Safaricom has explained how customers can safely open their password-protected M-PESA statements after clarifying that the security feature is designed to protect sensitive financial information from unauthorised access.

The clarification came after a customer questioned why M-PESA statements requested by users require a password before they can be opened, with the telecommunications company maintaining that the additional layer of security helps safeguard transaction records from unintended access.

Customers requesting an M-PESA statement through the M-PESA App or by dialling *334# receive the document as a password-protected PDF sent to their registered email address. At the same time, Safaricom sends a unique password via SMS to the customer’s registered mobile number.

To open the M-PESA statement safely, customers only need to download the PDF attachment, open it using any PDF reader on a smartphone or computer, and enter the password exactly as it appears in the SMS. Every statement is generated with a different password, meaning passwords cannot be reused to unlock future statements. If the password does not work, customers should confirm they are using the password sent for that specific statement, as each new request generates a fresh PDF and a new password.

Those who do not receive the password immediately are advised to wait a few minutes before submitting another request, while customers who cannot find the statement should check their spam or junk email folders before contacting Safaricom customer support.

Why are M-PESA statements locked?

Safaricom says password-protecting M-PESA statements forms part of its broader efforts to protect customers’ confidential financial information as digital financial services continue to grow. An M-PESA statement contains detailed records of deposits, withdrawals, money transfers, merchant payments, bill payments and other account activity that could expose sensitive financial data if accessed by unauthorised persons.

By separating the statement from its password, the company reduces the risk of fraud if an email account is compromised, a statement is accidentally forwarded, or a shared device is used to access emails.

The company has also continued to remind customers never to share their M-PESA PIN, one-time passwords (OTPs), statement passwords or other confidential account details with anyone.

Accessing your M-Pesa statement

Customers who cannot open a password-protected M-PESA statement should first verify that they are using the password sent via SMS for that specific statement request. Since every statement has a unique password, previously received passwords cannot unlock newly generated statements.

Customers should also ensure they have downloaded the latest PDF attached to the email and entered the password correctly. If the SMS containing the password is delayed, requesting a new statement will generate a fresh PDF together with a new password.

For persistent issues, Safaricom advises customers to seek assistance through its official customer support channels.

The guidance reinforces Safaricom’s emphasis on protecting customers’ financial information while ensuring they can conveniently access their M-PESA transaction history for personal record-keeping, loan applications, tax compliance and other financial needs.

The company’s password protection system is intended to ensure that only the rightful account holder can view sensitive transaction records, even if the statement email is accessed by someone else.