Fake M-Pesa Messages: How Restaurants Get Conned, and How to Stop It

The short answer: never release food because of a message on the customer's phone. An order is paid when the money shows on your side: your till's own M-Pesa confirmation, your M-Pesa statement, or your POS marking the order paid. Below is how the con works, five checks your cashier can make in ten seconds, and the house rules that stop it.

How the con works

It happens at the busiest hour. A customer finishes eating, says "nimetuma", and holds up a phone with an M-Pesa message. The amount is right and the name looks right. The cashier is serving three other people, so they nod. At closing, the money is not there.

These are the three versions restaurants run into most:

• The fake SMS. A message written to look like M-Pesa, sent from an ordinary phone number. Under pressure at the counter, it passes.
• The edited screenshot. A real, old M-Pesa message with the amount, date or code changed in a photo app.
• The "sent by mistake" call. Someone sends you a fake message for, say, KSh 2,500, then calls: "I sent it to the wrong number, please send it back." If you send it, you have paid real money for a fake message.

Five checks that take ten seconds

1. Look at your phone, not theirs. When a customer pays your till, the confirmation comes to the phone registered to the till, or to your M-Pesa business app. If nothing arrived on your side, nothing was paid.
2. Check the sender. A real M-Pesa message comes from MPESA. It never comes from a 07 or 01 phone number.
3. Check the code. Every M-Pesa payment has a 10-character code of capital letters and numbers. Write it on the order. A code you have seen before is a red flag.
4. Check the time. A message from yesterday, or from before the customer sat down, is not for this meal.
5. Check the amount on your side. Your confirmation shows the amount and the payer's name. Both should match the bill.

House rules that stop it for good

• The till phone stays at the counter. One person is in charge of it each shift. Not in a pocket, not in the office.
• No food on a screenshot. Put it on a small sign at the counter: "We confirm M-Pesa on our phone." Honest customers don't mind waiting a few seconds.
• Never send money back yourself. If someone says they paid you by mistake, ask them to request a reversal from Safaricom. If the payment was real, Safaricom moves it. You send nothing.
• A code on every M-Pesa sale. At closing, every M-Pesa sale has a code, and every code appears once on your statement.
• Check M-Pesa every day. Compare the day's M-Pesa sales with the statement before you close. A gap found the same day has a name and a shift attached. A gap found at month end has neither.

How I handle M-Pesa

I was built in Kenya around M-Pesa, so these rules are part of how I work:

• I can send the payment request straight to the customer's phone. They enter their PIN, and the order shows paid only when M-Pesa confirms it.
• If a cashier types a code in by hand, I mark the payment as unverified until the money is confirmed. You can require a manager's PIN to accept it anyway.
• One M-Pesa code pays one order. The same message cannot pay for two meals.
• Every payment sits on its order, so the day's report shows which sales were M-Pesa, cash or card, and who took them.

See every way I take payments.

Related reading

• Why your cash drawer never balances
• How to spot staff theft in your POS reports
• Starting a restaurant in Kenya: the licence checklist