M-Pesa Fake SMS Reversal Scam — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 27, 2026

Severity: CRITICAL | View Full Scam Details

Beware in 2026: M-Pesa Fake SMS Reversal Scam Hits India’s Digital Payments Hard

In 2026, Indian mobile payment users face a critical threat from the M-Pesa Fake SMS Reversal Scam — a dangerous phishing attack disguised as urgent payment reversal alerts targeting UPI and mobile wallet users.

What Is the M-Pesa Fake SMS Reversal Scam?

The M-Pesa Fake SMS Reversal Scam originated in East Africa targeting M-Pesa users, Kenya’s popular mobile money service operated by Safaricom. Though M-Pesa itself is not widely used in India, this scam has evolved and crossed borders, now appearing here under familiar local forms such as UPI transaction reversals, e-wallet refunds, or payment correction messages.

This scam mainly targets everyday digital payment users who rely on fast money transfers through popular platforms like Google Pay, PhonePe, Paytm, and bank UPI apps. Fraudsters exploit the trust users place in instant SMS alerts, especially those that appear to come from official channels. They imitate these alerts perfectly, including logo images and typical language used by companies, but send them from unofficial phone numbers.

India has recently seen a surge in similar phishing scams as per advisories from CERT-In and the I4C (Indian Cyber Crime Coordination Centre). The Reserve Bank of India (RBI) has also cautioned users to be vigilant around unexpected refund or reversal requests received via SMS or WhatsApp, warning about the risk of financial loss or data theft.

How This Scam Works — Step by Step

1. Fake SMS Alert Received: The victim receives an SMS that looks exactly like an M-Pesa or local mobile wallet transaction message. It falsely claims a recent payment was “credited” to their account by mistake.

2. Urgent Reversal Request: The message warns the user about a pending reversal and requests them to “refund” the amount immediately to avoid penalties, such as account suspension or legal action. The false alert shows a fake transaction amount and balance update.

3. Unauthorised Phone Number Used: Unlike real transaction alerts from shortcodes (e.g., M-Pesa official numbers or UPI-confirmed IDs), these messages come from random mobile numbers or WhatsApp contacts but are designed to look official.

4. User Contacts Fraudster: Sometimes, the message asks the user to call or reply via WhatsApp to a “support” number for assistance.

5. Transfer of Money: Believing the alert is genuine, the victim transfers the money back, typically via UPI or wallet transfer to the scammer’s account, thinking they are correcting an error.

6. Loss Realised Too Late: Once the money is sent, the scammers disappear. The original transaction was fake, and there was no real payment credited. Victims end up losing their own money with no straightforward way to recover it.

Real Warning Signs to Watch For

• The SMS comes from a phone number or WhatsApp contact, not from official UPI or bank-approved shortcodes.
• Messages create a false sense of urgency, pushing you to act immediately.
• Requests to refund money via UPI or wallet transfer, despite no real transaction errors.
• Unexpected alerts about payment reversals or refunds for transactions you did not do.
• Poor grammar, spelling mistakes, or slightly unusual phrasing in the message.
• Pressure to contact “customer support” via unsecured channels like WhatsApp or unverified phone numbers.
• No official mention of such reversals or refunds on your mobile banking or UPI app.

What Happens to Victims

Victims of this scam often experience immediate financial loss, sometimes amounting to several thousands of rupees in INR. Since UPI transactions are instant and typically irreversible, recovering money is extremely difficult once transferred to fraudsters.

Emotionally, victims suffer stress, frustration, and sometimes embarrassment, especially as many scams exploit users’ trust in digital payments and fear of penalties. SIM swap frauds are also sometimes involved, where fraudsters take control of the victim’s phone number to intercept real OTPs, further escalating the damage.

This scam exposes the dangers of blind trust in SMS alerts and highlights the need for scrutiny before acting on any payment reversal notices, especially for UPI payments tied to Aadhaar-linked bank accounts.

What RBI and CERT-In Say

The Reserve Bank of India has repeatedly warned users to be cautious about phishing attempts involving UPI and mobile wallets. RBI emphasizes never to share OTPs, PINs, or banking credentials with anyone, and to verify alerts directly through official banking apps.

CERT-In and I4C have put out advisories on rising phishing scams that mimic official transaction alerts. They recommend users to report suspicious messages immediately and use the IN-SCERT 1930 helpline for cybercrime-related assistance.

For any suspicious activity, users should contact their bank’s official customer support and avoid interacting with unsolicited messages claiming urgent refunds or reversals.

How to Protect Yourself

1. Verify SMS sender numbers: Always check if the SMS is from official shortcodes or verified sender IDs.
2. Never transfer money on the basis of SMS alone: Cross-check any refund or reversal alerts directly on your UPI or mobile wallet app.
3. Do not share OTPs or PINs: Legitimate services never ask for OTPs or passwords via SMS or WhatsApp.
4. Avoid responding to unknown WhatsApp or phone contacts: Do not click on links or call unknown “customer service” numbers.
5. Enable UPI transaction alerts within your bank app: This helps verify every transaction independently.
6. Regularly update your phone's security and apps: Keep apps like BHIM UPI, Paytm, and Google Pay updated.
7. Report suspicious messages: Forward fake SMS to your bank’s fraud cell or report them to cybercrime.gov.in.

What to Do If You've Been Targeted

1. Immediately contact your bank or UPI app customer care and inform them about the fraudulent transfer.
2. Lodge a complaint with the cybercrime helpline at 1930 or visit cybercrime.gov.in to file an online cybercrime complaint.
3. Contact your mobile operator to check if a SIM swap or related fraud has occurred and freeze or block compromised SIMs.
4. Change all your online banking and UPI PINs immediately.
5. Inform CERT-In or I4C via their official channels to help track such scams.
6. File a police complaint with all evidence including screenshots, SMS, and transaction details.

Frequently Asked Questions

Q1: Can M-Pesa Fake SMS scams happen in India even though M-Pesa isn’t common here?

Yes. While M-Pesa itself is rare in India, scammers copy the style and tactics of this scam for UPI wallets and bank alerts, making the threat very real.

Q2: How can I confirm if a reversal SMS is genuine or fake?

Check the sender ID carefully, verify the transaction directly on your UPI app or bank statement, and never act solely based on SMS instructions.

Q3: What immediate steps should I take if I accidentally transferred money to a scammer?

Contact your bank and cybercrime helpline 1930 without delay to report the fraud and seek help in freezing or tracking the transaction.

Digital payment scams like the M-Pesa Fake SMS Reversal Scam are evolving rapidly. Always stay alert and verify any SMS asking for urgent refunds or reversals. When in doubt, verify suspicious messages first at BharatSecure.app — India’s trusted platform for detecting and avoiding digital fraud. Stay safe and pay smart!