How to protect a phone-based gambling account from SIM swap and PIN theft

Your player account and your mobile wallet both hang on one phone number. Lock that number first: Safaricom says dialling *100*100# prevents your SIM being swapped without you present, and *106# shows the numbers registered in your name. Never share a PIN or a one-time code, and change the PIN at once if you think someone knows it.

By WebTech Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-10-04

Why the phone number is the weak point

An online gambling account in Kenya is tied to a phone line in three ways. Deposits leave a mobile wallet on that line, as described in the guide on how mobile-money deposits work. Small prizes are paid "automatically to the player's registered mobile money wallet" under the Third Schedule of the operations regulations. And one-time codes sent by SMS arrive on that line.

Whoever controls the number therefore controls the money in both directions. Safaricom's description of SIM swap fraud is blunt about the aim:

"Fraudsters go to the extent of registering an existing number on a new SIM card in order to intercept notifications, one-time passwords, online banking profile and transactions as well as changing the account security settings."

Safaricom, fraud awareness: SIM swap fraud

Lock the line before anything else

These steps use the codes and advice published on Safaricom's fraud awareness pages, read on the date shown in the sources list. Other networks publish their own procedures; use the official site or shop of your network for those.

1. Block remote SIM swaps

   Safaricom: "To prevent your sim being swapped without you present dial *100*100#."

2. Check which lines are registered to your ID

   Safaricom: "To confirm the phone numbers registered in your name dial *106#." The same page says that if someone tries to register a new line using your ID, you will receive an SMS from 707 asking you to confirm.

3. Turn on the SIM lock

   Safaricom's SIM swap page advises customers to ensure the SIM card "has an active SIM lock", to use strong passwords and to keep personal information off social media.

4. Set a PIN that cannot be guessed

   Safaricom: "Make sure your PIN is not easy to guess. Avoid using PINS such as year of birth." Use a different number for the handset screen lock, the SIM lock and the wallet.

5. Use a separate password for the player account

   Do not reuse the wallet PIN or an email password. If the operator offers a second login factor, switch it on.

Warning signs and what to do about each

If you think the line or the account has been taken over

1. Contact the mobile network first

   Safaricom: "Contact Safaricom as soon as you suspect your details or phone has been compromised." Getting the line back stops further one-time codes going to the attacker.

2. Change the wallet PIN

   Safaricom: "Change your PIN immediately" if you have shared it or suspect someone knows it.

3. Contact the gambling operator's customer care centre

   Ask for the account to be secured, the password reset and any pending withdrawal stopped. Section 68(8) of the Gambling Control Act, 2025 requires every online operator to maintain a customer care centre within Kenya, and regulation 9 requires it to handle matters arising from the licensee's gambling activities.

4. Write down what happened while it is fresh

   Note times, numbers that called you, messages received and transaction codes. Regulation 91(2) requires a licensee to report fraud and malpractice to the Authority within twenty-four hours, and your notes make that report accurate.

5. Report the fraud numbers

   Forward fake messages to 333. Safaricom also advises reporting threats to the police.

What the operator is required to do on its side

Account security is not only the player's job. An operator's gambling control system cannot be approved unless it provides for "online security of information" and "safety and security against criminal activities" (Act s.68(2)(a) and (b)). The glossary entry on the gambling control system lists the rest.

The operations regulations add technical duties. A licensee must encrypt all personal and financial data of a player in transit and at rest (r.42(1)). Among the online payment protections in r.49 is that online payments "have a multi-factor authentication, such as one-time passwords or biometric verification to prevent unauthorized payments". Regulation 50 requires platforms to be secure from cyber-attacks, hacking and bots, to undergo regular independent electronic security audits, and to keep an incident response report of breaches, downtime and fraudulent digital activity.

If personal data held by an operator is accessed by an unauthorised person and there is a real risk of harm, s.43 of the Data Protection Act requires notification to the Data Commissioner within seventy-two hours and written communication to the people affected. The terms used in that Act are set out in the glossary of personal data terms for gambling accounts.

Habits that reduce the damage of any single mistake

• Keep balances low. Money left in a player account or wallet is money exposed to a takeover. Withdraw what you are not using.
• Set limits. Regulation 87 requires operators to offer daily, weekly and monthly deposit limits and loss, session and expenditure limits. A limit also caps what a thief can move in.
• Use only the operator's approved domain. A copied login page collects passwords as efficiently as a phone call does. See the guide on fake betting apps and APK risks.
• Protect your ID details. Safaricom's advice is to keep your ID number, date of birth, full names and address private, since those are what an impostor needs to pass as you.
• Do not lend the account. An account used by more than one person has more than one set of passwords in circulation, and it stops matching the identity checked at registration. The guide on proof of age and identity checks explains why that matters at payout.