The money appeared real. Ksh64,950 hit the account at 3:28 PM on May 26. One minute later, it was gone.

A Kenyan crypto trader selling USDT on OKX’s peer-to-peer desk had just been cleaned out by a payment reversal linked to an obscure third-party processor called Finora Solution Ventures. Screenshots of the transaction, which circulated across Kenyan crypto Twitter within hours, showed the deposit and the reversal seconds apart.

Screenshot shared by @AntonioWallahi on X showing the Finora Solution Ventures deposit and near-instant M-Pesa reversal on May 26, 2026.

This was not the first case. It was not even the second.

One Minute. KSh 64,950. Gone.

The M-Pesa confirmation SMS showed the money arriving at 3:28 PM. Transaction code UEQ6Y5H05C. Source: Finora Solution Ventures. The same code was reversed at 3:29 PM. Ksh64,950 debited. The victim’s balance dropped from Ksh93,393 to Ksh28,443.

Brian Mutuab, a Nairobi-based P2P trader who goes by @Mutuabrian_M on X, flagged it immediately. He had seen this pattern before.

Second case I’m seeing under this exact scam. If you trade on P2P, beware of this. NEVER accept payment from any unrecognized THIRD PARTY App or Bank. Only transact with the known banks.

As Mutuab posted on X: the core problem is recourse. With a bank reversal, you can escalate through the institution. With Finora Solution Ventures, which nobody in Kenya’s crypto community had heard of before this incident, there is nowhere to go.

Thread showing @Mullahy and @Ayadollar responses to the viral M-Pesa reversal incident on May 26, 2026.

The Machine Behind the Prompt

What makes this version of the scam different is the automation behind it. Omar Patel Tate, who posts as @Ayadollar on X, laid out how the operation has evolved past manual execution.

And now they have advanced. Prompting is automated. They don’t have to do it manually. So they can prompt you 20 times a day, different amounts, different times, shows different company (merchant) each time.

As @kavatastrades posted on X (translated from Swahili): the OKX platform is being used as the battlefield, and the scammers have learned the terrain well.

@Ayadollar went further. When you receive a P2P payment, the funds should be moved immediately to KCB, M-Pesa float, Mshwari, or a bank account before releasing the USDT. Sitting on the receive confirms nothing if the counterparty has access to a reversal processor.

The original M-Pesa SMS showing UEQ6Y5H05C confirmed from Finora Solution Ventures followed by the reversal one minute later.

A user posting as Dust, with the handle @chartrovert, pointed out something that explains the scam’s confidence level.

They already know your minimum net worth so they prompt confidently.

In other words, the operation does not guess. The amount sent matches what the target can afford to hold. This is not random phishing. It is targeted.

This Has Happened Before. At 1 AM.

A November 2025 reversal confirmation: Ksh37,890 debited from a victim’s M-Pesa account at 1:01 AM using the same reversal mechanics.

The screenshots shared by @kavatastrades show a second victim hit in November 2025. Transaction code TKP1QB7FAQ. Amount: Ksh37,890. Time: 1:01 AM. After the reversal, the account held Ksh238.06.

As @kavatastrades posted on X in Swahili: the OKX P2P market taught him hard lessons. The 1 AM timing is not accidental. Sellers are less alert, transaction velocity is lower, and reversals process with less resistance on mobile money networks at night.

@Ayadollar confirmed this pattern: prompts at 1am are standard. Automated systems fire at hours when manual checks fail.

No Overdraft, No Defense

One piece of advice circulating among Kenyan P2P traders sits at the edge of dark comedy. As @0xxxIaN0 posted on X (translated from Swahili): never enter the P2P market without an overdraft on Fuliza. The logic is brutal but practical: when a reversal wipes your M-Pesa balance to near zero, Fuliza float keeps you operational while you figure out what happened.

The advice from @Mutuabrian_M runs along the same lines: stick to M-Pesa, Co-op, IM Bank, KCB, and NCBA. If any merchant sends from an unrecognized processor, report it immediately and refund before releasing crypto. Releasing USDT first is the point of no recovery.

Identical M-Pesa reversal sequence shared across multiple accounts confirming repeat occurrences of the Finora Solution Ventures pattern.

What the Reversal Window Actually Looks Like

OKX’s own P2P guidance, published on its help center, flags chargeback-style scams as a known risk category on peer-to-peer platforms. The platform’s escrow system protects the crypto side of the trade, but it cannot override a mobile money reversal that happens on Safaricom’s infrastructure before the seller checks the platform.

The practical vulnerability is the gap between the M-Pesa confirmation SMS and the moment the seller clicks release on OKX. In this incident, that gap was 60 seconds. The reversal hit within that window.

Mutuab’s counter to this is precise: always transfer the received cash to a second account before releasing USDT. Not because it stops the reversal, but because it moves the funds out of the reversible window on the originating account. If Finora Solution Ventures or any unnamed payment processor reverses the payment, it drains the source, not the destination.

Verified Trusted Payment Channels Per Community Consensus

Based on recommendations shared across multiple X threads on May 26, 2026, the Kenyan P2P trading community points to the following as the only safe payment rails for OKX transactions: M-Pesa person-to-person transfers, Co-operative Bank, IM Bank, KCB, and NCBA. Any payment originating from a name not on this list should be treated as a reversal risk until confirmed otherwise.

The broader risk the community flags is not just Finora. It is the model. Unknown processors, automated prompts, rotating merchant names. Any entity that can initiate a Safaricom-recognized payment and then reverse it within seconds is a structural threat to every P2P seller operating in Kenya.

That risk does not disappear until either Safaricom closes the reversal window for third-party processors on P2P transactions or OKX builds a hold period into its escrow release that outlasts the reversal window. Neither has happened yet.