CBK approves M-Pesa phone number masking for privacy

The approval came in a February 2026 letter. It covers peer-to-peer transfers. It includes Till and PayBill payments. Senders’ numbers will appear masked. For example, 0722XXXXXX. Merchants see partial details. They get payment amounts and codes. Full numbers need sender consent.

This tackles data misuse. Over 5,000 complaints hit in 2024. A third came from financial firms. Users faced spam. They got unsolicited calls. Masking stops this.

Previously, merchants saw full names and numbers. No opt-out existed. This fueled fraud risks.

Alignment with data protection law

The change supports Kenya’s Data Protection Act 2019. It limits data collection. Only essential info is gathered.

Sharing full numbers was excessive. It happened in routine buys. Like groceries or utilities. This led to marketing lists. It enabled fraud.

Safaricom already masks in Pochi la Biashara. Now, it extends across M-Pesa. This closes old gaps.

The feature minimizes data. It plugs leaks at the source.

Impact on merchants and users

Businesses must adjust. They cannot ask for confirmation messages. Safaricom discourages this. So does the Office of the Data Protection Commissioner.

Verify via apps instead. Use USSD like *334#. Or point-of-sale systems.

Small traders gain. They collected data unknowingly. This broke laws. Masking removes the risk. No action needed.

Users see no change in payments. Transactions stay fast. They remain reliable. But less data shares.

The rollout feels seamless. Money moves quietly. Numbers stay private.

Broader privacy gains

Kenya’s digital economy grows. Data privacy awareness rises.

The Office of the Data Protection Commissioner enforces more. Resolutions increase. Compensations follow breaches.

Advocates praise masking. It reduces fraud chances. It cuts social engineering.

Safaricom will educate users. This ensures smooth adoption.