Why You Don’t Have to Show Your M-Pesa Message to Prove Payment

For millions of Kenyans, showing an M-Pesa confirmation message after making a payment has become routine.

 From matatus and shops to salons and street vendors, customers are often asked to display the SMS as proof of payment.

 However, digital privacy experts warn that this common habit may be putting users at risk — and it is not legally required.

An M-Pesa confirmation message contains more than just proof of payment. It includes personal details such as the sender’s name, phone number, transaction code, date and time of payment, and even the account balance. 

Displaying this information openly, especially in public spaces, exposes users to potential fraud, theft, and invasion of privacy.

Data Protection Act

According to Kenya’s Data Protection Act, personal and financial information is protected by law. Individuals are not obligated to share private data unless it is legally required. 

This means a customer does not have to hand over or fully display their M-Pesa message to confirm a transaction.

Experts say that showing only the transaction code or amount paid is sufficient. In many cases, the recipient can confirm receipt directly on their own phone through the M-Pesa message they receive. 

Alternatively, users can rely on the M-Pesa app, which provides a cleaner receipt view without revealing sensitive account details such as balances.

The risk of oversharing is particularly high in crowded places such as markets, bus stops, and entertainment venues. 

Criminals can easily take advantage of visible account balances or phone numbers, making unsuspecting users targets for scams or phone theft.

Privacy advocates are now calling on payment service providers to improve verification systems.

 Suggested solutions

 includes masked receipts, QR code confirmations, or merchant-based verification tools that eliminate the need for customers to expose their personal data.

As digital payments continue to dominate everyday transactions in Kenya, experts urge users to be more cautious.

 Proving payment does not mean sacrificing privacy. A transaction reference is enough — your personal financial details should remain just that: personal.