Ebola Is in the News Again — So Are Health-Registration Scam Texts

Kenya confirmed new Ebola cases this week, and health scares follow a predictable pattern: first the news, then the panic, then the scam texts. Fake "contact tracing" registrations, bogus vaccination-portal links, "health ministry" SMS asking you to verify — every public health event in Kenya has produced exactly this wave before, and this one will be no different.

What the scams look like

• "You've been identified as a contact — register here." A link to a fake portal harvesting name, ID, and phone number.
• "Health registration required — confirm with the code sent to you." The "code" is an OTP they triggered on your account — WhatsApp, M-Pesa-adjacent, email. Reading it out hands over the account.
• Fake testing-booking or vaccine-slot sites that demand your phone number "for confirmation" — now your number's in a scammer's database.
• County-government impersonation — "Uasin Gishu County Health requires your details" — borrowing credibility from whichever county is in the headlines.

The mechanics — always the same

1. The scammer starts a real verification on a real service — using your number.
2. You get a genuine OTP. Looks official because it is.
3. They call or text — "Ministry of Health", "the hospital", "contact-tracing team" — and ask you to read back the code.
4. You read it. They take the account the code unlocked.

No health body will ever call and ask you to read a code. Not the Ministry, not a county, not WHO. The OTP is the keys — never read it to anyone.

Why your number is the target

Every place your number lives — a leaked database, a marketplace listing, a shady registration form — is a place scammers find it and aim at it. Health scares give them the urgency pretext; the number was the vulnerability all along.

That's the argument for scarcity: the fewer places your real number exists, the smaller the target. When a legitimate service wants phone verification — a news app, a health-information platform, a portal — you don't owe it your real line. A temporary verification number receives the OTP, verifies the account, and expires, leaving nothing for the next database to leak. (The fuller case: why your real number shouldn't be public.)

The rules that end every health scam

• Never share an OTP. Not with "the Ministry", not with "the hospital", not with anyone. Ever.
• Check the domain. Real health portals are on official domains — health.go.ke and county sites, not covid-registration-kenya.com clones.
• Urgency is the tool. "Register now or be flagged" exists to stop you thinking. Real public health doesn't work via SMS urgency.
• Verify through official channels — if a text claims to be a government body, check their official site or call their published number. Don't use the link they sent.

The 10-second habit

Code arrives, call follows: Did I just request this? If yes — it's for your screen only. If no — someone's fishing. Don't read it out, don't click their link, don't call back. Ebola or no Ebola, that rule has never had an exception.

More on the scam mechanics: MoMo & OTP fraud in Cameroon · election-season scams in Nigeria.