{"success":true,"data":{"id":"ke-mpesa-paybill-redirect-lure","label":"Fake M-Pesa Paybill number swap lure — \"Paybill has changed / nambari ya M-Pesa imebadilika\" pretext directing victim to update AP record to attacker Paybill. ~30M M-Pesa active users in Kenya. Detection: M-Pesa / Paybill / Lipa na M-Pesa brand + redirect / update narrative. Source: Red-Team R8 multi-agent council C3 (KE payment-rail specialist); CBK M-Pesa risk bulletin 2024.","description":"Fake M-Pesa Paybill number swap lure targeting Kenyan businesses and payment recipients. The phish narrative arrives as: \"Our M-Pesa Paybill number has changed — please update your records to the new Paybill [XXXXXX] immediately to avoid payment disruption,\" or \"Nambari ya M-Pesa Paybill imebadilika — tafadhali sasisha rekodi yako hadi Paybill mpya [XXXXXX]\" (M-Pesa Paybill number has changed — please update your records to the new Paybill). The attacker registers a new Paybill number and tricks AP staff into redirecting future M-Pesa payments. ~30M M-Pesa active users in Kenya; CBK M-Pesa risk bulletin 2024 documented this exact vector. Detection: m-pesa / mpesa / lipa na m-pesa / safaricom pay / paybill / till number brand AND \"Paybill (number has) changed\" / \"new Paybill\" / \"updated Paybill/mpesa number\" / nambari mpya ya paybill / \"please update (the) Paybill/mpesa\" narrative. Source: Red-Team R8 multi-agent council C3 (KE payment-rail specialist).","tier":"danger","category":"other","isThin":false}}