M-Pesa Begins Masking Phone Numbers in Transactions as Privacy Push Takes Effect
Kenya’s leading mobile money platform, M-Pesa, has officially begun rolling out a new privacy feature that masks users’ phone numbers during transactions, marking a major shift in how personal data is shared within the country’s digital payments ecosystem. The change, which takes effect this week, follows regulatory approval from the Central Bank of Kenya and is expected to significantly enhance user privacy while reducing fraud and misuse of personal information.
For years, M-Pesa users making payments through PayBill and Buy Goods (Till numbers) have unknowingly shared sensitive personal details with merchants, including their full names and phone numbers. While this system made transaction verification easy, it also created a loophole that exposed millions of Kenyans to unsolicited marketing messages, spam, and even potential fraud schemes. Now, that long-standing practice is coming to an end.
Under the new system, when a customer completes a transaction, the recipient will no longer see the sender’s full mobile number. Instead, the number will appear in a partially masked format, such as 07XX XXX 123, while the transaction itself will still go through seamlessly.
The decision to introduce this feature was not abrupt. It is rooted in a broader push to align Kenya’s fast-growing digital financial services sector with the requirements of the Data Protection Act of 2019. The law emphasizes the principle of data minimisation, which requires that only necessary personal data be shared during any transaction. For regulators and privacy advocates, the routine exposure of full phone numbers during everyday payments had increasingly been viewed as excessive and risky.
The turning point came in late February 2026. In a formal communication dated February 27, 2026, the Central Bank of Kenya approved Safaricom’s request to implement phone number masking across M-Pesa transactions. This approval followed a review of the company’s proposal to enhance customer privacy and reduce data exposure.
Shortly after the approval, Safaricom began preparations for rollout, and by early March 2026, the feature started going live across the network. Reports indicate that the approval and rollout announcements gained widespread public attention around March 2–3, 2026, when multiple platforms confirmed that the feature would be implemented immediately.
This development is also part of a longer evolution of the M-Pesa platform. In recent years, Safaricom has been gradually introducing privacy-focused features, including services like Pochi la Biashara, which already masked customer numbers for small traders. The latest update simply expands that level of privacy protection across all major transaction types, closing a gap that had existed for years.
Beyond privacy, the change is expected to transform how transactions are verified in everyday situations. Traditionally, customers were often asked to show their M-Pesa confirmation messages to prove payment. This practice, though common, raised serious legal and ethical concerns because those messages contain sensitive personal and financial data. With the new system, merchants are now expected to rely on their own M-Pesa business tools, such as transaction notifications, apps, or USSD systems, to confirm payments instead of requesting access to a customer’s phone.
For businesses, especially small traders, the shift may require slight adjustments but ultimately reduces their exposure to data protection risks. Many merchants had been unknowingly collecting customer data without complying with legal requirements, which could expose them to penalties under data protection laws. By masking this information automatically, the system removes that burden and ensures compliance in the background.
For customers, however, the benefits are immediate and clear. The risk of having one’s phone number harvested for marketing lists or fraudulent schemes is significantly reduced. It also reinforces a broader cultural shift toward digital privacy, where users retain greater control over their personal information even in routine transactions.
The rollout comes at a time when M-Pesa continues to dominate Kenya’s financial landscape, serving tens of millions of users and acting as a backbone for daily economic activity. As the platform evolves, changes like phone number masking signal a move toward a more secure and privacy-conscious future for digital payments.
Ultimately, the introduction of masked phone numbers is more than just a technical update. It represents a regulatory and technological alignment aimed at protecting users in an increasingly digital economy. With the Central Bank of Kenya’s approval now implemented, the move sets a new standard for how mobile money platforms handle personal data—not just in Kenya, but potentially across other markets where M-Pesa operates.
As this new era begins, one thing is clear: sending money will feel exactly the same, but the information that travels with it will be far more secure.
