Safaricom Gains CBK Approval for Phone Number Masking in M-Pesa Transactions
Safaricom has received formal approval from the Central Bank of Kenya (CBK) to implement a data minimisation feature on its M-Pesa platform, allowing the company to mask customers' full phone numbers during payments to merchant Till numbers and PayBill accounts.
This long-awaited update, reported widely on March 2, 2026, addresses a longstanding privacy concern where merchants previously received the payer's complete mobile number alongside transaction confirmations. Under the new system, merchants will see only a partially hidden version—such as 0722XXXXXX—while still receiving essential details like the payment amount, transaction code, and possibly the sender's first name. The feature aligns with Kenya's Data Protection Act 2019, which mandates that personal data collected in transactions be limited to what is strictly necessary, reducing risks of misuse, unsolicited marketing, fraud, or unwanted contact from merchants.
The approval follows Safaricom's application to the regulator, which reviewed submissions and granted permission to roll out partial number masking for both merchant payments (Till and PayBill) and potentially peer-to-peer transfers. This builds on existing privacy measures, such as those in Safaricom's Pochi la Biashara service, which already hides customer numbers from small business sellers. Once activated, the change will apply by default to Lipa na M-Pesa transactions, meaning everyday payments at shops, for utilities, or services will no longer expose users' full contact details automatically. In cases where a merchant requires the complete number—for legitimate reasons like order fulfillment or follow-up—they may need to request it through the system, with the customer retaining the choice to approve or deny disclosure. This consent-based approach further strengthens user control over personal information.
The development has sparked positive reactions among users and privacy advocates, as it enhances digital security in Kenya's dominant mobile money ecosystem, which serves over 38 million active customers. By limiting the automatic sharing of identifiable data, the feature helps curb issues like social engineering scams and spam that have plagued M-Pesa users in the past. While the exact rollout timeline remains unclear, experts expect Safaricom to introduce the update soon, possibly with customer education campaigns to ensure smooth adoption. This move positions M-Pesa as more privacy-focused, reinforcing trust in digital payments amid growing regulatory emphasis on data protection across Africa's fintech landscape.
