Betting companies in Kenya hold customer money and take payments through mobile money such as M-Pesa. That makes them a target. Fraud can come from a staff member, from a customer who abuses a bonus, from a thief who takes over a SIM card, or from a criminal who uses the company's own Paybill number to trick people. Each threat needs its own control. And each control can slow down honest customers.
How betting companies in Kenya prevent fraud
No single tool stops fraud. Operators use layers: rules for staff, checks at sign-up, limits on payments, and monitoring of how accounts behave.
Kenya's 2026 conduct rules make this a legal duty. A licensed company must run internal controls to detect and prevent money laundering, terrorism financing and fraud (regulation 95). It must tell the Gambling Regulatory Authority about any suspicious activity, suspicious transaction or fraud within 24 hours (regulation 90).
The rules set a floor. Above that floor, operators choose how tight to make each control. That choice is the hard part, because every extra check costs some honest customers.
Internal controls that stop staff fraud
Staff can misuse their access. For example, they can add money to an account or change a balance without approval. Four controls cut this risk:
- Maker-checker: one person starts a money move and a different person approves it.
- Access by role: staff can only reach the systems their job needs, such as crediting accounts or changing game results.
- Audit logs and regular checks: every change is recorded and reviewed.
- Whistleblowing: staff can report a colleague safely.
These controls cost customers nothing. Their only price is some extra work for staff.
Detecting bonus abuse and many accounts
Welcome bonuses and free bets attract people who open several accounts to claim them again and again. Operators look for the same device, the same IP address and matching account details across accounts.
These matches are risk signals. They are not proof. Many honest customers share a device, a home Wi-Fi connection or a public network, such as a cybercafé. A match should trigger further checks, for example confirming identity or reviewing the account's history. It should not automatically reject a bonus or ban an account.
KYC and identity checks in Kenya
KYC means Know Your Customer. In Kenya's 2026 conduct rules, regulation 82 sets these duties:
- Three checks for online gambling: a licensee must not allow anyone to take part in online gambling without an identity check, a location check and an age check (82(1)).
- Data sources and timing: the data used must come from reliable, independent sources that can be checked electronically. It must be used before the player account is activated and before the licensee receives any wagering deposit (82(2)).
- Winners: the identity of any winner must be verified before winnings are paid (82(3)).
- What verification includes: official identification documents, and confirmation that the person is not self-excluded and is legally eligible to gamble under the Act (82(4)).
Regulation 83 is a separate rule. It prohibits anonymous gambling, and the use of virtual assets for gambling or withdrawals, unless the regulator approves.
The rules do not say which tools to use. Operators can use methods such as a one-time code (OTP) sent to the phone, mobile money details and the national ID. Too many extra steps push honest customers away. A risk-based approach keeps the legal checks for everyone and adds stricter checks, such as a closer look before a withdrawal, when behaviour looks risky.
Payment fraud: the M-Pesa Paybill scam
One Kenyan risk specialist described a scam involving a betting company's Paybill. Fraudsters told tenants to pay their rent to the Paybill and to type the fraudster's own phone number as the account number. The money landed in the fraudster's betting wallet, and the fraudster withdrew it. The tenants lost their rent.
The scam worked because a Paybill payer types the account number themselves. In that case, the operator responded with a rule: funds are credited to the account linked to the phone number that sent the payment, whatever account number was typed. Under that rule, an honest customer who types a wrong number does not get the money in the account they meant.
This was one operator's control. Whether another operator can use the same rule depends on how its Paybill and its payment provider are set up. Operators should check with their provider what matching and crediting options exist before changing how payments are credited.
Paybill numbers also matter to the regulator. We reported that it wrote to Safaricom with the licensed companies and their approved Paybill numbers. For the wider payment picture, see mobile money success rates in African iGaming.
SIM-swap fraud and account security
In a SIM swap, a thief gets the victim's number moved to a SIM card the thief controls. The thief can then receive one-time codes and reach mobile money. One risk specialist said swaps were uncommon in the betting cases she had handled.
What customers can do
Safaricom's fraud advice tells customers to dial *100*100# to stop their SIM being swapped without them present. A customer also gets an SMS from 707 if someone tries to register a new line with their ID. Safaricom staff never ask for an M-PESA PIN.
What betting operators can do
Those steps protect the customer's line. A betting company does not run them. Operators need their own controls, where they can see the relevant changes. They should consider extra verification after a phone-number change, a new device, a password reset or a suspicious account recovery request. The check matters most before a large withdrawal. Honest customers who change phones will meet it, so it should be quick.
Identifying suspicious transactions
Limits help in two ways. They cap the operator's exposure, and they make strange behaviour stand out. Warning signs include a sudden jump in deposits, unusual stakes and betting that does not fit a player's history.
Money laundering has its own pattern. A player deposits a large sum, bets little or nothing, leaves the money for a day or two, and then withdraws it. That pattern is a signal, not proof. A genuine customer can also deposit and then change their mind. So a person must review the case before the operator acts or reports it. The conduct rules also refer to the Financial Reporting Centre, the body set up under Kenya's anti-money laundering law.
The role of AI in fraud detection
AI tools can sort accounts into risk groups and flag odd patterns faster than staff can. For example, a system could flag several new accounts that each deposit a similar amount from the same device and then ask to withdraw at the same time. It could also flag one account whose deposits suddenly jump far above its usual size, with almost no betting before a withdrawal request.
Each alert still needs human review. An analyst checks the account history, the device and the payment details. Then the analyst decides whether to hold the withdrawal, ask for more ID or clear the account. A machine can misread context, such as a shared phone, a family account or a one-off big win. We found no independent figures showing how well AI fraud tools perform in African betting, so treat vendor claims with care.
Fraud prevention and responsible gambling
The same signals serve both goals. A sudden jump in deposits can mean fraud, or it can mean a player is losing control. Kenya's rules require real-time player tools. These include daily, weekly and monthly deposit limits, loss and session limits, and reality checks. They also include self-exclusion of at least 24 hours, linked to a national register (regulation 84). We covered the pressure on these tools in our report on faster play and self-exclusion.
What Kenyan betting operators should prioritise
- Staff controls first. Use maker-checker on every manual money move, and keep audit logs.
- Treat ID checks as the legal minimum. Add extra steps only where risk signals call for them.
- Review payment matching with your provider. Check how your Paybill credits payments and what options exist to match the sender's phone number. Warn customers about the account number scam.
- Flag, then review. Treat device and IP matches as signals that start a check. They are not grounds to reject or ban on their own.
- Add checks after account changes. Look harder at large withdrawals that follow a new phone number, a new device or a suspicious account recovery.
- Keep people in charge of AI alerts, and link fraud signals to safer gambling tools.
Information, not legal advice. Check the rules with the Gambling Regulatory Authority. 18+ only. Gamble responsibly.
