How To Avoid Mobile Money Fraud in Tanzania (2026)

Mobile money is the default way Tanzanians hold and move money. That also makes the wallet on your phone the single most attractive target a fraudster has, and the uncomfortable truth is that most successful mobile money fraud in Tanzania is not a hack. Nobody breaks the encryption. Instead, somebody talks you into approving the transaction yourself, or quietly takes control of the phone number your wallet is attached to.

That distinction matters, because it tells you where your defences actually need to be. This guide covers the scams that genuinely take money in Tanzania, the one habit that stops most of them, and — the part almost nobody gets right — the three completely separate places you have to report, depending on what was taken.

Start here: reporting is three lanes, not one

When something goes wrong, Tanzanians usually make one call and assume it is handled. It is not, because three different bodies own three different pieces of the problem, and each has its own clock.

Your money is the Bank of Tanzania's territory. Complaints about a wallet debit, a transfer that vanished, or a fraud loss go to your provider first under the Bank of Tanzania (Financial Consumer Protection) Regulations, and then to the Bank of Tanzania itself.

Your phone number is the TCRA's territory. Scam calls and messages, a SIM registered in your name that you never asked for, or a SIM swapped out from under you are communications matters, and the Tanzania Communications Regulatory Authority handles them.

The crime belongs to the Tanzania Police. TCRA states plainly that all criminal matters, fraud included, are resolved by the Police, and that a victim should report to a police station to be given an RB number and an assigned investigator.

Most people do only the first, and only by phone. Doing all three, in writing, is what separates the cases that recover money from the ones that do not. Hold that thought — the full ladder is set out further down.

The scams that actually take money here

Fraud in Tanzania clusters into a small number of repeated patterns. Recognising the shape is most of the defence.

The impersonated agent or "provider staff" call. Someone rings claiming to be from Vodacom, Yas, Airtel or Halotel, or from your bank. There is a problem with your account, a reversal to process, a promotion to claim, an account about to be blocked. They need your PIN, or the code that just arrived by SMS. This is the single most common route by which money leaves a Tanzanian wallet, and it works because the caller sounds calm, official and helpful.

The fake credit and refund request. You get an SMS that looks like a payment notification. Moments later someone calls: they sent money to the wrong number, please send it back. The original SMS is fabricated — no money ever arrived — and the refund you send is real. Note that this is a different problem from genuinely sending money to a wrong number by mistake, which is a transfer error your provider must handle rather than a fraud.

Advance-fee offers. A job, a loan, a plot of land, a scholarship, a shipment stuck at customs. Everything is ready; there is just a processing fee, a registration fee, or a facilitation payment first. There is never anything on the other side of the fee. If a lender in particular asks for money before disbursing, that is a defining red flag — our guide on how to spot an unlicensed lender covers what a legitimate one looks like, and how to borrow money safely sets out the checks worth doing before you sign anything.

The manufactured emergency. A message from a relative's number, or a stranger claiming to be a nurse or a police officer: someone is in hospital, or in custody, and money is needed immediately. Urgency plus family is the most effective combination fraudsters have, because it is designed to stop you verifying.

Phishing links. A message asks you to verify or secure your account through a link. The page is a convincing copy, and it captures whatever you type. Providers do not ask you to re-enter wallet credentials on a web page reached from an SMS.

Investment and online-earning schemes. These overlap heavily with mobile money because the deposit is taken by wallet. If you are being promised guaranteed high returns, treat it as a scheme until proven otherwise; our guide to making money online in Tanzania separates the legitimate routes from the recruitment-driven ones.

Your PIN is the whole ballgame

Almost every scam above converges on one objective: getting you to say your PIN out loud, or to read back a one-time code.

No employee of any Tanzanian mobile money provider, bank, or regulator has any legitimate reason to ask for your PIN. Not to verify you, not to reverse a transaction, not to fix an error, not to release a promotion. There is no procedure anywhere in the system that requires it. The same goes for the one-time codes sent by SMS: a code exists precisely so that only the person holding the phone can authorise something, and reading it to a caller hands over that authority completely.

Treat these as absolute rules:

• Never say your PIN aloud, to anyone, ever — including agents at the counter and people who claim to be calling from the provider.
• Never read back an SMS code. Read the message body instead: it usually says what the code authorises, and that is often the moment you realise you are being played.
• Never let an agent enter a transaction on your behalf or handle your handset while a transaction is open. Key it in yourself.
• Never approve a transaction you did not initiate, no matter how the prompt is explained to you.
• Change your PIN if you have ever said it near anyone, and never use a birth year or a repeated digit.

Read every confirmation SMS before you accept anything. Confirm the name and the amount, not just that a prompt appeared. Fraud very often succeeds in the gap between the story you are being told on the phone and what the prompt on your screen actually says.

SIM swap: the attack that needs no PIN

The uncomfortable exception to all of the above is the attack that never asks you for anything. If a fraudster can get your number issued onto a SIM they control, they can trigger PIN resets and receive every one-time code themselves. You find out when your handset drops to no service for no reason.

That sudden, unexplained loss of signal — especially if it follows a call asking you to confirm personal details, or a period of unusual phishing attempts — is the warning sign. It deserves an immediate response rather than a wait-and-see. Get to a service centre or call your provider from another phone and have the wallet frozen, then work through the reporting ladder below.

The related weakness sits at registration. TCRA has warned consumers to make sure their fingerprint is captured only once when registering, because dishonest agents have captured prints repeatedly to create additional registrations the customer never asked for — which then get sold on. When you register or replace a SIM, watch the scanner, and refuse a second capture you cannot get explained.

Check what is registered in your name: *106#

This is the most useful thing in this article and it costs nothing.

TCRA operates *106# on every network. Dial it, choose option 3, and you get the list of phone numbers registered against your NIDA citizenship number. If numbers you do not recognise appear on that list, someone has registered a SIM using your identity — and anything done with that SIM points back at you.

The remedy is specific: take it to the customer service desk of the relevant service provider, who will delete the unrecognised numbers biometrically. Do it in person, and do it promptly.

Make this a routine check, not a one-off. Once or twice a year takes two minutes and is the only way most people would ever discover a fraudulent registration in their name.

The 2025 rule that moved the burden onto your provider

Here is the change that most Tanzanians still do not know about, and it materially improves your position.

Until 2025, arguing about a fraud loss meant trying to prove your provider had done something wrong. The Bank of Tanzania (Financial Consumer Protection) (Amendment) Regulations, 2025 substituted regulation 35, and it now runs the other way. Where a consumer suffers loss through fraud or a scam, the provider must promptly refund the actual amount lost — unless it is proven that the loss occurred due to the consumer's own negligence or fraudulent behaviour.

The burden of proving negligence sits with the provider, not with you. That is a genuinely different starting point from "prove we were at fault", and it is worth quoting the regulation number when you complain.

Two related rules matter alongside it. Complaints about mobile financial services must be resolved within twelve hours under the substituted First Schedule — hours, not days. And responsibility rests with the provider that initiated the transfer, which forecloses the familiar runaround of being told to go and ask the receiving institution instead.

None of this makes negligence free. If you gave away your PIN after being warned, expect the provider to argue exactly that. But you are no longer required to prove your own innocence unprompted, and a refusal to refund now has to be justified.

Report the number: UTAPELI to 15040

TCRA runs a dedicated shortcode for scam numbers. Send an SMS with the keyword UTAPELI to 15040. You will be prompted to enter the phone numbers that were involved in the fraud.

This is not a complaint channel and it will not get your money back — it is intelligence. TCRA uses these reports to block offending numbers, and tens of thousands have been blocked through it. Reporting takes under a minute, and it is the only mechanism that stops the same number working the next person on the list. Do it even when you did not lose anything, and especially when you did not: near-misses are exactly the reports that arrive early enough to matter.

The escalation ladder, in order

Work through this properly. Skipping the written stage is the most common reason a claim stalls.

1. Freeze it. Call your provider immediately and have the wallet blocked. Speed matters more than completeness at this stage.
2. Report to the police. Get an RB number and the name of the assigned investigator. Fraud is a criminal matter and TCRA will direct you here regardless. If a handset or SIM was lost or stolen, obtain a loss report that includes the IMEI along with proof of ownership, then take it to your provider to have the account closed.
3. Complain to your own provider in writing. Not a phone call — an email or a letter, so that a record exists. Cite regulation 35 and ask for the refund of the actual amount lost. Get a reference number. Mobile financial services complaints carry a twelve-hour resolution deadline.
4. Escalate to the Bank of Tanzania. If the provider refuses or misses its deadline, you have fourteen days to refer the complaint to the Bank. Do not let this window pass. The Bank issues a written determination within sixty days, and a provider that fails to implement its decision faces a penalty of TZS 1,000,000 per day.
5. Escalate the communications side to TCRA. For scam numbers, fraudulent SIM registrations or a SIM swap, complain to your provider in writing first; if there is no response within thirty days or you are dissatisfied, submit the complaint to TCRA with evidence of that communication. Toll-free 0800008272, or dawatilahuduma@tcra.go.tz.

Keep every SMS, screenshot, reference number and RB number. Reconstructed timelines lose; documented ones win.

Habits that cut your exposure

• Keep balances low in the wallet you transact from. Move savings into a bank account or a fixed deposit where they are not one PIN away from a stranger — see how to open a bank account and our savings account comparison. The savings calculator will show what that money earns while it sits somewhere safer.
• Understand that deposit insurance does not cover this. The Deposit Insurance Board protects depositors up to TSh 7,500,000 per depositor per bank if a bank fails. It is not fraud cover. Deposit insurance explained sets out what it does and does not do.
• Verify through a channel you chose. Never the number that called you, never a link you were sent. Look the provider up yourself.
• Slow down deliberately when a request is urgent. Urgency is the tool, not a coincidence.
• Use a screen lock on the handset, and never let a shop attendant keep it out of sight during a repair without removing the SIM.
• Check your statements. Small unexplained debits are often reconnaissance before a larger attempt. If credit has been taken in your name, checking your credit report is the fastest way to find out.
• Know your normal costs, so an odd charge stands out. Our guides on reducing mobile money charges and choosing a mobile money service cover what the fees should look like.
• Take extra care with money crossing borders, where recovery is hardest. See sending and receiving money, receiving money from abroad and our money transfer comparison.

Frequently asked questions

Will my provider refund me if I was tricked into sending the money myself? Possibly. Since the 2025 amendment, regulation 35 requires a prompt refund of the actual amount lost through fraud or a scam unless the provider proves the loss was caused by your own negligence or fraudulent behaviour. Handing over your PIN after repeated warnings is the case they will argue is negligent. Report immediately and in writing, cite the regulation, and make the provider justify any refusal rather than accepting one over the phone.

How do I know if someone has registered a SIM using my identity? Dial *106# on any network and choose option 3. It lists the numbers registered against your NIDA citizenship number. Take any you do not recognise to that provider's customer service desk, where they will be deleted biometrically.

My phone suddenly lost network for no reason. Should I worry? Treat it as a possible SIM swap until you have ruled it out, particularly if it follows a suspicious call or message. Use another phone to contact your provider, have the wallet frozen, and confirm whether a replacement SIM was issued on your number.

Is it worth reporting a scam number if I did not lose any money? Yes, and it is arguably more valuable than reporting after a loss. Send UTAPELI to 15040 and enter the numbers when prompted. TCRA blocks reported numbers, and an early report stops the same number reaching the next person.

Someone sent me money by mistake and is asking for it back. What should I do? Do not send anything from your own balance on the strength of a phone call and an SMS. Check your actual balance through your provider's menu — not the message you were sent — and confirm the credit genuinely exists and has cleared. If it did, ask the sender to have their own provider process the reversal, since responsibility for a transfer rests with the provider that initiated it.

Should I go to the police or to the Bank of Tanzania? Both, for different things. The police handle the crime and give you an RB number. The Bank of Tanzania handles your provider's conduct and whether you are refunded. TCRA handles the number, the SIM and the scam messages. They are three separate lanes and each needs its own report.

Reviewed 1 September 2026.

This article is general information about mobile money security in Tanzania and is not financial advice. Complaint deadlines and consumer protection rules are set by the Bank of Tanzania (Financial Consumer Protection) Regulations as amended in 2025; confirm current requirements with the Bank of Tanzania, TCRA or your provider, and report suspected criminal fraud to the Tanzania Police.