How to Spot a Fake ZIPROF Invoice or MPesa Payment Scam

If you receive a message asking you to pay an invoice or a bill using MPesa, it's worth checking the details carefully before you send anything. Scammers sometimes send fake invoices or payment reminders that look like they came from your hosting provider, hoping you'll pay into the wrong account. Here's how to tell a genuine ZIPROF payment request from a fake one, and what to do if something looks off.

Signs a payment request might be fake

• It creates urgency, telling you your website or email will be suspended within hours unless you pay immediately.
• It asks you to pay to a personal MPesa number instead of a Paybill.
• The Paybill number or account number doesn't match what's on your actual ZIPROF invoice.
• It asks you to reply with your MPesa PIN, one-time password, or full MPesa statement.
• The sender's email address doesn't match ZIPROF's official domain, even if the display name looks right.
• It includes a link asking you to "log in" to confirm payment, which leads to a fake login page.
• The message has unusual spelling, odd formatting, or a generic greeting like "Dear Customer" instead of your name.

Never share your MPesa PIN or one-time password with anyone, including anyone claiming to be from ZIPROF support. ZIPROF will never ask for your MPesa PIN by email, SMS, or phone call.

How genuine ZIPROF payments work

ZIPROF's primary payment method is MPesa Paybill. To pay a real ZIPROF invoice, you always use the official Business Number (the Paybill number) and enter your own invoice number, including its prefix, exactly as it appears on your invoice, as the Account Number. You never need to send money to a personal phone number or a different Paybill to settle a ZIPROF invoice.

If a message asks you to pay somewhere other than the Paybill number and account number shown on your actual invoice in your client area, treat it as suspicious.

How to verify a payment request before you pay

1. Log in to your ZIPROF client area directly, not through a link in the message, and check your invoices there. Compare the amount, invoice number, and due date to what the message claims.
2. Check that the Paybill Business Number and Account Number in the message match exactly what's shown on the invoice in your client area.
3. Look closely at the sender's email address, not just the display name. If it doesn't match ZIPROF's official domain, don't trust it.
4. If you're unsure, don't reply to the message. Instead, open a support ticket from your client area or contact ZIPROF support through a channel you already know is genuine.
5. Never click a link in an unexpected invoice message to "log in" or "verify" your account. Type your client area address directly into your browser instead.

What to do if you've already paid a scammer

If you've sent money in response to a fake invoice, act quickly:

1. Contact Safaricom's customer care immediately to report the fraudulent transaction and ask about reversal options.
2. Note down the MPesa transaction code, the date and time, and the number or Paybill you paid.
3. Report the incident to your local police station or the Directorate of Criminal Investigations' cybercrime unit if the amount is significant.
4. Contact ZIPROF support with the details so they can confirm your invoice status and advise on next steps.
5. Check your actual ZIPROF invoice in your client area to confirm whether it's still unpaid, and settle it through the verified Paybill details once you're certain they're correct.

For details on paying a genuine ZIPROF invoice correctly, see How to Pay Your ZIPROF Invoice via MPesa.