Safaricom Fires 118 Employees Over Fraud as Telco Tightens Internal Controls
Safaricom has dismissed 118 employees over fraud-related offences in the financial year ended March 2026, signalling an intensified crackdown on misconduct as Kenya’s largest telecommunications company strengthens measures to protect its operations, customer information and mobile money business.
The dismissals, disclosed in the company’s 2026 Sustainable Business Report released on October 27, 2026, increased from 113 employees in the previous financial year. The latest figures highlight the continuing challenge of preventing internal fraud within a company that operates one of Kenya’s most widely used digital financial services platforms, M-PESA.
According to the report, Safaricom took disciplinary action against employees whose conduct violated company policies and employment obligations. The offences identified include theft, falsification of company records, unauthorised access to customer call records, breaches of security and compliance rules, and conduct amounting to criminal offences.
The telecommunications company also reported three disciplinary warnings during the year and referred 14 cases to law enforcement agencies, compared with seven referrals in the previous financial year. The increase in referrals suggests that more cases were escalated to external authorities for further action.
The disclosures come as fraud remains a major concern for businesses operating in Kenya’s increasingly digital economy. Mobile money transactions, electronic communications and customer databases have become essential parts of everyday life, making the protection of financial information and digital systems a priority.
Safaricom’s latest report offers insight into how the company investigates suspected misconduct, disciplines employees and works to reduce fraud-related losses.
However, the report does not establish that every employee dismissed was involved in the same type of offence, nor does it link all the dismissals directly to the company’s financial recoveries. Each reported figure relates to a particular aspect of Safaricom’s broader fraud-management and compliance programme.
Employee dismissals rise as fraud remains a major concern
The dismissal of 118 employees represents an increase of five cases compared with the 113 dismissals recorded in the previous financial year.
Although the increase may appear modest, it forms part of a wider effort by Safaricom to strengthen internal controls and enforce standards of conduct among its workforce.
Employees in telecommunications companies may have access to sensitive information, customer accounts, internal systems and operational processes. Such access is necessary for service delivery, but it also creates risks if individuals misuse their privileges or fail to follow established security procedures.
Safaricom’s report identifies several categories of misconduct that may result in dismissal. These include theft, the falsification of company records, unauthorised access to customer call records and violations of security and compliance requirements.
The company also lists criminal conduct among the grounds that may lead to disciplinary action.
Falsifying records, for instance, can undermine the reliability of company information and make it harder to detect irregular transactions. Unauthorised access to customer records can also threaten privacy and undermine public confidence in the company’s ability to safeguard personal information.
The company says the appropriate disciplinary outcome depends on the investigation findings and the nature of the misconduct. Possible outcomes include warnings, dismissal and referrals to law enforcement where suspected criminal conduct warrants further investigation.
These measures are particularly important for a telecommunications operator whose services support personal communication, business transactions and financial activities for millions of customers.
The figures do not mean that every dismissed employee was convicted of a crime. Employment disciplinary action and criminal prosecution are separate processes, and any criminal allegations referred to the authorities must be handled through the relevant legal procedures.
Cases referred to law enforcement double
Beyond the employee dismissals, Safaricom referred 14 cases to law enforcement agencies during the financial year ended March 2026. This was twice the seven referrals reported in the preceding financial year.
The referrals indicate that the company escalated certain matters beyond its internal disciplinary structures for possible external investigation or enforcement.
Such referrals can be important where suspected conduct may involve criminal offences that require investigation by the relevant authorities. Internal disciplinary committees can determine employment-related consequences, but they do not replace the role of police investigators, prosecutors and courts in criminal matters.
The report does not provide a detailed breakdown of all 14 referrals or establish the outcomes of each case. It would therefore be inaccurate to assume that every referral resulted in an arrest, prosecution or conviction.
Nevertheless, the increase shows that Safaricom is using both internal procedures and external reporting mechanisms to address suspected wrongdoing.
The company also reported issuing three disciplinary warnings during the year, compared with none in the previous financial year. These figures reflect the range of outcomes recorded through its disciplinary processes.
Safaricom’s approach highlights the importance of having clear procedures for handling suspected misconduct. Such procedures help organisations establish what happened, assess the available evidence and determine the appropriate response.
For a company operating in a highly regulated sector, effective investigation and reporting systems are essential to maintaining compliance and protecting customers.
How Safaricom investigates suspected fraud
Safaricom’s 2026 Sustainable Business Report outlines a process through which suspected fraud can be identified, investigated and referred for disciplinary action.
Cases may originate from customer complaints or be detected proactively through the company’s fraud-management system. This allows the company to respond to concerns raised by customers while also using internal monitoring to identify suspicious activities.
Once a case is flagged, a manager or the Ethics and Compliance team investigates the matter and recommends whether it should be addressed informally or through a formal disciplinary process.
The investigation findings are documented, with supporting records prepared for further review. The final report and relevant evidence are then forwarded to Human Resources for appropriate action.
A disciplinary committee determines the outcome in accordance with the company’s policies and procedures.
Depending on the circumstances, the outcome may include a warning, dismissal or referral of a suspected criminal offence to law enforcement agencies.
The process is intended to ensure that disciplinary decisions are based on investigation findings rather than suspicion alone.
This is particularly important in a company where employees may work across different departments and handle sensitive information. An allegation of misconduct needs to be examined carefully to establish the relevant facts and determine whether company rules were breached.
A structured process also helps distinguish between different types of incidents. Some matters may involve procedural failures that can be addressed through corrective action, while others may warrant formal disciplinary proceedings or external investigation.
For employees, clear procedures provide a framework for understanding the allegations and the potential consequences of their actions. For the company, they support accountability and consistency in handling cases.
Safaricom’s disclosures therefore illustrate the importance of combining fraud-detection technology with human investigation, documentation and appropriate disciplinary oversight.
Safaricom recovers Sh953 million linked to inflated agent commissions
The report also reveals that Safaricom recovered Sh953 million linked to inflated agent commissions through monitoring and data analytics during the financial year.
The amount was lower than the Sh1.7 billion reported in the previous financial year.
Agent commissions are an important part of the mobile money ecosystem because M-PESA agents provide services that allow customers to deposit and withdraw money and conduct other transactions.
The accuracy of commission payments is therefore essential to maintaining trust and ensuring that the system operates efficiently.
Safaricom’s recovery of funds linked to inflated commissions suggests that its monitoring systems identified irregularities in payments and enabled the company to take corrective action.
Data analytics can help companies identify patterns that might otherwise be difficult to detect through routine manual checks. By analysing transaction records and payment patterns, businesses can flag unusual activity for further investigation.
However, the report does not establish a direct connection between the Sh953 million recovery and the 118 employee dismissals. It would be misleading to suggest that all the recovered money resulted from the conduct of the employees who were dismissed.
The figures relate to separate aspects of Safaricom’s broader efforts to manage fraud risks and protect company resources.
The recovery nevertheless demonstrates the potential value of continuous monitoring and data-driven controls in identifying irregular financial activity.
It also highlights the importance of accountability across the wider agent network, where reliable commission calculations and transparent payment procedures are necessary for the sustainability of mobile money services.
For Safaricom, the challenge is not only identifying irregular payments after they occur, but also strengthening systems to prevent similar incidents in the future.
Fraud reduction target remains a challenge
Safaricom reported an 82 per cent reduction in fraud incidents during the financial year, against a target of 90 per cent.
Although the company made progress, the result fell eight percentage points short of its stated target.
The report also indicated that Safaricom recovered 46 per cent of reported fraud losses.
These figures show that fraud prevention remains an ongoing challenge, even as the company invests in monitoring, investigation and employee awareness programmes.
Fraud can take different forms, ranging from manipulation of internal records to attempts by external criminals to deceive customers or gain unauthorised access to accounts.
Some incidents may involve weaknesses in processes, while others may exploit human behaviour or technical vulnerabilities. As digital services expand, criminals can also adapt their methods in response to new security measures.
For this reason, fraud prevention requires several layers of protection. Companies need secure systems, effective access controls, reliable identity verification, regular audits and clear procedures for reporting suspicious activity.
They must also ensure that employees understand the risks associated with their responsibilities and the consequences of violating security requirements.
Safaricom’s reported reduction in fraud incidents suggests that its interventions had an impact, but the failure to meet the 90 per cent target indicates that further improvements are needed.
The recovery of less than half of reported fraud losses also points to the importance of preventing incidents before money is lost. Recovering funds after irregularities have occurred can be difficult, particularly where transactions involve several accounts or external actors.
The company will therefore need to continue strengthening preventive controls alongside its investigation and recovery efforts.
M-PESA and the growing importance of customer protection
Safaricom’s fraud-management efforts are particularly important because M-PESA plays a major role in Kenya’s digital economy.
Individuals use mobile money to send funds to family members, pay bills, purchase goods and services, receive business payments and manage everyday expenses. Businesses also rely on digital transactions to collect payments and support their operations.
This widespread use means that customers expect transactions to be secure, personal information to remain confidential and suspicious activity to be addressed promptly.
Fraud involving mobile money can cause financial losses and undermine trust in digital services. For some customers, losing money through an unauthorised transaction can have serious consequences, especially where the funds were intended for rent, food, school fees or other essential expenses.
The dismissal of employees over fraud-related offences is therefore part of a broader conversation about safeguarding the systems that support digital financial services.
Safaricom’s report also identifies customer fraud risks that require measures beyond internal disciplinary action. Criminals may attempt to manipulate customers into revealing sensitive information or authorising transactions that benefit the fraudster.
Such schemes demonstrate that fraud prevention cannot rely on technology alone. Customers, agents, employees and service providers all have roles to play in maintaining security.
Companies must make it easier for customers to report suspicious activity, investigate complaints promptly and communicate clearly about the steps people can take to protect their accounts.
At the same time, employees must follow strict rules governing access to customer information. Access should be limited to legitimate work-related purposes, and inappropriate use of confidential information should be investigated.
For Safaricom, maintaining customer confidence will depend on the effectiveness of these measures and its ability to respond when problems arise.
Cybersecurity threats remain another major concern
The report also highlights the scale of cybersecurity monitoring undertaken by Safaricom during the financial year.
The company said it monitored approximately 1.25 billion cyber intrusion attempts and investigated more than 130,000 security events.
These figures illustrate the pressure facing telecommunications companies as criminals and other malicious actors seek opportunities to exploit digital infrastructure.
Cybersecurity threats can include attempts to gain unauthorised access to systems, disrupt services, steal information or exploit weaknesses in digital platforms.
Safaricom reported that it mitigated distributed denial-of-service attacks without material customer impact during the year. Such attacks seek to overwhelm online systems with traffic, potentially making services unavailable to legitimate users.
The company also reported no confirmed material cybersecurity breaches affecting customer data or business operations during the financial year.
However, the volume of monitored intrusion attempts and investigated security events shows why continuous monitoring and rapid response remain necessary.
Cybersecurity teams must identify suspicious activity, assess potential risks and take action to prevent incidents from developing into more serious breaches.
The company also needs to ensure that employees and third-party partners understand the security requirements associated with their access to its systems.
The distinction between an attempted intrusion and a successful breach is important. A high number of monitored attempts does not mean that all of them succeeded, just as an investigation into a security event does not automatically establish that customer information was compromised.
Safaricom’s disclosures indicate that it treats cybersecurity as a continuing operational priority alongside fraud management, data protection and regulatory compliance.
Employee training and ethics programmes
Safaricom has also invested in employee education as part of its efforts to strengthen ethical conduct and prevent fraud.
According to the report, 98 per cent of employees participated in the company’s annual ethics awareness programme during the financial year, matching the previous year’s level.
The company also conducted an Ethics and Fraud Awareness Week involving its chief executive and senior leadership.
Such programmes are designed to reinforce the standards expected of employees and explain the risks associated with misconduct, corruption, misuse of information and other violations of company policies.
Training can help employees understand how to identify suspicious activity, report concerns and comply with internal procedures.
It can also clarify the boundaries surrounding access to customer information and the handling of confidential company records.
Safaricom extended elements of its ethics and compliance engagement beyond its direct workforce to business partners, dealers and M-PESA agents.
The company reported that it trained 141 suppliers in business-partner know-your-customer and ethics requirements. It also reached 339 dealers and 972 M-PESA agents through relevant training activities.
These initiatives reflect the importance of managing risks across a business ecosystem rather than focusing exclusively on permanent employees.
Suppliers, agents and other partners may interact with company systems, customers or operational processes. Ensuring that they understand applicable standards can help reduce vulnerabilities and strengthen accountability.
However, training alone cannot eliminate fraud. Its effectiveness depends on whether employees and partners apply the lessons in their daily work and whether management consistently enforces the rules.
The dismissals and referrals disclosed in the report therefore sit alongside a wider effort to combine education, monitoring, investigation and disciplinary action.
What the dismissals mean for employees and employers
The Safaricom disclosures also highlight the importance of workplace accountability and fair disciplinary procedures.
Employers have a responsibility to protect their resources, maintain secure systems and ensure that employees comply with legitimate workplace policies. Where misconduct is established, disciplinary action may be necessary to protect the organisation and prevent similar incidents.
At the same time, employees are entitled to fair treatment and due process.
Kenya’s Employment Act sets out procedural requirements for termination on grounds of misconduct. Section 41 provides for an employee to be informed of the reason an employer is considering termination and to be given an opportunity to respond, including with the assistance of another employee or a shop-floor union representative of their choice, as applicable.
The law also requires the employer to hear and consider the employee’s representations before termination or summary dismissal for misconduct, subject to the relevant statutory provisions.
The existence of an allegation does not, by itself, establish that misconduct occurred. Employers must assess the evidence and follow the applicable disciplinary procedures before reaching a decision.
Similarly, an internal dismissal does not automatically amount to a criminal conviction. Where a suspected offence is referred to law enforcement, investigators and prosecutors must follow the relevant legal process.
These distinctions are important in interpreting Safaricom’s report. The 118 dismissals represent employment-related outcomes recorded by the company, while the 14 referrals concern cases escalated to law enforcement agencies.
The report does not state that every dismissed employee was prosecuted or convicted, and the figures should not be interpreted as proof of criminal guilt in every case.
For other employers, the disclosures provide a reminder of the importance of clear workplace policies, secure access controls, reliable reporting channels and fair disciplinary processes.
Safaricom’s dismissal of 118 employees over fraud-related offences in the financial year ended March 2026 highlights the continuing challenge of protecting corporate resources and customer information in Kenya’s digital economy.
The figure increased from 113 dismissals in the previous year, while referrals to law enforcement agencies doubled to 14. The company also issued three disciplinary warnings and recovered Sh953 million linked to inflated agent commissions through monitoring and data analytics.
Safaricom reported an 82 per cent reduction in fraud incidents against a target of 90 per cent, while recovering 46 per cent of reported fraud losses. It also monitored approximately 1.25 billion cyber intrusion attempts and investigated more than 130,000 security events.
Together, these disclosures illustrate the scale of the company’s efforts to strengthen internal controls, improve cybersecurity and protect its mobile money operations.
The report also demonstrates that tackling fraud requires more than dismissing employees after misconduct is identified. Effective prevention depends on secure technology, employee training, transparent investigations, responsible data access and cooperation with relevant authorities.
As Kenyans continue to rely on digital financial services for everyday transactions, the ability of telecommunications companies to protect customer information and respond to suspected wrongdoing will remain critical.
For Safaricom, the next challenge will be translating its monitoring and disciplinary measures into further reductions in fraud, stronger recovery of losses and sustained public confidence in its services.
