Put the warning first — an open call to banks, saccos and telcos

The overlap

Banks, saccos and telcos already tell customers not to share one-time codes. Those lines are usually last in the SMS. The theft happens while someone is on the phone, coaching the customer to read the digits that just arrived.

Keshio cannot rewrite your templates. You can. This is an open call to do that, and to let us measure it with you.

We make no claim yet that the reorder works. The point of a pilot is to find out.

A typical message still looks like this:

Your OTP is 482913. Valid for 5 mins. Do not share this code with anyone.

On many phones the lock screen shows only the first line. The customer on a live call sees the code. The warning is below the fold, if they scroll at all.

The caller is not breaking cryptography. They are using a genuine code, a trusted device, and a person who believes they are speaking to their institution. Education that arrived on a calm day is competing with urgency in the ear.

The Central Bank of Kenya’s March 2026 draft Financial Consumer Protection Framework asks institutions to notify consumers clearly and in time about digital frauds. Putting the warning first is a same-day way to act on that, without a new gateway, a new sender ID, or a shorter code lifetime.

What we ask you to send

Keep one SMS segment, in plain GSM-7 characters (no curly quotes, accents, or emoji):

Never share this code. A caller asking for it is a scammer.
You are paying KES 45,000 to JOHN KAMAU.
Code: 482913

• Warning first, so it is what the lock screen shows.
• Transfer line in the middle when your system already knows the amount and recipient, so a code read aloud for a “refund” contradicts the text.
• Digits last.
• Sender ID, aggregator, and OTP lifetime unchanged.

Start with one sender ID or one OTP type — for example new-beneficiary transfers. Alternate customers between today’s text and the pilot text for about eight weeks. Count, per 10,000 OTPs: reports of codes shared with a caller; fraud complaints involving a disclosed code; calls to your fraud line; complaints about the new wording.

Fraud events are rare. One institution may be too small to show a difference. We suggest pooling anonymised results across partners. You decide whether to be named.

What we have already built: Subiri

Keshio ships an Android interruption called Subiri. It is free, opt-in, and off until the customer turns it on.

When a listed verification SMS arrives during a call, Subiri:

• Opens a full-screen warning that never shows the digits.
• Asks one factual question: Did you call them, or did they call you?
• After the call, shows Call your bank now with the institution’s verified line and fraud line, when those numbers are in our catalog. We never auto-dial.

We do not hide or delay the SMS. It still lands in the stock inbox. Subiri is an interruption, not a lock. That is an honest limit, and it is why your template still matters.

What Subiri can already count on the phone (no code, no message body, no recording): OTPs during a call, alerts shown, each answer, taps on Call or Report, calls that ended soon after the alert. Those are behaviour, not fraud outcomes. A claim a bank can cite needs your fraud-report numbers on the same sender ID and period.

Why your role is the multiplier

Three things only the institution can do.

1. Reach people who never installed Keshio. Subiri only helps customers who opted in. Your SMS reaches every person you already text a code to. Reordering the template is the change that does not depend on an app.

2. Make the callback real. After a coached call, the scammer’s next line is often “hang up, I will call you back.” Subiri’s next screen is “call the number on your card.” If you confirm your sender ID and your official and fraud lines, that screen can name you and open the dialer to your numbers — not a number the caller dictated. Listing is free. We check identity, sender ID, and the lines ourselves. We do not take a public form. Wording stays “listed partner” and “supports the initiative.” Never “approved by” or “certified.”

3. Turn phone counts into a result you can use. Our dashboard is aggregates of on-device actions. Your fraud desk already knows whether codes were shared. Pairing those series is how a reorder, or Subiri, becomes evidence instead of a story.

Telling your own customers about Subiri — a branch screen, a social post, a line in your existing scam-awareness SMS — is a further step. We will give you a short kit. It is optional. The template change does not wait on it.

What this does not replace

Even a better SMS and an on-phone interruption still leave the digits visible in the inbox. The durable fix is at the operating system: withhold the code during an unverified call, keep same-device autofill, and release it only after a provenance check.

That is a research proposal, not a product we can ship as a third-party app. Android 15 already redacts OTP notifications for untrusted listeners; it does not hide the code from the person on the call. The working paper The Call and the Code states the mechanism, the hypotheses, and who we need to test it.

This post is the operational ask: change the text you already send.

How to join

We ask for:

• A named contact in fraud, digital, or customer protection.
• Approval for one pilot sender ID or OTP type.
• Aggregate counts for the measures above — no customer data.

We offer the wording, a simple measurement sheet, and a short summary for your fraud team, at no cost. You can also join only as a listed partner (sender ID and callback lines) if the template change needs a longer internal path.

Write to [email protected] with the subject OTP template pilot.

If you already send a warning first, tell us. We would rather list you and learn from what you did than pretend the idea is new.

How Subiri works · The Call and the Code