A phishing email pretends to come from a bank, supplier, courier, or even your own hosting provider, with the goal of getting you to click a malicious link, open an infected attachment, or hand over a password, PIN, or payment detail. Business owners in Kenya are a frequent target, especially through fake invoice, delivery, and M-Pesa payment notices. Here is how to recognize one and what to do if it reaches your business email address.
Signs an Email Might Be Phishing
- The sender's display name looks familiar, but the actual email address behind it doesn't match the company it claims to be from.
- The message creates urgency or fear, such as threatening to suspend your account, cancel an order, or block a payment within hours.
- It asks you to confirm a password, PIN, card number, or other sensitive detail directly by email or through a linked form.
- It includes an unexpected attachment or a link that doesn't match the sender's real website when you hover over it.
- The greeting is generic ("Dear Customer") rather than using your name or business name.
- There are spelling mistakes, odd formatting, or a mismatched logo and tone compared to genuine messages from that sender.
If an email claims to be from ZIPROF about an invoice or payment, check it against the signs described in How to Spot a Fake ZIPROF Invoice or MPesa Payment Scam before acting on it.
How to Check a Suspicious Email Before You Act
- Hover your mouse over any link without clicking it. Your email client will usually show the real destination address at the bottom of the window or in a tooltip. If it doesn't match the sender's genuine website, don't click it.
- Click on the sender's name to reveal the full email address, not just the display name. A message claiming to be from a bank or supplier should come from that organization's actual domain.
- If the email asks you to make a payment or update account details, contact the company directly using a phone number or website you already know and trust, rather than replying to the email or using any contact details it provides.
- Never open an attachment you weren't expecting, even if the sender's name looks familiar. Contact the sender through a separate channel to confirm they actually sent it.
What to Do If You've Received a Phishing Email
- Do not click any links, open any attachments, or reply to the message.
- Delete the email, or mark it as spam/junk so your mail provider learns to filter similar messages in the future.
- If you clicked a link and entered a password, change that password immediately, and change it anywhere else you were reusing it.
- If the same sender keeps emailing you, create a mail filter to automatically block or move their messages. See How to Create a Mail Filter to Block or Sort Messages for the steps.
- Warn your staff if the phishing email was sent to a shared or department mailbox, so no one else on your team falls for the same message.
Never send your ZIPROF account password, M-Pesa PIN, or card details by email. ZIPROF will never ask for your password or PIN through an email, SMS, or phone call.
What to Do If You Already Responded or Lost Money
If you entered login details on a fake page, change that password right away and check your account's recent activity for anything you don't recognize. If you sent money or shared M-Pesa details because of a phishing message, report it to Safaricom through their official customer care channels and to your bank if a card was involved, as quickly as possible. Keep a copy of the phishing email in case you need it for a report.
Phishing attempts are not something a spam filter can catch every time, since they're designed to look legitimate. Staying alert to these signs, especially around invoices, deliveries, and payment requests, is the most reliable way to protect your business.