tag:blogger.com,1999:blog-4854181385517767691.post6666335319641359379..comments2011-05-09T21:29:11.164+03:00gmeltdownhttp://www.blogger.com/profile/16262599035915984050noreply@blogger.comBlogger7125tag:blogger.com,1999:blog-4854181385517767691.post-26443481829212787862011-05-09T21:29:11.164+03:002011-05-09T21:29:11.164+03:00I hope I&#39;m wrong, but irrespective of whether sms confirmation message was genuine or not, why would an MPESA agent pay out ?<br />Are the agents not suppose to key in the confirmation supplied by customer on the MPESA system and than the system would validate same and advise if Agent should honor it or not. Am I missing something here?Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-4854181385517767691.post-73711322629144306702010-08-12T10:43:08.825+03:002010-08-12T10:43:08.825+03:00Correction: The M-PESA fraud tool place on 1st Feb 2010 and not 2009 as earlier indicatedgmeltdownhttp://www.blogger.com/profile/16262599035915984050noreply@blogger.comtag:blogger.com,1999:blog-4854181385517767691.post-39412504033500951142010-02-12T10:19:42.615+03:002010-02-12T10:19:42.615+03:00The most basic education to the Agent HAS to be to check the ID of the sender of the SMS.<br /><br />If it is sent by MPESA, it would normally contain an MPESA sender ID.<br /><br />If it is sent by a fraudster then it would contain the Fraudsters Mobile number.<br /><br />This is one of the most obvious fraud possibilities in launching such services and I am surprised that it wasn&#39;t foreseen and the agent trained accordingly.<br /><br />I realise that you may think that even with training the Agent may omit seeing the sender ID on a per transaction basis, but then that is the fear that needs to be drilled into the agent that you cannot afford to miss out on seeing who is the sender of the SMSFarhadnoreply@blogger.comtag:blogger.com,1999:blog-4854181385517767691.post-24666987111196690572010-02-10T03:53:31.109+03:002010-02-10T03:53:31.109+03:00I thought that the SMS was encrypted and could ONLY be deciphered by the SIM application?<br /><br />Are you saying that the thieves got around this?Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-4854181385517767691.post-11673049677561288442010-02-09T09:33:36.232+03:002010-02-09T09:33:36.232+03:00@kipsang sorry for delayed response. You may go ahead and repost. It may have been prefferatble to simply link to this post but you may repost as you wish.<br /><br />@anon 9.24am, am informed that the fake Safaricom guys did not gain access to the dispensing handset but true to your hypothesis, there was a fake contact labelled M-PESA on the handset. Its still unclear how it got there eg a VCARD sent and saved inadvertently. What is puzzling now is the thought that a dispensing handset should be allowed to receive SMS texts from an origin other than the Safaricom system.<br /><br />Me thinks M-PESA agents are highly exposed to fraud and theft from employees and such tricksters. Several such incidents practically eat away the float deposited at safaricom and they either inject more capital of they are out of businessgmeltdownhttp://www.gmeltdown.comnoreply@blogger.comtag:blogger.com,1999:blog-4854181385517767691.post-67136922239902056412010-02-02T18:54:57.652+03:002010-02-02T18:54:57.652+03:00This is how the tricks works : -<br />The conmen visit your premise pretending to be from Safaricom or use any other excuse to handle the dispensing phone. Once they access the phone they save themselves in your phone book by the name mpsesa. Then they edit a normal mpesa message and send as a normal sms to the dispensing phone. what you see is actualy an sms message bearing the name mpesa but if you scroll the message further down you see the actual number of the sender. a very cheap trick but higly devastating.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-4854181385517767691.post-32483563131540937792010-02-02T09:24:08.958+03:002010-02-02T09:24:08.958+03:00Dear gmeltdown,<br /><br />I would like to repost this article followed by a link to your blog for publication on mine (http://kipsang.wordpress.com). <br /><br />Hence this comment to ask your permission to do so.<br /><br />Kind regards,<br /><br />Kipsang.kipsanghttp://kipsang.wordpress.com/noreply@blogger.com