The transactions themselves can only have an impact on compromising privacy if they fall into the wrong hands - but this is something that can be easily prevented if encryption of all data is used on the device, in this case a smartphone. In addition, every transaction can be seen online at any time, so if you want to brag to someone, you don't necessarily need to save a screenshot - you can always make it, send it to someone and then delete it.
You can simply warn him that it is a bad practice that has some risks, and beyond that, nothing else makes sense. If something bad happens, you did your part because you warned him, and if nothing bad happens, everyone is happy and satisfied.