How to recognise a betting phishing SMS before you tap the link
A betting phishing SMS tries to make you tap a link, read out a code or pay a fee. A prize is credited to your account, not released for a fee, and no operator needs your wallet PIN. If a message pushes you to hurry, do not tap: open the operator's app or site yourself.
What a phishing SMS is trying to get
Phishing is a message built to make you hand over something: a password, a one-time code, a wallet PIN, or money. In betting, the message usually borrows a familiar name and a reason to hurry, such as a locked account, a pending prize or a verification deadline.
The aim is often the same as in a SIM takeover, described in the guide on protecting a gambling account from SIM swap and PIN theft: control of the phone number or the login, and through them the money in the player account and the mobile wallet.
Signs that separate a scam from a real notice
No single sign proves a message is fake, and a scammer can copy a real sender name or a real tone. Use the table to decide what to check, then check through a route you chose yourself.
| What the message does | Why it is a warning sign | What to do instead |
|---|---|---|
| Asks for your M-PESA or Airtel Money PIN | The PIN is only ever entered on your own handset into the wallet service | Do not reply or tap. Never type it into a web page opened from a message |
| Asks you to read out or forward a one-time code | The code exists to prove you are the one logging in. Whoever holds it can act as you | Ignore the message. If you did not request a code, someone else is trying your account: change the password |
| Says you won a prize and must pay a fee first | A monetary prize is credited to the player's account within two days (Act s.70(1)). Any processing fee must be disclosed to the player by the licensee (s.72(6)(b)) | Look in your account through the real app or site. Do not pay |
| Threatens closure or a freeze unless you act within minutes | Urgency is meant to stop you checking | Open the operator's app or site by yourself and look for the same notice |
| Contains a shortened or oddly spelled link | The page may be a copy of a login screen. See fake betting apps and APK risks | Type the operator's domain yourself or use the app you installed from an official store |
| Asks you to install an app or file from the message | A file sent outside an official store is a common route for malware | Do not install. Read the guide on fake apps first |
| Arrives although you never registered anywhere | Probably a bulk message to many numbers | Delete it. Do not reply, including with "STOP" |
| Offers to place bets or "guarantee" results for a fee | Soliciting people to bet in an unlicensed activity is an offence under s.92(c) of the Act | Ignore it and do not send money |
What licensed operators have to do, and what they do not do
An online operator must run under a gambling control system approved by the Authority. That system cannot be approved unless it provides for online security of information and safety against criminal activities (Act s.68(2)(a) and (b)). The glossary entry on the gambling control system lists the other required elements.
The operations regulations add that online payments must have multi-factor authentication "such as one-time passwords or biometric verification to prevent unauthorized payments" (r.49(c)). That is why one-time codes exist, and why they are worth nothing to you once someone else has them.
Nothing in the Act or the regulations read for this guide says an operator may ask a player to tell it a wallet PIN. Registration involves proof of age of majority (s.72(3)), which is covered in proof of age and identity checks, but that is a document check inside a registered process, not a reply to a text.
Why prize and fee messages deserve extra doubt
The most common betting scam text promises a payout that is "held" until you pay something. The law describes a different process. A monetary prize is credited by the licensee to the player's account within two days (Act s.70(1)), so there is no step in which a stranger must receive money before your balance changes.
Before a prize is remitted, the operator must require proof of age of majority (s.70(6)). That is a check the operator carries out on your registered account. The timelines for payouts are set out in the guide on prize payment and withdrawal timelines.
If you were never a registered player, you cannot have won a prize in an operator's game. A message claiming otherwise is not a notice from a licensee.
A safe way to check any message
- Stop and do not tap
Reading a message is harmless. Tapping, replying or calling a number in it is where the risk starts.
- Open the operator yourself
Use the app you already installed from an official store, or type the domain by hand. If the matter is real, it will also show inside your account.
- Check the operator is on the register
The GRA publishes a list of licensed gaming companies for the trading period 2025/26. It is a snapshot of that period, so check the live register on gra.go.ke before relying on a name.
- Use the customer care centre
Every online operator must keep one in Kenya (Act s.68(8)); its purpose includes handling matters arising from the licensee's gambling activities (r.9). Get the contact details from the operator's own site or app, not from the message.
- Report and tell your network
Report the message to the operator and use your network's official channel for scam messages.
If you already tapped, replied or paid
| What happened | Do this first |
|---|---|
| You tapped but entered nothing | Close the page. Delete any file you did not intend to install and run a security scan if you downloaded anything |
| You typed a player-account password | Change it from the real app or site. Change any other account that used the same password |
| You shared a one-time code or wallet PIN | Change the PIN, call your mobile network from another phone if you can, and ask the operator's customer care centre to secure the account and stop any pending withdrawal |
| You sent money | Keep the transaction message, note the time and number, and report to your network and the operator. Recovery is not guaranteed |
Keep notes of the times, numbers and transaction codes. An operator that learns of fraud must report it to the Authority within twenty-four hours (r.91(2)), and accurate notes help it do so.
Habits that limit the damage
- Keep small balances. Money left in a player account is exposed if the login is stolen. The guide on how mobile-money deposits work shows where the money moves.
- Use a unique password for the player account, different from your email and wallet.
- Keep data to yourself. Your ID number and date of birth help an impostor sound convincing. See personal data terms for gambling accounts for what operators may collect.
Gambling is addictive: play responsibly, and only with money you can afford to lose.
Questions and answers
Can a betting company ask me for my M-PESA PIN by SMS?
There is no reason for it to. Your wallet PIN is entered on your own handset into the wallet service. A message, caller or page asking you to type or send it should be treated as fraud.
A message says I won a prize and must pay a fee to release it. Is that real?
Treat it as a red flag. Section 70(1) of the Gambling Control Act, 2025 says a licensee must credit a monetary prize to the player's account within two days, and s.72(6)(b) says the particulars of any processing fee must be made available to the player by the licensee.
Why do I get betting messages when I never registered?
Possibly a scam sent to numbers in bulk. For a registered player, regulation 96(3) of the operations regulations says personal data shall not be used for marketing without the participant's prior consent.
I tapped a link by mistake. What now?
Do not enter any details. If you did enter a password, change it at once from the operator's real app or site, then contact the operator's customer care centre and your mobile network.
Where do I report a fraudulent message about a licensed operator?
Tell the operator's customer care centre, which operators must maintain in Kenya (Act s.68(8)). Your mobile network also has its own channel for reporting scam messages: use its official website or shop.
Does the operator have to tell me about a fraud on its platform?
Regulation 91(2) of the operations regulations requires a licensee to report fraud and malpractice to the Authority within twenty-four hours.
Sources
- Gambling Control Act, 2025 (No. 14 of 2025), ss.68, 70, 72, 92, accessed 2026-10-04
- Gambling Control (Conduct of Gambling Operations) Regulations, 2026, rr.9, 49, 91, 96, accessed 2026-10-04
- GRA: licensed operators, trading period 2025/26, accessed 2026-10-04