Card checkout beside M-Pesa for merchants in Kenya

M-Pesa is not a card authorization

An M-Pesa confirmation is a prompt or a paybill on the customer’s phone. A 2D card authorization is the number, the expiry, and the CVV typed into a checkout. Offering both on one Kenyan store does not merge them. If the card network asks for 3-D Secure, the card path gains an OTP. The M-Pesa path still ends on the phone, whether or not the card path asked for a password.

IntaSend spells out the card checks in order. The number, the expiry, and the name are on the front of the card. The CVV is the second check, and card networks also call that code CID, CVC, or CSC. The OTP, when a 3D flow is used, is a third check sent to the mobile number the customer registered at the bank. IntaSend says that code is random and usually expires in about five minutes. A shopper who cannot see the phone cannot finish that third check. That is why a stolen card photo is weaker against a 3D flow than against a form that stops at the CVV. It is also why you should not advertise that a Kenyan checkout never asks for the password. The network can still demand it.

IntaSend argues that the extra password cuts fraud, cuts chargebacks, and reassures shoppers who look for a 3-D Secure mark. Those are arguments for keeping the password available, not statistics we are repeating as our own results. Chargebacks still need a person who can send evidence. Fincra’s Kenya page points merchants to a dashboard and to dedicated managers. Use that kind of access so a failed M-Pesa prompt and a declined card are visible as separate rows. A single “failed payment” label will send your team to the wrong rail.

Going live is a short sequence. First decide which confirmations you will show: M-Pesa, cards, bank transfer, or all three. Second, pick the pipe: a payment link if there is no website, a plugin if the store is WooCommerce or Shopify, or an API if the product is your own. Third, run one test on each confirmation, not one test that you then assume covers the others. Fourth, agree who settles the funds and on what schedule, in writing. Fincra lists KES among the currencies it says it can process, and it also lists payouts to bank accounts and mobile money. Settlement into a Kenyan business account is a commercial term. It is not created by labelling the card form 2D.

SeerBit Kenya describes reach across more than a dozen African countries from one integration, and local payment methods as the way to convert buyers who will not use a foreign card. That is useful when you sell outside Kenya. It does not remove M-Pesa for buyers who are in Kenya. Paytota describes the same idea from the other direction: one connection toward many markets, with cards, transfers, wallets, and cash named as categories. Keep the Kenyan phone confirmation in the list even if the catalogue of foreign methods gets longer.

Before the first real shilling moves, write down the three confirmations in the order the shopper will see them. If M-Pesa is first, the phone prompt should be the first thing after the amount. If the card is first, the number, expiry, and CVV come first, and the OTP appears only when the network asks. A bank transfer, when you offer it, needs its own reference so the credit can be matched. Fincra’s pay-in copy treats those methods as a list the customer chooses, not as one blended authorization. Copy that separation into the screen, then test each line with a small amount. A test that only checks the card will not tell you whether the M-Pesa prompt reached the handset. Record that test.