Your phone is probably carrying more of your life than your wallet ever did. It has your money, messages, photos, contacts, email, banking apps and, for many Kenyans, access to M-PESA. Then some of us slide a national ID behind the phone cover and keep the PIN nearby. Convenient? Yes. Safe? Not at all.
Safaricom says not every privacy threat starts with a sophisticated hacker. Sometimes the opening is a weak PIN, an unlocked phone or a caller who sounds convincing enough.
Nicolas Mulila, Group Chief Risk Officer at Safaricom, told NewsTrendsKE that personal data is anything that can identify you, including your full name, ID details and phone number, as well as information connected to those identifiers.
“Why is privacy important? So that you don’t have people contacting you whom you didn’t want to share your phone number with. You don’t have people pretending to be you and taking loans in your name,” said Nick Mulila.
Start with these six things
The advice from Safaricom is not complicated. It is the kind of phone hygiene most people can fix today:
- Do not use your date of birth as your PIN.
- Do not leave your national ID behind your phone cover.
- Do not write down your PIN and store it behind your phone.
- Dial *100*100# to protect your line against unauthorized SIM swaps.
- Never give your PIN to anyone who calls you.
- Do not give strangers your phone to make calls or change settings
The date-of-birth warning matters because birthdays are often easy to find. They appear on social media, forms, workplace records and family posts. Once someone knows your birthday, a PIN is no longer a secret.
Your personal information can also be exposed away from your phone. Think about the visitor’s books at office receptions, apartment entrances and public buildings, where people routinely write down their names, phone numbers and ID details.
“All of us leave our phone numbers in very many different places,” Mulila said. “When you go into a public building, you put in your name, ID number and phone number. We never know where those books go.”
The same risk exists at events, where registration sheets may be left on open tables, photographed or copied. Before sharing personal details, customers should ask why the information is needed, who will have access to it and how it will be protected.
The scammer may not ask for your PIN
The old fraud script was direct: someone called, claimed to be from Safaricom and asked for your PIN. More people now recognise that trick. The newer scams are designed to keep you engaged long enough to act before you think.
“There’s been a lot more people trying to defraud others,” Mulila said. “We are seeing a proliferation of links — people claiming that your order is delayed and that you need to put your details into this link.”
Other versions tell you that you have won money, qualified for a promotion or need to reverse a transaction. Sometimes the fraudster never asks you to reveal the PIN aloud. Instead, they guide you through codes that move money from your account.
“Fraudsters get people to actually press in the codes that would transfer money to the fraudster without the person realizing. They’re very, very cunning.”
And it is not only people who are unfamiliar with technology who get caught.
“We’ve had everyone from mama mboga to experienced businessmen, to judges, teachers, medics and people in government. Everyone gets taken in.”
Mulila’s test is refreshingly simple: stop and question the story.
“If the deal sounds too good, ask yourself: Did I actually sign up for such a promotion? Have I ever shopped at such a place? And why would I need to pay money to get money?”
An unlocked phone can create a problem you never started
Not every subscription or interaction with a third-party service is initiated by the registered phone owner.
Mulila said Safaricom has investigated complaints where another person used a customer’s unlocked phone without their knowledge.
“Sometimes somebody borrowed your phone and did a quick bet. Especially during school holidays, these complaints increase. Maybe there are youngsters in the house, the phone is not locked, and they decide to try their luck.”
Once a number has been used to register for or interact with a service, that business may be able to contact it afterwards. This is why a phone lock matters even when the device is inside the house.
A PIN, password, fingerprint or facial recognition feature does more than protect a lost phone. It also prevents someone from opening apps, approving subscriptions or using services while the device has been left unattended.
Your phone PIN is not a relationship test
Sharing a phone password with a spouse or partner is sometimes treated as proof that there is nothing to hide. But privacy is not the same thing as secrecy. A phone can hold work information, financial details and other people’s private messages.
Protecting your data also means being deliberate about what you share outside close relationships. A phone number may be submitted through an event form, competition, merchant, delivery service or mobile application. By the time unexpected messages begin arriving, it may be difficult to know where the information originally came from.
You should therefore avoid treating every request for personal information as routine. Ask whether the full ID number is necessary, whether a register is visible to other people and whether the details will be used for any purpose beyond the one explained.
What to do when something feels wrong
Keep the evidence. Take screenshots, save the number, note the time, keep the message and do not delete the transaction details. Report the incident through My OneApp or forward the scam texts to 333.
“Privacy is your right. Feel free to exercise it and ask questions where you don’t understand so that you can learn more.”
