Arm-twisted Mpesa/M-banking withdrawals


#1

This past weekend i got the following text from a friend of mine.

Now this looked a bit odd coz normally when my friend is in a fix and needed some cash he would always call personally and ask for the cash of which we would then agree on the terms of payment and such like things. I did not respond or call him immediately coz i was on the road at the time traffic had just opened up so i placed my phone aside and decided to call him later when i stopped.

About an hour later i called his phone which went mteja, called up some of our mutual friends who confirmed they had also received the same distress mpesa text and on calling back his phone was mteja. Some of them had even sent mpesa to his phone. Worried, we decided to call his brother who lives with him and to our relief, our boy (lets christen him Jeff) was safe and sound albeit a little shaken.

So What Transpired?
Well Jef was invited to a house warming party in Thika that Friday and instead of driving there he decided to use public means. On arriving in Thika town at around 9pm he alighted and immediately dialed his friends for directions and this was where things took a turn for the worst. Some two individuals sprung out of nowhere, roughed him up pushing him into a dark alley where a gun was pointed to his head and a knife on his stomach.

The first thug hastily proceeds to remove Jeffs phone from his pocket, forced him to pattern-unlock it then gave it to his accomplice to peruse it. After just a few seconds of perusal, thug no.2 asks Jeff for his Mpesa pin cautioning him that giving the wrong pin would get him stabbed severally and shot. Scared for his life, Jeff agrees and gives them his Mpesa pin of which its authenticity is verified by thug(2) who checks the Mpesa balance using the pin. He then asks him for his Eazzypay and Coop bank pins since the 2 apps were spotted in his app drawer, Mpesa Ledger was not spared either. Thug(2) then proceeds to check Jeffs text messages of which Barclays Banking texts were found. Jeff was asked to produce his Barclays pin as well as its USSD code to access it since there was no Barclays Banking app installed on his phone. The banking app pins were all verified by checking their account balances. Thug (1) then emptied Jeffs pockets of all his valuables (it’s a good thing Jeff never had his ATM cards on him). As Jeff was pleading with them to spare his life they roughed him up again, tore his clothes and used them to tie his hands, legs and mouth-gagged him to immobilize & shut him up.

The two thugs then left with his phone where they proceeded to withdraw the cash at various Mpesa Agents in town that night. Jeff was later found by street boys who untied him and guided him to a police post nearby.

The damage
Jeff woke up saturday morning in hospital with calls from friends through his brothers phone asking whether he was alright and when to expect their cash back. This prompted Jeff to have his Safaricom line blocked, bank accounts suspended and engage the CID in the whole matter. As we speak Jeff has around 115k mpesa to refund to swindled friends, KCB Mpesa and Mshwari loans to pay back (note he has never taken any loans from these two) and an undisclosed amount of cash from his various banks withdrawn.

Prevention

  1. Hide banking apps from your phones App Drawer using the various hiding apps/ Launchers available on the playstore.

  2. Make a habit of deleting confirmation banking texts from your phone after you are done with them.

  3. Use a different smartphone to install your most used banking apps (preferably one lying around in the house) or a kabambe phone to perform USSD type banking transactions. These phones can only be used in the house and switched off after you are done. (make sure you password protect them)

  4. Refrain from always carrying your ATM card in your wallet. Only carry your ATM card when you need it otherwise always leave it in the house somewhere where even your houshelp cant get to.

  5. Make use of ATM Machines around your area of residence instead of relying on the ones in the City Centre. This reduces the amount of time you have your ATM card on you.

  6. Avoid keeping huge amounts of cash in your Mpesa Wallet. Always have a threshold and transfer excess cash to your bank account

  7. If you are the kind that goes to parties leave your smartphone at home and go with your kabambe phone


#2

Thanks for the info. I hope your friend is alright.


#3

He’s fairing on well we are just thankful they didn’t take his life


#4

I’m sorry about your pal’s predicaments and I pray for his full recovery.

  1. However, when it comes to personal safety (even though kisirani inaeza kupata out of nowhere) the thing I usually do is avoid going to places I don’t know about, late. That is a place you don’t know about and you are not used to. It’s always good to show up early or have someone accompany you there.

  2. I always have the emergency mode running on the background and should anything go wrong like in your friend’s case, all I need to do is press the power button three times successively and the phone will start to take stills of both back and front camera and record sound and activate the continuous tracking of the phone using GPS. That would make sure that the phone takes photos of us when the thieves are there confirming the pins et al.

  3. I have also obtained a new idea from this. I think I’m going to install that app that crashes apps when you want to use them. All you have to do is install the app and pick the apps to crash and activate them. The main app will be hidden from the phone’s menu and when you want to access any app including the Safaricom menu everything will just crash.

Bottom line, he should avoid visiting places he does not know about at such hours of the night. I was once mugged at gunpoint and I learnt best. The thugs were good though. They only checked my bag hoping to get a laptop but luckily niliacha nyuma, took away my keys, had 6K with me wakachukua and told me to get lost nikijaribu ku raise alarm they would shoot me from behind.

ooh! I gave them my phones wakakataa. They did not even bother to check.


#5

This is a story that has prompted me to find out ways to protect your self from such cases. @deewinc I would
like to know how you have emergency mode running, setting up and such.

I would also like to gather information from anyone on ways to prevent such cases from happening.


#6

Interesting, what is the name of the app?


#7

This will only piss off the thugs and the might harm you. Like these days if you get mugged na waki pata uko na 200/= tu, watakufagia!

They best thing I guess is to carry less money and to report cases to Safaricom, your bank and the police immediately so that they can block all transactions.


#8

I’d also like to find a Non-Launcher App that hides banking apps from view in the app drawer and doesn’t have such obvious names like ‘Hide Apps’ or ‘App locker’.

Nova Launcher is the only app i know that can hide your banking apps from prying eyes. Problem is its a launcher app and getting those banking apps back so as to use them is a hectic process.


#9

I archive texts with bank information or anything sensitive. My phone actually has a secure zone where you can install apps separately, and the switch between the default open zone and the secure zone can be hidden on the notifications bar. Bank apps all get installed on the secure side, meaning that you really have to look to find the instances running to find out that the apps are really there.
If you’re going somewhere new, tell whoever it is to send you the location on Whatsapp or to drop a pin on Google Maps. Identify a route that you will use to get there, and don’t talk on the phone asking for directions while you’re on your way. People hear things. It helps to be cautious.
Don’t assume anything. You can be mugged anywhere. The people most likely to set you up are those who know that you’re new in the area…
Ostentatious displays will get you targeted. Don’t flash money around, don’t talk about money on the phone, don’t do anything that will attract attention to you. And maintain situational awareness. If you get a gut feeling that something is wrong, make sure that you can identify a clear path if you need to escape.


#10

Wow! Wish phones had a distress button to alert friends if in trouble


#11

This sounds like good content for a video tutorial :slight_smile:


#12

Yup! If only I would answers, now!


#13

How do you archive texts I have seen apps that backup the texts but restoring does not work, they send them to gmail which converts them into one big insha making it hard to tell the separate texts.


#14

Hard of messages? The app by Google? Try it


#15

Guys I’m pretty busy for today, when I find time tomorrow I will show you how emergency mode works. Also, I will try check out the app for crashing apps and let you know. I once used it like 3 years ago. I have forgotten the name of the app. I will try use for it.

For now, this works perfect when you have a Samsung. If your device does not have KNOX by default, you can download Secure Folder from Playstore. Not sure if it supports other phone makes other than Sammys. I think this is much safer than having an app to crush apps. But I will share it tomorrow when I’m free. Closing the week right now.

UPDATE: Here is something useful. It works the same way in Lollipop, Marshmallow, and Nougat


#16

This works only for Samsungs? Alaa! Are you trying to make us buy the S8?


#17

hehehe not really. I’m not sure which Sammys have it but from the Grand Prime the feature should be there.


#18

To those who wanted the fake app crusher. You can even set the icon of the app to hide and only show up after dialing some code that the app gives you before hiding.


#19

SMS backup and restore app on play store does that for me, very useful when I’m moving across Android devices. Does it for SMS and call log.


#20

A friend’s phone was stolen at night in April, same thing happened. All his contacts received a txt message requesting 6K for an emergency.
Unfortunately, the thugs kept the phone ON for the following day… they pick but they dont say a thing.

The owner didn’t bother to replace the line or report the case… he assumed the phone once gone its switched off. He made a mistake not alerting friends about the phone as he stayed home keshoye siku mzima… people sent money pia yeye anaendelea kulipa deni alitumiwa Mpesa!