It is a ritual every Kenyan knows: you pay for fuel, groceries, or a meal, and before you can leave, a security guard demands to see your phone to "confirm" the M-Pesa message. According to the Office of the Data Protection Commissioner (ODPC), this common practice is illegal and a violation of your privacy.

Data Commissioner Immaculate Kassait has clarified that merchants and security firms have no legal basis to demand access to your personal device. The M-Pesa SMS contains sensitive financial data, including your balance, which is private property protected under the Data Protection Act of 2019.

The Legal Stand

The ODPC notes that the merchant receives their own confirmation message. Demanding to see the customer’s phone is essentially a lack of trust in their own internal systems.

• What They Can Ask: A cashier can ask for the transaction code (e.g., QAA5...) to verify payment in their system.
• What They Can't Ask: They cannot demand you hand over your unlocked phone or scroll through your messages. This exposes users to "shoulder surfing" where fraudsters steal personal data.
• The Loophole: Many businesses claim their systems are slow to reflect payments. However, the ODPC insists that administrative inefficiency is not a justification for breaching privacy rights.

Know Your Rights

As digital payments become the norm, data hygiene is critical. Kenyans are urged to politely decline such requests and read out the code instead. Your phone is your bank branch; you wouldn't let a stranger walk into the bank manager's office, so don't let them into your inbox.