Opinion

Safaricom needs to fix M-Pesa privacy problems

Here’s the follow up article to What needs to change with M-Pesa in 2020, which I published on 28th December 2019.

I wanted to include Privacy Issues as point number 1 before Transaction Costs in the article linked above. Actually, the draft article still has that as the first point. I decided against it, because I felt this topic needed an article of its own. Also, transaction costs were a big conversation at that time. And I feared the discussion around privacy would somehow be lost.

One thing that has continuously bugged me about M-Pesa, something we all use almost every day, is how it has almost completely wiped away the idea of privacy for every Kenyan using it.

Think about it. When you sign up for M-Pesa what details do you give away:Full Names, Government Identification Number, Date of Birth, and much more.

What about when you withdraw money from an Agent? You give away your ID number, your phone number, plus the Agent remains with your full names. Here’s a stranger you’ve never met, asking you for all these private details about you, just so that you can get physical cash that’s already yours.

There’ve been numerous concerns about how safe this data is: How is the information we give agents stored? Who has access to the data? What measures have been taken to ensure that the data doesn’t land in the wrong hands? What happens when the data lands in the wrong hands?

We’ve not seen any serious information or announcements from Safaricom on the same. For example explainer videos on how customer data is handled, or how agents keep safe what we give them. Neither have we seen any serious responses from the company on the growing concerns of Kenyans concerning fraud, spam messages from businesses or other weird companies, SIM swaps, and much more.

A study by Myriad Connect, back in 2018, estimated that seven out of ten Kenyans reported to have fallen victim – or know someone who has fallen victim – to financial transaction fraud. And you know what these fraudsters are targeting most? Mobile Money.

Of course from 2018 to now, the number of Kenyans falling prey to fraudsters keeps increasing. We’ve seen them use new methods to trick innocent Kenyans. Some will call you, some will text you, and some will be very convincing including knowing all your official government names.

Hakikisha by M-Pesa:

Have you ever received a call/text on your Safaricom line from some random person who tries to tell you you’ve won something, or your line or bank account has an issue?

I believe most of us have. Though all of us reading this site are clever, and know too well not to fall for such scams. But think of an old person getting a call from a new number, and the caller on the other end knows their full official name. How easy will it be for the fraudsters to steal from them?

And how do these fraudsters know our full names? Well, M-Pesa is the new Truecaller. Only that it is 100% accurate.

When Safaricom introduced Hakikisha for M-Pesa, they hailed it as a new way to reduce mistakes when sending out cash. So you’ll be able to see the full names of whomever you’re sending money to, before you actually okay the transaction. This, they said, would be limited to 5 tries a day so as not to be misused.

Well, many months later, Kenyans, including fraudsters, found incredible ways to use the feature. Also with much thanks to the mySafaricom App where the limit to 5 tries doesn’t seem to work. Say you

  1. Receive a message from someone you don’t know, use Hakikisha. Try sending them one shilling, see their full name, then cancel the transaction before entering your PIN on the mySafaricom app. Now you know the full names of the person.
  2. Got a missed call, well, Hakikisha.
  3. Remember a number of someone you heard some while back but don’t know their name, Hakikisha. Which opens so many avenues for stalkers and creeps. They can hear your number out when you say it loud to a Supermarket teller, or when you write it out at a security entrance.
  4. Now if you’re a fraudster, and you want to con someone, all you need to do is guess a random array of Safaricom numbers, get their full names from Hakikisha, and call or text them. Works even better if you can get these numbers from unsecured loan and bank apps.

Instead of Hakikisha, what can Safaricom do?

Well, this is one thing I’ve thought about a great deal over the last few weeks. Hakikisha exposes your full names to everyone who has your Safaricom number. It is obviously a violation of your right to privacy. I don’t want everyone to know my official names. Did I sign up to M-Pesa so that anyone who can get my number from anywhere including guessing it, gets to know my full names?

Article 31 of the Constitution of Kenya states: “Every person has the right to privacy, which includes the right not to have — …the privacy of their communications infringed.”

Instead of Hakikisha, I propose this to Safaricom:

  • Remove option for people to see full names of people they’re sending money to. Limit that option to business pay bills and till numbers.
  • Prompt people to double-check and confirm that that’s the right number they’re sending money to. If I can go through 8 steps to buy data, let me go through 2 extra steps to confirm I’m sending cash to the right person.
  • Introduce a 5 minute un-usable window once money has been sent and received.This window will help someone who’s made a mistake to reverse the transaction.
  • This un-usabe window means I can see I have received money from someone, but I cannot use it in anyway. If it’s not my cash, the sender can reverse it. This simple step solves issues with Fuliza automatically using up funds, people rushing to withdraw the cash, or other excuses people give when they receive money from wrong numbers.

With this, you not only remove the upper hand fraudsters have had over the past year, you also solve all issues with M-Pesa reversals.


Safaricom needs to fix M-Pesa privacy problems
In this Twitter exchange, a customer complains they sent money to their cousin wrongly, but the reversed amount was less. Safaricom says the other party had used up part of the cash when reversal was initiated. They go on to suggest that the customer should talk to their cousin for the other amount.

Privacy 2020

Safaricom needs to be on the fore-front of addressing issues raised by customers around fraud. It shouldn’t be left for people to speculate. There should be statements by the company letting people know that this and this has been said, and this and this is being done. The company should also be very clear about how customer data is handled, and how Kenyans can be sure that the stupid spam messages we receive aren’t as a result of Agents selling our numbers.

In the same breath, Kenyans need to be relentless in our noise. When we suspect something is happening, we need to make noise about it. We need to demand accountability, and transparency from the companies that take our data.

41 Comments

  1. Can M-pesa verify this number and confirm who is using it? +245709656016
    This number called us today about a transaction held and from thereon, it became unreachable.
    Are these fraudsters? How did they have our information?

  2. Today I found out that someone registered my ID to another number and took out a loan from KCB. Asking safaricom about this issues they remain useless. Beware of where you withdraw cash.

  3. Agents should be provided with very basic affordable smart phones equipped with Mpesa software to collect user details and replace the books. Probably send QR codes or random codes very unique and only used once within a given time frame (say a minute) ensuring user data is strictly with Safaricom. These Mpesa books are a definite recipe for fraud!

  4. Very true. Nowadays it’s hard to surprise someone with some little coins.You have to confirm whether they have fuliza…which ends up not being a nice move

  5. My worry, is the whole thing of leaving a trail of marks with my name at all places I pay with Mpesa; at mama mboga, supermarket, petrol station, restaurants etc,Kwanza I hate when the attendant calls out my name. I think paying bills part should give a unique code confirmation.

  6. Safaricom as a Company should introduce some of the following steps towards data protection:
    1. Introduce special Mpesa Agent phones that will be able scan the digital National ID in future.
    2. Monitor the lines registered by an individual if they operate from the same location.
    3. Enhance there verification mechanism from HAKIKISHA to a better way.
    4. Enhance the use of virtual money in trade to enhance data protection.
    5. More so on use of Paybill and Till numbers they need to introduce verification to reduce on fraudster who use them to defraud people

  7. The issue of someone registering a new line from someone details it has been handle to the extent of taking a photo of the one to be registered and holding the Mpesa agent accountable in case of colluding with fraudster to con people

  8. Actually I think safaricom is doing great although they really need to address this issues. Especially where someone can take your details register a line and use it to get a loan and at the end run you remain being followed of having debts which you are not even aware of.

  9. For sure are our private details safe? If someone I don’t know has my ID number and Full Name then can’t he or she be able to register funny transactions on my behalf without my knowledge? Can’t someone fill a birth certificate with your details as a father or mother without you knowing? Take a loan with your details without your knowledge? TAFAKALI YA BABU

  10. Safaricom and associate company issuing fuliza Mobile loan’s needs to improve.we don’t pay fuliza loan’s they take away any available funds that comes along the way. We want an application that has a due date in order to assist the much needed application.

  11. Exactly… safaricom should with immediate effect adopt such ideas… they have made their customers “Naked” in terms of personal data privacy … creating conducive room for fraud setters…

  12. My friend shut up, the agent remains with all your detils, from phone number to the name to the ID no. Am saying because I once was an agent just recently. So if you think that the agent has limited, then you are wrong, he has more than enough

  13. Great article, data privacy is a problem that should not be taken lightly.
    Safaricom needs to protect our personal data before it falls into the hands of professional scammers

  14. This article is not well thought, sorry to say this. The stupid idea of minutes to make money accessible is so lame as long as it gives the name. Not only will it slow the system for nothing but inconvenience people so badly. Imagine having to stay with a client for munites just to avoid cancellation of transaction. Hakikisha was subcrition based. By accepting to use it means u accepted it’s terms. It’s funny u mentioned Truecaller, a fraudster has so many ways of getting your details.

  15. Thank you for not just identifying the problem but also finding a solution. I hope Safaricom gets a work around with some of the solutions offered. God bless you in Christ Jesus the solid rock we stand all others just but sinking sand

  16. Nice idea,but my suggestion as a cybersecurity specialist is that safaricom should assign a person with a new unique ID number that that exactly mean the the person national ID but has been translated somehow to generate a new Safaricom ID that they can convert themselves to find the person real nation andit is very possible.

  17. Safaricom also needs to look at how the can somehow hide your balance from the receipt when u pay with mpesa some attendants want to look at the message, granted that’s okay. But at the tailgate of that message shows how much is left in your wallet. So your just show everyone how much you have in your mobile wallet. This is risky if you have like many zeros after a digit, it could mark you as a target

  18. From an agents perspective the o ly information an Mpesa agent has after a deposit or withdrawal is ua name and ID number they never have the phone number unless they request an admin, Mpesa agents serve different people daily I feel its rather very hard for them to be using details fraudulently I mean we all go to these buildings in town with log books where we give out our phone numbers, id’s and names. When it comes to data issues then we seem to have along way to go. Not just mpesa

  19. Brilliant article handsome young man
    Safaricom should employ individuals like youbso that people do not compare you with Nyakundi because you are all bloggers

  20. For me I think they should introduce a nickname/username/display name where only safaricom and people who you are transacting with would know your real names

  21. There is also the issue of Safaricom confiscating one’s cellphone number when you travel out of Kenya and don’t use it for 6 months and worse give the exact number to another person, unknowingly your friends continue to use the number and make Mpesa transaction on it. Can Safaricom reshuffle the phone number instead of registering it EXACT !!! Mpesa agents are not strict with I/D’s.

  22. Nice article, but you should have also noted that Mpesa is not a bank, it is illegal until otherwise. Once a ground breaking innovation has been hijacked by the dynasties (Moi: KCB; KCB Mpesa , Kenyatta: CBA; Fuliza, Mshwari, to extort the third estate.

  23. The article is on point. Just wanted to add that they should also tighten the refund policy to companies n gvt institutions that use paybill. E.G. eCitizen It’s impossible to get a refund if one erroneously pays twice for parking. The phone numbers that safaricom customer care gives for eCitizen don’t work, there no mechanism for a written request, no office to visit…. Compute this error to 200 customers in a day? It’s good money that an accountant doesn’t need to account for

  24. Giving details helps us find fraudsters and other Criminal aliens. So hakikisha thing should be there to stay safety first, how not to use personal information is what people should be taught.

  25. An add on is that mobile money companies should be able to notify their customers when their details are used to register new number/line and let customer confirm using the existing number that for sure they are signing in a new number to avoid scam/ fraud.

  26. A very intriguing article. The reason why “Hakikisha” was accepted by Kenyans is because most of us don’t even have the slightest idea of what privacy means and we would sell our data for free. Try this Hakikisha sh*t on a privacy conscious country and the next day it would be shut down. Sorry, next hour. Very glad someone out there is actually thinking in a privacy conscious way. Means we are actually beginning to wake up. Kudos.

    Someone mentioned “a necessary evil”…my sentiments exactly…the kind of thinking that means we don’t even know what privacy is and what it entails. There is no necessary evil when it comes to someone using your data without your approval. You have so say yes…period. we only recently passed the data protection laws so we have a looooong way to go. Pushed hard enough, I’m sure Safaricom would implement a privacy policy.

  27. Well I like the gesture that comes with the article but the alternative proposed doesn’t really match up to the service being offered. Recently Jack disclosed why Twitter was rather less reluctant to add the edit button. As part of the alternatives they had considered was the option in which they could introduce a 30 second window after a tweet was sent wherein a user could edit the tweet. It was turned down because it meant that globally, a tweet would take an extra 30 seconds before being read. And this hampered its core intention. Being social in the now.

    Introducing a delay with mpesa simply does exactly the same thing. You use mpesa because you’re guaranteed of using your money now. You will receive it now and you will send it now. What they could consider instead would be blacking out most parts of the name. Or having you input the customers name and letting them tell you whether it matches or not. But this again brings another problem, you’d have to know your persons name together with all their apostrophes and pronunciation otherwise more often than not you’d get a name wrong and essentially the service becomes less useful. Eventually being neglected in future due to inefficiencies.

    Hakikisha is here to stay. That’s for sure. Safaricom has gained more, the public as well through actually being able to verify numbers than the loss that would come with someone having your full names. And at this point, its a necessary evil. I do not downplay your information being easily accessible. My 2 cents, black out 3 quarters of the name.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Back to top button