Fake betting apps in Kenya: how to spot a clone before you deposit

A clone betting app borrows a real operator's name, logo or colours and then takes deposits for someone else. Under Kenyan law it is an illegal gambling platform, and the people behind it commit an offence. The quickest test is the regulator's own list, reproduced on this site's app check table of licensed operators and their domains.

What makes a betting app fake under Kenyan law?

Section 28(1) of the Gambling Control Act, 2025 says no one may offer a gambling activity or service unless it is licensed under the Act. Regulation 102(2) of the Conduct of Gambling Operations Regulations, 2026 (L.N. 112) defines an illegal gambling platform as any website, application, digital device or electronic system that offers gambling without the authorisation, licence or approval the law requires.

Regulation 102(1) makes it an offence to set up, run, manage or host such a platform, or to supply it with hosting, servers, domain registration, payment processing or technical support. Under regulation 102(3)(a), an individual convicted of that offence faces a fine of up to KES 1,000,000, up to six months in prison, or both.

Six signs that an app is a clone

No single sign proves an app is fake. Each one is a mismatch with something a licensed operator has to show, and the table pairs each sign with the rule or policy behind it.

Clone names and wrong developers

Google Play's Impersonation policy bars apps that pretend to be another developer, company or app, or that imply a link which does not exist. Its examples include a developer name that suggests an official relationship, a copied business logo and titles close enough to an existing product to mislead users.

Every store listing names its developer. If that name belongs to a person, or to a company missing from all 187 lines of the regulator's list, the app does not tie back to a licence. A one-letter difference in the company name counts as a mismatch too.

APK links in chat groups

An app file shared in a messaging group skips the store's review of its developer and its permissions. You also cannot see who published it unless you can trace the link back to a domain.

A genuine download has a home. Section 36(3) of the Act requires an online licensee to display its licence on its online platform, and regulation 41(a) of L.N. 112 requires that platform to keep an approved domain name. How installing outside a store works, and what Android asks before it allows it, is explained in what sideloading means for betting apps.

Requests to pay a personal number

Section 29(b) of the Gambling Control Act, 2025 requires a licensee to keep an account with an authorised financial institution registered in Kenya and to pay all monies from its licensed activity into it. Section 72(1) lets you play only through a registered account with the licensee, and section 73(3) lets the licensee accept a wager only from funds in that account. A request to send your stake to someone's phone number fits none of this.

Regulation 4(2) of L.N. 112 lists what a licensee's terms and conditions must contain when they go to the Authority for approval. Paybill numbers, shortcodes and USSD numbers are on that list, next to the customer deposit mechanisms.

Safaricom's M-PESA fraud page tells customers never to disclose their PINs and to verify with known contacts before sending money. It tells customers not to be conned or threatened by a caller, and to report the number to 333 instead. Which phone permissions a genuine app has a reason to request is covered in betting app permissions: what each one means.

How to check an app against the regulator's list

The Gambling Regulatory Authority publishes a list headed Licensed Gaming Companies for the Trading Period 2025/26. On 29 October 2026 it had 187 lines, 170 marked Renewal and 17 marked New. Its eight columns are No., Operators Name, Trading Name, BK, PG, PL, STATUS and DOMAINS.

1. Find the brand in the Trading Name column.
2. Read the company in the Operators Name column on the same line and compare it with the developer name on the store listing.
3. Compare the website the app opens, and the address an APK came from, with the DOMAINS column on that line.
4. Open the listed site and look for the licence, which section 36(3) requires an online licensee to display.
5. Before a first deposit, confirm the payment goes to a paybill or till and not to a personal number.

Some lines read Nil in the DOMAINS column, so a missing domain is not proof of a fake. A domain that differs from the one on the operator's line is a mismatch. A full walk-through is in how to verify a betting app is from a licensed operator.

Where to report a fake betting app

Section 10(m) of the Act gives the Authority the function of receiving and determining complaints from the public about games of chance. Its complaints page still uses the wording of the former Betting Control and Licensing Board, which the Authority replaced under section 6(3), and asks for a signed complaint form. Step-by-step instructions for each channel are in how to report a fake betting app in Kenya.

What this page does not cover

The regulator's list ties brands to companies and domains, not to app names. On its own it cannot tell you which of two similar store listings is genuine, which is why the developer and domain checks matter.

Recovering money sent to a clone is not covered here. Report the payment to Safaricom and the Authority promptly, and keep the messages, numbers and screenshots you have.