, probe application programming interfaces, web gateways, and customer database connections around the clock. The goal of these intrusions is discovering unpatched software vulnerabilities, stealing customer identity records, and gaining administrative backdoors into settlement databases. Safaricom engineering teams operate twenty-four-hour threat intelligence desks in Nairobi, using behavioral pattern recognition to isolate malicious IP pools before foreign traffic reaches internal servers. The scale of external attacks proves that major African telecommunications providers operate as strategic national infrastructure, requiring cyber defenses equivalent to commercial banks. Telecommunications security outlays across Africa match infrastructure commitments we analyzed when Airtel Africa expanded network investments across regional hubs.

Whistleblowing and the Password Spreadsheet Vulnerability

A surprising detail in the report involves the internal tools used to track misconduct investigations. Safaricom noted that fraud was the single most common category of concern raised through its independent, anonymous employee ethics hotline during the year.

When staff members notice colleagues approving suspicious transactions or accessing call records without customer consent, they submit encrypted reports to the Ethics and Compliance department. Yet the report revealed an operational bottleneck in how those investigations are managed. Investigation files, interview notes, and evidentiary records are prepared manually outside the primary fraud management software. The sensitive files are tracked using password-protected spreadsheet files accessible exclusively to compliance managers. Relying on manual spreadsheets to manage sensitive corporate fraud investigations presents obvious internal security hazards. If an administrative spreadsheet is leaked, corrupted, or accessed by a rogue systems administrator, active investigation targets could be alerted before formal charges are filed. Safaricom indicated that it is overhauling this workflow: replacing manual spreadsheets with an automated case management platform that logs administrative access through tamper-proof cryptographic audit trails. Managing distributed internal corporate records matches governance models we detailed when Bujeti launched automated software for African finance.

The Ethics Training Push: Reaching 5,600 Workers

Disciplinary action represents the final step of corporate enforcement; prevention requires continuous employee education. The 2026 report documented an extensive education initiative designed to train workers on data protection laws and compliance ethics.

Over the twelve-month period, Safaricom conducted formal fraud awareness training for 5,643 individuals across the enterprise. The sessions reached retail shop workers, call center customer support agents, field brand ambassadors, and regional M-PESA distribution supervisors. Company records show that ninety-eight percent of permanent staff completed mandatory annual ethics refresher courses. Training programs instruct employees on social engineering tactics: warning customer service attendants how scammers pose as corporate managers or police investigators to trick front-line staff into releasing customer account details. Staff are trained on Kenya Data Protection Act, which establishes severe personal fines and criminal penalties for workers who disclose customer phone records, location data, or transaction histories to unauthorized third parties. Educating decentralized workforces on regulatory boundaries mirrors compliance priorities we followed when central bank rules targeted market concentration to protect consumer data.

The Rapid Response Dedicated Fraud Line: Routing 1,500 Complaints Monthly

On the customer side, Safaricom has worked to shorten the window between a theft occurring and accounts being frozen. When an attacker steals a phone line, every minute of delay increases the financial damage.

Safaricom upgraded its dedicated 333 emergency fraud reporting hotline, routing roughly 1,500 direct customer complaints every month straight to specialized response squads. In past years, a customer reporting an unauthorized line swap had to navigate confusing general call center queues, waiting up to forty-five minutes while the scammer finished draining funds. Under the revised setup, calling 333 allows users to report an active account compromise immediately. The system executes a rapid security freeze: blocking M-PESA withdrawals, suspending linked bank accounts, and canceling pending Fuliza loan requests within seconds of the report. The fraud team then initiates identity checks to confirm legitimate ownership before restoring services. Safaricom stated that the fast-freeze pipeline contributed to recovering forty-six percent of reported consumer losses this fiscal year. Rapid fraud containment models across consumer payment networks match developments we tracked when Taja scaled cross-border payments with automated fraud screens.

The Pan-African Telecom Security Dilemma

The fraud challenges documented by Safaricom are not unique to Kenya; they reflect systemic vulnerabilities across the African telecommunications sector. From Lagos to Johannesburg, mobile money operators are confronting the identical challenge: securing decentralized networks against insider collusion.

In Nigeria, commercial banks and mobile network operators lose billions of naira annually to unauthorized SIM-swap fraud and rogue banking agent collusions. In South Africa, telecommunications regulators have mandated facial biometric verification for SIM registrations to curb organized syndicates who use forged identity papers to hijack bank accounts. When an operator expands to dozens of millions of users, managing thousands of retail kiosks and outsourced call center workers becomes difficult. Competitors like MTN MoMo, Airtel Money, and Orange Money are investing tens of millions in automated behavioral profiling tools, attempting to identify rogue employee behavior before customers suffer financial loss. The continental drive toward secure payment plumbing reflects regulatory changes we analyzed when South Africa opened national payment rails to non-bank fintech operators.

The Future Mandate: Biometrics and Zero-Trust Telecommunications

The firing of 118 workers sends an unmistakable warning to the telecommunications industry: relying on paper employment contracts, administrative warnings, and manager trust is obsolete. A modern financial operator must adopt a zero-trust security architecture.

Under a zero-trust model, no employee: regardless of job title or years of service: is trusted by default. Every action that touches customer funds or personal data requires continuous verification. Moving forward, Safaricom is accelerating the rollout of facial biometric authentication for high-risk customer operations. If a customer walks into a retail shop requesting a replacement SIM card, the customer service representative will not be able to approve the transfer using a personal computer password. The system will require a live facial scan of the customer, matched against government identity databases in real time, before the phone line can be swapped. Furthermore, internal software systems are removing administrative permissions that allowed workers to view customer phone numbers in plain text, replacing sensitive records with masked cryptographic tokens. By removing human discretion from sensitive identity transactions, Safaricom aims to protect both its customers and its honest workers from criminal pressure. Network modernization strategies across regional mobile providers were detailed in our review of MTN expanding mobile money operations across West Africa.

The Bottom Line on Safaricom Corporate Clean-Up

Safaricom 2026 Sustainable Business Report proves that corporate transparency remains the ultimate disinfectant. Many corporate enterprises would attempt to conceal internal theft, fearing that public admissions of rogue workers would trigger customer panic and share price declines.

By publishing exact numbers: detailing 118 dismissals, fourteen criminal police referrals, and KSh953M ($7.3M) in reclaimed commissions: Peter Ndegwa and his leadership team demonstrated the courage required to protect corporate integrity. The path forward will require relentless vigilance. As digital fraudsters adopt automated social engineering tools and complex money-laundering schemes, Safaricom must stay ahead: deploying real-time telemetry, closing investigation software loopholes, and holding internal offenders legally accountable in open court. In the emerging African digital economy, the companies that endure will not be those that pretend fraud does not exist, but the disciplined operators who root out corruption with an uncompromising hand, proving that public trust is a sacred commitment that will be defended at all costs.

Read More on TechRobust:

• Safaricom expands M-PESA into wealth and insurance
• Airtel Money revenue jumps 34 percent to $830M post-IPO
• Taja tops 50,000 users across seven African markets