How to spot a fake betting app or a copied site before it reaches your wallet

Start from the regulator's published list, not from a link. A licensed online platform must run on a domain name approved by the Gambling Regulatory Authority (Operations Regulations, r.41). If the address in your browser or the publisher of an app does not match a domain on that list, do not enter a password, a PIN or an identity document.

By WebTech Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-10-04

What a fake app or copied site is after

A fake betting app is not built to take a bet. It is built to collect one of four things: the password to a real player account, a mobile-money PIN, a one-time code, or a photo of an identity document. With the first three a fraudster can empty an account or a wallet. With the fourth, a fraudster can try to pass as you elsewhere, which is why the guide on SIM swap and PIN theft belongs next to this one.

The copy often arrives as a link: in an SMS, a messaging group, a social media post or an advert that imitates a known brand. The page behind the link looks right. The address does not.

The anchor: an approved domain name

Kenyan regulations give you one fixed point to check against. Regulation 41 of the Conduct of Gambling Operations Regulations lists the minimum standards for an online gambling system, and the first of them is "an approved domain name". Operating an online platform without the Authority's approval is an offence under r.48(2), and a licensee must notify the Authority of any material change to the platform within seven days (r.47(1)).

The regulator publishes a list of licensed gaming companies. For many entries the list includes a web domain. That gives a simple rule: the name you see in the browser's address bar should be a domain that appears in the regulator's list, spelled exactly the same way.

How to check a site or an app, step by step

1. Type the address yourself

   Do not follow a link from a message to reach a login page. Type the domain from the regulator's list into the address bar, or use a bookmark you made earlier from that address.

2. Read the address bar from right to left

   The real site name is the part immediately before the ending (such as .com or .co.ke). Extra words in front of it, a swapped letter, a hyphen that should not be there or a different ending all mean a different site.

3. Look for the operator's legal details

   An operator's approved terms must state "the name and full physical address of the promoter" and its Paybill numbers, short codes and USSD numbers (r.4(2)). Approved advertising must show the licence number, the licensee's name and address and a customer-care number (Advertising Regulations, r.8). A site with none of these is not behaving like a licensee.

4. Trace an app back to that domain

   The regulator's list does not name apps. Treat an app as genuine only if you reached it from the operator's approved domain or from an official app store listing whose publisher is the licensed company. An app file sent to you by a person, a group or an unknown site fails this test.

5. Check the payment prompt

   Before entering a wallet PIN, compare the business number and the recipient name with those in the operator's terms. The guide on how deposits reach a player account explains what that prompt should look like.

Why app files from links are a particular risk

An APK is simply the package in which an Android app travels. A file from an unknown source can be a real app with extra code added. On the screen it shows the same logo and the same login form. Underneath, it can ask for permissions that a betting app has no need for.

This site does not explain how to install apps from outside official channels. If a licensed operator offers an app, its own approved domain is the place that says where to get it.

If you have already installed something suspicious

1. Disconnect and remove it

   Switch off mobile data and Wi-Fi, then remove the app. Check the list of apps with SMS and accessibility permissions and withdraw any you do not recognise.

2. Change the wallet PIN

   Safaricom's advice when you suspect someone knows your PIN is: "Change your PIN immediately." Contact your network as soon as you suspect your details or phone have been compromised.

3. Change the player-account password from another device

   Use the operator's approved domain. Then contact its customer care centre, which s.68(8) of the Gambling Control Act, 2025 requires to be maintained within Kenya, and ask whether there were logins or withdrawal requests you did not make.

4. Think about what documents you sent

   If you uploaded an identity document to a copied site, watch for lines registered in your name (on Safaricom, *106#) and for messages about accounts you did not open. The guide on proof of age and identity checks explains where genuine verification happens.

5. Report it

   Safaricom asks customers to notify it of impostors and suspicious branded links, websites and social media handles, and to forward fraud messages to 333. The Gambling Regulatory Authority's toll-free line is 0800-723-770.

Why an unlicensed site leaves you without cover

The protections described across this site are duties of licensees: separated player funds (r.41), encrypted player data (r.42), payment deadlines, a customer care centre in Kenya and a regulator that can suspend or revoke a platform authorisation (r.51). They exist because the operator's system was approved, as set out in the glossary entry on the gambling control system.

A copied site or an unlicensed one offers none of this. Money sent to it is not held in a player account under the Act, and there is no approved dispute process behind it. Section 92 makes it an offence to aid the unlicensed management of an electronic gambling site or to solicit any person to bet on an unlicensed site.