Data Security

Kenya Offline: What 72 Hours Without M-Pesa Could Mean

P

Pawanax Editorial

November 6, 2026

A mobile money and Equity agent storefront in Nairobi, Kenya.

A 48–72-hour internet blackout plus bank and M-Pesa cyber disruption could delay billions in payments across Kenya and spill into regional trade.

This is a hypothetical scenario analysis, not a report of an actual outage.

Imagine a Thursday morning. A Kisumu kiosk has bread on the counter and a wholesaler waiting for payment. A Nairobi rider has an order ready, but the customer cannot confirm the transfer. At a farm gate outside Eldoret, a buyer promises to pay after loading produce. Phones show bars. Some can call. The money does not move.

Nothing in this imagined scene is a witnessed event. It is a way to test a question: what if Kenya lost most public internet access for two or three days, while a cyber incident also disrupted major bank and M-Pesa transaction services? The distinction matters. A web outage alone is not the same as a mobile network failure; a failed payment system is not the same as a lost payment; and the value of transactions interrupted is not GDP erased.

Two failures, not one

Assume a national internet disruption lasts 48 to 72 hours. Public websites, mobile data, home broadband and internet-dependent business systems become unreliable. Voice calls and SMS remain partly functional. Cellular radio access, signalling and USSD menus continue in some places. Power and physical cash distribution remain broadly available.

Now add a separate, hypothetical cyber disruption: for 48 hours, M-Pesa’s central transaction processing and several large banks’ digital payment channels are unavailable or restricted. Ledgers are not assumed destroyed or altered. Staff isolate systems, check records and restore services in stages. Some ATMs, cards, branches and interbank rails continue; others slow or fail. This is a stress case, not a claim about any named institution.

Why separate them? Internet apps and websites need data connectivity. USSD runs through mobile network signalling and can work without an internet data session. Safaricom documents both USSD code *334# and the M-PESA app as ways to access a service. Therefore, a general internet failure might leave USSD transfers alive, depending on the operator’s network and backend. It would still break app payments, online banking, merchant dashboards, cloud tools and many business links. If the USSD gateway, mobile core, electricity or M-Pesa ledger also fails, USSD cannot rescue the transaction. A phone displaying network bars proves radio coverage, not that a payment has cleared.

What the numbers measure

Kenya’s exposure is large, but headline figures describe different things. Safaricom’s FY26 results report M-Pesa value of KSh41.68 trillion and 46.41 billion transactions for the year ended March 2026. Dividing by 365 gives about KSh114 billion and 127 million transactions a day. These are gross flows through one platform, not new wealth produced. A shilling can circulate several times: customer to shop, shop to supplier, supplier to worker.

CBK’s mobile-payments table is narrower. Its provisional August 2026 entry reports KSh761.13 billion in “Total Agent Cash in Cash Out” value. That is agent cash-in and cash-out activity, not all M-Pesa payments or total payment-system throughput. It signals how much cash conversion passes through agents in that month; it cannot be added to Safaricom’s annual transaction value or treated as another estimate of the whole network.

The distinction between flows and output is just as important. A KSh2,000 payment that fails at noon and succeeds on Saturday is delayed, not necessarily lost. The shop may still sell the item. But delay has a cost: stock does not arrive, a casual worker cannot buy supper, a driver makes another trip, or a customer abandons the purchase. Some activity shifts to cash or later days; some is permanently lost. A gross transaction total cannot tell us how much of either.

A transparent stress calculation

Here is deliberately simple arithmetic, not a forecast. Use the FY26 M-Pesa daily average of KSh114 billion as a scale reference. Assume a full outage of the transaction platform for two days and that 30 per cent of the daily value could not be completed through another channel during those days. The gross delayed or displaced value would be:

KSh114bn × 2 × 30% = KSh68.4bn.

If the disruption lasts three days, under the same assumption, the figure is KSh102.6bn. Those amounts are not GDP losses. They are illustrative M-Pesa transaction value that might fail to clear on time under stated assumptions. The 30 per cent is a scenario choice, not a measured outage rate. Substitution to USSD, another wallet, card, bank transfer or cash would lower it; broader system failure would raise it. The exercise excludes bank-to-bank payments, production losses and secondary effects, and does not add CBK agent cash totals.

To make a GDP comparison, use a different calculation. CBK reports Kenya’s 2025 nominal GDP at KSh17.58 trillion. Divide by 365 and the economy’s average daily value added is about KSh48.2 billion. Two or three days therefore correspond to roughly KSh96 billion or KSh145 billion of ordinary daily GDP, respectively. That is only a calendar benchmark. It does not mean a two-day outage destroys that amount. GDP counts value added, not the face value of every payment, and activity may be postponed, rerouted or recovered. A credible loss estimate would require sector-level evidence about interrupted production, substitution, duration and recovery. We do not have that for this hypothetical event.

The counter at the end of the chain

The first pressure would be practical. Small shops need change and working capital. A merchant unable to verify payment must choose between handing over goods and risking a loss, or refusing a customer who may have paid. A farmer may have produce ready but no confirmed receipt. A matatu can take cash, if passengers have it and can make the fare. A salaried worker may have money in an account but be unable to reach it.

Agents would face the reverse problem. Customers might rush to withdraw cash while float is limited or electronic confirmation unavailable. Cash in a drawer cannot satisfy every request, and CBK’s monthly agent cash-in/cash-out measure says nothing about float at a particular outlet. If USSD works, some transfers could ease queues. If the core wallet ledger is affected, USSD may return an error. Repeated attempts can leave customers unsure whether payment is pending, reversed or complete.

Banks could keep branches open, but branches cannot replace normal digital throughput. Staff would reconcile records and prioritize critical services. Firms dependent on online orders, cloud accounting, card authorization or imported software would lose more than payment access. Clinics, logistics companies and public offices would need fallback procedures. The outage’s reach would depend on backup power, offline processes, cash and whether domestic systems could communicate without public internet.

Spillovers across borders

Kenya is linked to its neighbours by trade, transport and payments. CBK says the East African Payment System connects bank transfers among Kenya, Rwanda, Tanzania and Uganda; its latest annual report says EAPS handled 46,463 transactions worth US$1.51 billion between July 2024 and June 2025. That is a defined regional bank channel, not the whole of cross-border trade. A Kenyan outage would not automatically switch off partner countries’ networks or every regional payment rail. But transactions involving Kenyan banks, merchants, clearing links or mobile-wallet partners could wait. Truckers, wholesalers and families might face delayed confirmation or settlement even where the sender’s side remained online.

The same caution applies to remittances. CBK estimates that remittance inflows reached KSh666.7 billion in 2024, around 4 per cent of GDP. Most of that annual flow would not vanish during a weekend outage. Some transfers could queue, move through another provider or arrive later. Households waiting for money to buy food or pay rent would still feel the delay immediately. A monthly national total is a measure of scale, not a map of who can wait.

What resilience would mean

After a crisis, officials and companies would each have reasons to describe it in favourable terms. A low count of permanently failed transactions could be offered as proof that the system was resilient. A large gross value of interrupted payments could be used to imply a matching economic catastrophe. Neither claim follows from the number alone. The useful questions are simpler: how many people could not pay or receive money, for how long, which channels remained available, how much activity was recovered, and what services had no workable fallback?

Resilience means a shop can verify payment, a worker can reach wages, an agent has usable float, and records can be reconciled safely. It requires testing USSD and SMS separately from data apps; cash and offline procedures for essential services; protected ledgers; and clear messages when transactions are pending. Overlapping failures need rehearsal because a cyber incident during an internet outage leaves fewer tools for diagnosis and coordination.

The imagined Thursday ends without a grand economic verdict. The kiosk still has bread. The rider still has an order. The farmer still has produce. Some payments clear later; some sales are lost; some households borrow or go without. Kenya’s annual payment totals show how much value normally moves through its digital rails. They do not tell us what a 72-hour silence would cost. That answer would be written in the small transactions that could not wait.

Sources and method

  • Central Bank of Kenya, Mobile Payments statistics. August 2026 agent cash-in/cash-out value is presented using the table’s own label and is not treated as total payment throughput.
  • Safaricom PLC, FY26 Results Booklet, reproducing company-issued audited results for the year ended 31 March 2026. M-Pesa total transaction value and volume are used only as scale references; the arithmetic assumes 365 days.
  • Safaricom, M-Subscription terms and conditions, for the documented USSD *334# and app access routes. This establishes channel availability as a design fact, not a guarantee of operation during a network or backend failure.
  • Communications Authority of Kenya, FY2024/25 sector statistics summary, for data-subscription and mobile-connectivity context.
  • Central Bank of Kenya, Annual GDP data, for 2025 nominal GDP used in the calendar-day comparison.
  • Central Bank of Kenya, 2025 Annual Report, for EAPS scope and FY2024/25 transaction figures.
  • Central Bank of Kenya, 2025 Remittances Household Survey announcement, for the 2024 remittance inflow estimate.

Scenario duration, outages, recovery assumptions and the 30 per cent non-substitution share are hypothetical. All computations are illustrative and do not estimate actual GDP loss.

Read the other stories

Evidence checked 6 November 2026. Hypothetical scenarios are conditional analysis, not reports of events or calibrated forecasts.

Cover image: Illustrative photo of an M-PESA and Equity agent in Nairobi by Fiona Graham, CC BY-SA 2.0. It does not depict an internet or mobile-money outage. Original photograph; licence and reuse terms. Original image used without editing.

About the author

P

Pawanax Editorial

Pawanax Editorial examines technology, political risk and trade through their consequences for Kenya and Africa. Articles distinguish reported facts, analysis and hypothetical scenarios.

Share What's Next

Related articles

Ensuring Patient Data Privacy in the Digital Age

Data Security

Ensuring Patient Data Privacy in the Digital Age

In late February 2024, a ransomware crew entered the networks of Change Healthcare, a company most patients had never heard of, through a remote-access server that did not require a second factor of authentication. The company's chief executive said as muc...

D

Dr. Amina Kimani

August 22, 2023 · 5 min read

Twenty Minutes, Ten Blockchains, $6.3 Billion: Anatomy of the Binance Hack

Data Security

Twenty Minutes, Ten Blockchains, $6.3 Billion: Anatomy of the Binance Hack

At 20:05 UTC on Thursday, 29 October 2026, the largest theft in the short history of crypto began. Most of it was over in about twenty minutes. Binance says roughly $6.3 billion left its wallets, and the blockchain analysts at TRM Labs, whose tally runs sl...

Mr. Derrick Macharia

Mr. Derrick Macharia

October 30, 2026 · 5 min read

Stay in the loop

Get new articles on healthcare AI and African health systems.

Healthcare AI insights. Unsubscribe anytime.