How to Spot a Fake M-Pesa Payment Prompt

If you run a business that takes M-Pesa payments, you've probably already had a moment where a payment prompt or message made you pause and think, wait, is this real? That instinct is worth trusting — this is one of the most common fraud patterns hitting Kenyan businesses right now, across every sector.

How the scam usually works.

You get an STK-push prompt on your phone — the normal-looking pop-up asking you to enter your M-Pesa PIN to complete a transaction. Except you didn't initiate it. Someone else did, hoping you'll enter your PIN out of habit without checking what it's actually confirming. The moment you do, money moves out of your account, not in.

A close cousin: a message claiming to be from M-Pesa or a delivery service, saying a payment "failed" or is "pending," with a link or a callback number to "fix it." Following that link, or calling that number, hands your details to the scammer directly.

What to actually check before entering your PIN, every time:

• Did you initiate this transaction? If a prompt shows up and you didn't just make a purchase or request a payment, don't enter anything.
• Does the amount match what you expect? Scammers sometimes send a prompt for a specific amount hoping you won't look closely.
• Never enter your PIN because a message told you to "verify" or "confirm." Legitimate M-Pesa processes almost never ask you to do this outside of the transaction you yourself started.
• If in doubt, stop and call Safaricom directly using the number on their official app or website — not a number from the suspicious message itself.

The bigger pattern worth knowing: this isn't really about M-Pesa's security — it's about exploiting a habit. Entering a PIN quickly, without reading, is muscle memory for anyone handling payments all day. The fix isn't a technical one; it's a habit correction, and it's worth teaching everyone on your team who handles payments, not just yourself.