The reliable way to check if an M-Pesa payment is real: verify the customer's code against the confirmation SMS you receive — in about three seconds, no API.
— reads
The reliable way to check if an M-Pesa payment is real is simple to state and easy to get wrong: verify the customer's transaction reference against the confirmation message the operator sent to your own phone — never against the screenshot on theirs. A screenshot is just a picture, and pictures are edited in seconds with a free app. The confirmation SMS that M-Pesa delivers to the merchant's SIM, by contrast, comes straight from the operator's system to a device the customer cannot reach. That is the copy worth trusting, and matching the customer's code against it is exactly what KODA automates — the full flow is on How KODA verifies mobile money payments.
It helps to know what a genuine M-Pesa confirmation actually is. When a customer pays, Safaricom or Vodacom sends a message containing a unique transaction code, the amount, and the sender's details to the receiving number. A real payment always leaves this trail on the merchant side. A fake payment leaves none — so the fraudster substitutes a doctored image, a forwarded text with the numbers changed, or a confident verbal claim. Each of these attacks a customer-side artifact. Checking the merchant-side confirmation sidesteps all of them, and KODA adds forgery tests on the device SMS stream, described in How KODA Catches Fake Payment SMS, so even a cleverly spoofed message is caught.
In practice the check takes seconds and no special equipment. The customer reads you the M-Pesa reference code; you submit it to KODA by typing it into the Manual Console, dropping it into a WhatsApp thread, sending a USSD string, or letting your checkout collect it. The engine matches the code, the amount and the sender against the real confirmation on your phone and returns a green verdict or a rejection. The step-by-step version, including how it works without any Safaricom or Vodacom integration, is in How to Verify an M-Pesa Payment Without a Telco API. Every verified code is then locked for life, so nobody can pay once and reuse the same code for a second order.
Verification catches the specific M-Pesa scams merchants meet every week. The recycled code — a genuine receipt reused across several tills — is dead on arrival once that reference has been spent. The wrong-amount trick, where a screenshot shows a bigger figure than what actually moved, fails because the amount must match. A payment that is still pending, was reversed, or was sent to the wrong number looks fine in a screenshot but produces no matching confirmation, so it will not verify. And an edited image never had a real code behind it in the first place.
None of this requires a contract with the operator. KODA does not plug into Safaricom or Vodacom; it simply reads the confirmation the merchant already receives, which is why it can verify M-Pesa across its markets and, with the same method, Orange Money, Airtel Money, MTN MoMo, Wave and more than 200 other operators. The live coverage map is on KODA global coverage — operators & countries. You keep your existing M-Pesa till or number and your existing routine — you only add a truth check between 'the customer says they paid' and 'I hand over the goods'.
If you take M-Pesa from the public, a single faked payment can wipe out the margin on many honest sales, so the habit worth building is small and permanent: never release value on a screenshot, always confirm the code. You can try it now at no cost — head to Get started with KODA free and verify your first M-Pesa payment free. To go deeper on the anti-fraud side, read How to Stop Mobile Money Screenshot Fraud in 2026, and if you are automating checks in software, see Mobile Money Payment Verification for AI Agents.
Verify the customer's transaction code against the confirmation SMS M-Pesa sent to your own phone — not against their screenshot. KODA does this match automatically and returns a verified-or-not verdict in about three seconds; see How KODA verifies mobile money payments.
A screenshot or a forwarded text can be edited, yes. The one copy that cannot be quietly doctored is the confirmation delivered by the operator to the merchant's own SIM — that is the copy KODA checks, with extra anti-forgery tests explained in How KODA Catches Fake Payment SMS.
No. KODA reads the confirmation the operator already sends the merchant, so it needs no operator integration and no telco contract. The same approach covers Orange Money, Airtel and 200-plus others — see KODA global coverage — operators & countries.
About three seconds, once the operator's confirmation has arrived on the merchant's phone. You can check a code by hand in the console or automate it entirely.