No. Do not tell a PIN to someone who calls or messages claiming to be a payment provider’s customer-care agent. Treat an OTP the same way: never read it out or forward it to an incoming contact. End the conversation and contact the provider yourself through a channel you already know is official, such as its app or the contact details published on its own website. Ask how to submit the complaint securely.
You can still resolve the payment question without handing over a secret code. Keep the transaction message or receipt, note the transaction reference, and match the payment against the order. The Central Bank of Kenya’s 2014 National Payment System Regulations discuss transaction references and complaint handling, so these are useful details to have when you contact the relevant provider. The regulations are dated; check the provider’s current terms for its process and any applicable timelines.[1]
If someone asks for your PIN or OTP
A complaint call can feel urgent, especially when an order is waiting or a payment appears to have gone to the wrong place. That urgency is a reason to slow the interaction down. A PIN or one-time code is an authentication secret: keep it private, even when the caller knows your name, order details or part of a transaction message.
Use a simple response: “I won’t share a PIN or code. I’ll contact the provider through its official channel.” Then end the call or stop replying. Do not keep negotiating, click a link the contact sends, or use a phone number they give you as your only way to verify them. Find the provider’s official contact route independently and ask whether there is a secure way to continue the complaint.
A genuine complaint process may need you to identify the transaction. That is different from disclosing a PIN or OTP. You can provide relevant details through the provider’s secure process, such as a transaction reference, date, amount and the account or number involved where requested. Follow the provider’s own instructions, and share only the information needed for that complaint. The Communications Authority of Kenya describes safe password practices and multi-factor authentication as useful parts of cybersecurity awareness.[2]
Build a clear record before you complain
Suppose you have paid for an online order, but the seller cannot see the payment. Before contacting anyone, gather the payment confirmation and order details. Check that the amount and recipient shown in the payment record match what you intended. Keep the original message or receipt intact; do not rely only on a forwarded screenshot or a caller’s description.
Write down what happened in order: when you paid, what the payment record says, when you first noticed the issue and whom you have contacted. If the provider gives you a complaint reference, save it alongside the transaction reference. CBK’s regulations describe provider responsibilities around defective electronic retail transfers and complaint handling; they are useful background for knowing why a reference and a clear account of the issue matter. They do not establish a particular resolution time for your case, so use the provider’s current complaint process for next steps.[1]
Payment services have separate providers and channels. CBK describes its oversight of payment systems and gives mobile money and electronic funds transfers as examples of retail payment channels. That makes it important to identify which provider’s payment record is authoritative for the transaction you are questioning.[3]
For a buyer or seller using a cashless order flow, keep the order and payment records together. Confirm the actual digital payment status through the authoritative payment record before making the next decision about the package. A message from an unknown caller is not a substitute for that record, and neither is a promise that a payment has been made.
If you have already shared a code
Act promptly through the provider’s official channel. Explain that you disclosed a PIN or OTP during a contact you could not verify, and ask what steps its published process recommends for securing the account and reviewing the transaction. Change credentials through the provider’s official app or site if instructed, and keep the complaint reference and any relevant messages. Do not return to the caller’s link or number to carry out those steps.
Keep the language factual when describing the incident: what code you shared, when, through which contact method and what happened afterwards. Avoid sending additional codes to anyone who follows up. The right response depends on the account and provider, so use that provider’s current secure instructions rather than relying on a caller’s directions.
The useful rule is straightforward: share transaction evidence through a provider’s secure complaint route; keep authentication codes to yourself. For a cashless online order, Moveka is your strongest practical next step for checking the available delivery choices and price against your actual parcel and selected locations, so you can plan the next move with the details in front of you.
