In-app M-Pesa payments: how the STK push works, and what to check before you enter your PIN

When you tap deposit in a betting app and pick M-Pesa, you usually type only your phone number and the amount. Seconds later a Safaricom pop-up appears on your phone and asks for your M-Pesa PIN. That pop-up is the STK push, and Safaricom has published how it works.

A licensed app should reach this screen only after it has checked who you are, because regulation 82(2) of L.N. 112 places the identity check before the first wagering deposit; why a betting app asks for your ID photo covers that step. This page covers the payment itself: the flow, the prompt, the recipient, the charges and what to do when a push fails.

What is an STK push?

STK stands for SIM Toolkit, the Safaricom menu stored on your SIM card. Safaricom's 2018 integration document describes the Lipa na M-PESA API as built on a feature called STK Push, which moves the start of a payment from the paying customer to the business being paid. The same document heads that section M-PESA Xpress API, and Safaricom's Google Play payment pages use the M-PESA Xpress name too.

Without a push, you would pay a paybill by hand and type the business number and account number yourself. Safaricom's document says the push removes the need to remember those numbers, because the business presets every detail and the customer only confirms with the PIN. It remains a customer-to-business payment; only the starting point moves.

What happens between the tap and the PIN?

Safaricom's document sets out eight steps. The table puts them in order, with who acts at each one.

Step 8 matters when money leaves your M-Pesa but the betting balance does not move. The operator still has ways to look the payment up, so your M-Pesa confirmation message is the evidence to give its customer care.

What should the prompt on your phone show?

Safaricom's document says the customer confirms the payment amount from the message on screen before entering the PIN. Compare that figure with the amount you typed in the app. If it differs, or a prompt appears when you did not tap deposit, cancel it.

A cancelled or ignored prompt moves no money. The 2018 document treats a cancellation, a wrong PIN and a timeout alike: the transaction is cancelled and the operator is told the reason.

The PIN goes into Safaricom's pop-up, never into a box drawn by the betting app. Safaricom's Secure M-PESA page says the PIN must not be shared with anyone, including people who claim to be Safaricom support, and that Safaricom contacts customers only from 0722000000. A screen or a caller asking you to type or read out the PIN is a reason to stop.

How do you confirm who you are paying?

In the request, the party being paid is the operator's shortcode, and the account reference is the value you would otherwise have typed as the account number. Regulation 3(3)(b) of L.N. 112 requires a licensee, before it starts operating, to declare to the Authority all the pay bills or other payment mechanisms it will use.

That declaration is not published in a form you can search. The regulator's list on gra.go.ke has eight columns, No., Operators Name, Trading Name, BK, PG, PL, STATUS and DOMAINS, and none of them holds a paybill number. So the practical check is the app itself: confirm its operator and domain on the App check list of licensed operators and domains before you deposit.

Section 73(4) of the Gambling Control Act, 2025 lets a licensee receive player funds by debit card, electronic funds transfer, mobile money transfer, cash deposit or another method the Authority approves. Regulation 85(1) of L.N. 112 requires every financial transaction of a licensee to pass through a secure payment gateway that meets the payment industry data security standard or an approved equivalent.

Both rules describe money reaching the licensee. A request to top up your account by sending money to someone's personal number does not, and it is one of the warning signs in how to spot a fake or clone betting app.

What does an M-Pesa deposit cost?

Safaricom publishes customer charges for some payment types but not for all of them. The table sets out what its consumer tariff page and the Act say.

Whether a paybill deposit costs you anything depends on how the operator's paybill is set up, and the Safaricom pages read for this guide do not say. Section 72(6)(b) gives you the way to find out: the operator must make available the particulars of any processing fee you may incur, so look for them before you confirm.

Illustrative example: a deposit of KES 300,000 cannot go through as a single push, because the per-transaction limit is KES 250,000. It would take two pushes, and both would count toward the KES 500,000 daily limit together with every other M-Pesa payment you make that day.

Safaricom's ceilings are not spending advice. If you want a lower one, regulation 84(2)(a) of L.N. 112 requires the operator to let you set daily, weekly and monthly deposit limits, and the help and limits page lists other tools.

Why did the push fail or never arrive?

Safaricom's document names five ways a push ends without a payment. Each has a simple check.

• A wrong PIN cancels the request, so start a new deposit and type the PIN with care.
• A timeout ends the request; the 2018 document puts the window at usually 1 minute 30 seconds.
• A SIM without the STK applet cannot show the prompt. Safaricom's FAQ on M-PESA payments in Google Play tells customers who get no PIN push to update the SIM by dialling *234*1*6#.
• A cancel tapped on the phone stops the payment at once.
• A second STK request on the same phone fails while the first is still running, because only one can be processed at a time.

The same sources add two conditions. The phone must be online and unlocked when the push is sent, and the Google Play FAQ asks dual-SIM users to keep the Safaricom line in SIM one. Even after a correct PIN, M-Pesa processes the payment like any other customer-to-business transaction, so the result can still be a failure.

Before you tap deposit again, check your M-Pesa balance or the latest confirmation SMS. Safaricom's Secure M-PESA page advises checking the balance on SMS as proof of a transaction, which avoids paying twice.

Money left M-Pesa but the app shows nothing: what now?

Contact the operator first, with the M-Pesa transaction code, the amount and the time. Section 68(8) of the Act requires an online operator to keep its customer care centre in Kenya. Under regulation 9(2)(e) of L.N. 112, a complaint still unresolved after 72 hours, or one you ask in writing to escalate, is referred to the Authority.

Do not count on a self-reversal. Safaricom's reversal page says forwarding the confirmation message to 456 works within 24 hours for Safaricom-to-Safaricom person-to-person transfers and for airtime bought for yourself; a payment to a business paybill is not on that list.

If the app turns out to be a clone, the money went to whoever controls that paybill or number. Report the fake betting app and keep every confirmation message.

What this page does not cover

Withdrawals, money sent from the operator back to your phone, are not covered here, although the Third Schedule to L.N. 112 says prizes up to KES 500,000 are paid automatically to the player's registered mobile money wallet or account. Taxes on deposits and withdrawals, Airtel Money and card deposits are also outside this page. The Safaricom document quoted above dates from October 2018, so its time window and wording may have changed since.