Safaricom Under Pressure Over SHA Deductions From M Pesa Without PIN Prompt

Safaricom has come under renewed public scrutiny after Kenyans raised alarm over the Social Health Authority (SHA) allegedly deducting money from M Pesa accounts without prompting users to enter their PIN, particularly after registration for the SHA Lipa Mdogo Mdogo service.

The issue, which sparked intense debate online, gained momentum after an M Pesa user on X claimed the deductions began soon after enrolling in the instalment based health payment programme.

“Kindly explain how SHA is able to deduct money from our M Pesa accounts without prompting us to enter our PIN,” the user wrote in a direct appeal to Safaricom.

Safaricom later issued an explanation on how the deductions occur, describing the process as an authorised payment mechanism linked to the SHA service.

However, the clarification has done little to calm the growing concern among Kenyans, who argue that the ability to deduct money without a PIN prompt raises questions about consumer consent, transparency, and the integrity of M Pesa’s security safeguards.

Kenyans Demand Answers on Consent and Control

Online reactions show widespread discomfort with what users describe as an automated deduction system operating without real time confirmation from account holders.

Many Kenyans argue that the PIN prompt is the most visible and critical user control feature on M Pesa and its absence creates uncertainty about whether users are actively approving transactions.

Critics say that while automation can improve convenience, it must not undermine account holder authority over when money leaves their wallet.

The controversy has fueled fears that such payment structures may set a precedent where other institutions could eventually access customer funds through pre authorisation models that ordinary users do not fully understand.

“Kenyans are not refusing to contribute,” one user argued in the comments. “They want transparency, consent and control.”

Concern Over Financial Rights and Data Protection

The backlash has also expanded into a broader conversation about financial rights and personal data protection.

Some users and digital rights voices have questioned whether the SHA payment process meets the standard of informed consent as required under Kenya’s Data Protection framework, especially if users are not clearly alerted that the programme enables future deductions without PIN verification.

The key issue being raised is whether registration alone constitutes sufficient consent for subsequent deductions or whether users should receive explicit confirmation prompts before every transaction.

Others argued that any system that bypasses a PIN prompt, even if technically authorised, risks weakening public confidence in the security of the mobile money platform.

---

Authored by Edward Nganga via LinkedIn

---