Is your money vanishing from M-Pesa without your permission? One Kenyan found out the hard way that the Social Health Authority (SHA) could be deducting funds directly, sparking a wave of concern. But how is this even possible without entering your M-Pesa PIN? Let's break down what happened and how you can protect yourself.
On January 12th, 2026, a Kenyan M-Pesa user, identified as @UCollince on X (formerly Twitter), voiced his frustration online. He noticed that SHA, following his enrollment in their 'Lipa Mdogo Mdogo' service, was directly debiting his M-Pesa account. The alarming part? No PIN prompt was ever requested. He took to social media, tagging Safaricom, demanding an explanation for what he perceived as unauthorized access to his funds.
"Good morning, @SafaricomPLC. Kindly explain how @_shakenya is able to deduct money from our M-Pesa accounts without prompting us to enter our PIN. This started happening after we registered for the Lipa Mdogo Mdogo service. We need clarification on how this authorization works," he posted, highlighting a growing anxiety among users of the service.
Safaricom, the telecommunications giant behind M-Pesa, quickly responded to the user's concerns. The explanation hinges on a specific M-Pesa feature: M-Pesa Ratiba.
According to Safaricom, if a user has activated M-Pesa Ratiba and granted SHA permission for auto-deduction, funds can be debited without requiring a PIN for each transaction. "Hello Collince, apologies for that. If you have activated M-PESA Ratiba, which is a standing order service on M-PESA, and enabled SHA to auto deduct, this can happen without prompting for the PIN," Safaricom stated in their reply.
But here's where it gets controversial... While M-Pesa Ratiba offers convenience for recurring payments, the lack of PIN prompts for each deduction raises significant security and control concerns. Users might unknowingly authorize deductions or forget about the standing order, leading to unexpected and potentially unwanted transactions.
So, what exactly is M-Pesa Ratiba? Introduced in October 2024, M-Pesa Ratiba is essentially a standing order service within M-Pesa. It allows users to schedule recurring payments – daily, weekly, monthly, or yearly – to other individuals or businesses directly from their M-Pesa wallets. Think of it as automatically scheduling your rent payment, school fees, or even a monthly subscription. Setting up Ratiba is designed to be straightforward, and Safaricom emphasizes that there are no penalties for cancelled or failed transfers due to insufficient balance.
Examples of how you might use M-Pesa Ratiba include setting up regular payments for rent, school fees, insurance premiums, newspaper subscriptions, utility bills, or even sending regular financial support to family members. It's designed to streamline those predictable, recurring transactions.
And this is the part most people miss... The power to automate payments also means potentially losing direct control over each individual transaction. While convenient, it’s crucial to understand the implications of granting auto-deduction permissions.
Controversy Alert! The core issue boils down to user control versus convenience. Is the ease of automatic payments worth the potential risk of unauthorized or forgotten deductions? Some argue that the onus is on the user to carefully manage their M-Pesa Ratiba settings and authorized deductions. Others believe Safaricom should implement additional security measures, such as transaction notifications or periodic authorization confirmations, to enhance user protection. What do you think?
What are your thoughts on this issue? Do you find the convenience of M-Pesa Ratiba outweighs the potential security risks? Have you experienced similar situations with automatic deductions? Share your experiences and opinions in the comments below!
