Want to defeat M-Pesa scammers? Master transaction codes

Messaging fraud is becoming a major concern to Kenyans, with recent reports indicating a rapid rise in scams that target online and mobile messaging services.

One of the most common trends in messaging fraud is the use of fabricated M-Pesa transaction messages that fraudsters send to unsuspecting mobile phone users to con them of their hard-earned money.

Usually, a mobile phone user will receive a message scripted as an M-Pesa transaction, informing them that they have received money by mistake. The sender will immediately call them, asking to be refunded the money which they purport to have transferred erroneously.

Some have fallen into that trap, refunding money that they did not receive in the first place. This happens especially when one does not verify if the M-Pesa transaction message comes from service provider Safaricom.

These deceptive schemes by fraudsters who target financial and personal data are getting more complex and, as a result, expose people and businesses to significant financial losses as well as identity theft.

A recent study by information and insights company TransUnion found that that digital and message fraud remains a significant concern.

According to the study, 72 per cent of consumers surveyed reported being targeted by fraud schemes but avoided falling victim, while eight per cent said they fell victim.

At the same time, a recent global report by Ofcom said scams are more commonly attempted via text messages, with about seven in 10 people globally reporting to have received a suspicious text.

With this trend of defrauding people becoming even more common and advanced with time, it has become necessary for people to understand the logic behind M-Pesa transaction codes such that one can use the knowledge to determine whether the code is authentic or fraudulent.

Speaking to The Eastleigh Voice, Safaricom’s Cluster Technical Tribe Lead for Financial Services Hesbon Kiptoo said the M-Pesa transaction code is usually a medley of letters and numbers that the service provider uses to create a reference for every mobile money transaction carried out on their platform.

“We use letters and numbers in generating M-Pesa transaction codes because the combining alphanumerical offers limitless permutations meaning we can never run out of M-Pesa transaction codes,” Kiptoo said.

The first three digits of an M-Pesa transaction code denote the year (first digit), month (second digit), and date of the month (third digit) that the transaction took place.

This year, all M-Pesa transaction code messages start with the letter S while mobile money transfers that will be done in 2025 will start with the letter T.

The second digit in an M-Pesa transaction code can only contain any of the first 12 letters of the alphabet with the letter A representing January and the letter L denoting December. Since we are in August, the first two letters of M-Pesa transaction codes generated to denote mobile money transfers done this month will start with the letters SH.

A M-Pesa graphic. (Photo: Safaricom)

The third digit in an M-Pesa transaction code can only contain the numbers 1-9 or the letters A-V. The numbers 1-9 are used to denote transactions which take place during the first nine days of a month with 1 representing the first day of the month and 9 standing showing the ninth day of the month.

The letters A-V denote transactions which took place between the 10th day and the 31st day of a month. The letter A represents the 10th day of the month while V represents the 31st day of the month.

For months with 30 days, the letter U is used to represent the month’s last day. For February, which can end in 28 or 29 days, the letters S and T are used to represent the month’s last day in an M-Pesa transaction code.

Knowing what the first three digits of an M-Pesa transaction code denote can assist one in identifying a fake M-Pesa transaction code and avert a fraud attempt.

Kiptoo revealed that the remaining seven digits in an M-Pesa transaction code are generated sequentially to denote transactions as they take place in real-time and the numbers and letters contained therein assist the company to keep track of all mobile money transfers.

“The transaction codes provide us with information about a mobile money transfer transaction such as whether the money was moving from an M-Pesa agent or a bank to a person’s number, among other details that can help in following up on a transaction in case there is a complaint or a reversal request,” Kiptoo said.

Speaking to The Eastleigh Voice, Jeff Oduor, an account executive at Infobip, which helps businesses communicate with their customers through SMS, chatbots and online platforms such as WhatsApp, said checking a sender’s ID is crucial in differentiating between a fake and a real message.

This, he said, applies especially to banking messages that fraudsters often use to lure their targets.

“The message should always have a recognised ID, for instance, Safaricom or M-Pesa,” he said.

Oduor, however, paints a positive picture of the country’s scope of messaging and digital fraud.

“If you compare the scope of Kenya to other African peers like Nigeria, then you're nowhere in terms of the numbers. People in the country are also more educated on the matter and are sensitised on those kinds of messages, making fraud detection easier,” he said.

He said evolving technology on Google messages and specific apps are equipped to warn individuals if a message looks malicious.

Oduor said users should expect the introduction of a special type of text messaging which will incorporate additional features like images instead of just receiving blank texts.

The communication protocol — the Rich Communication Services (RCS) — which is yet to be applied in the country, has been launched in South Africa and Nigeria.

RCS will replace SMS and MMS on cellular networks with a communication system that is richer and more modern.

“Engagements are ongoing with different stakeholders seeking to bring the feature into the country,” Oduor said.