Safaricom has received approval from the Central Bank of Kenya (CBK) to mask customers’ phone numbers when they pay using M-Pesa to Till and Paybill numbers, a development aimed at strengthening privacy and protecting users’ personal data during digital transactions.
Under the new arrangement, when a customer makes a payment through M-Pesa to a merchant’s Till or Paybill number, the merchant will no longer see the customer’s full phone number. Instead, a masked version of the number where part of the digits are hidden will be displayed. This means that sensitive personal information will not be transmitted to merchants automatically, reducing the risk of unsolicited contact, spamming, fraud or misuse of personal data.
The CBK’s approval expands on existing privacy enhancements that Safaricom has tested in recent years. Historically, customers making payments with M-Pesa saw their full phone number and name shared with merchants upon transaction completion, a practice that sometimes resulted in post payment contact for marketing or other purposes. The new model aligns M-Pesa transaction data with the Data Protection Act, 2019, which requires that personal data collected during any transaction be limited to what is strictly necessary for completing the payment.
In its announcement, CBK noted the growing importance of privacy features on digital platforms as part of consumer trust and confidence. A related report stated that “with the rise of digital services, including e-commerce, privacy features such as number masking on mobile payment platforms are important for digital trust and consumer protection.”
For users, the practical experience of making payments will remain largely unchanged. They will continue to use the familiar steps to complete M-Pesa transactions; the only difference will be that merchants will receive a masked phone number rather than the full one. Merchants, meanwhile, are expected to confirm transactions through their business apps or other integrated systems rather than relying on seeing the customer’s number.
Safaricom’s move echoes broader trends in Kenya’s digital economy where privacy and data protection are becoming central to service design. Critics had previously raised concerns about how easily mobile money contact details could be harvested and used without consent. Masking phone numbers reduces that exposure, making it harder for personal information to be used for unsolicited outreach or malicious activity.
In Kenya, mobile money remains a cornerstone of the digital economy, with millions of transactions processed daily. As services evolve and government regulators like CBK prioritise consumer safeguards, further enhancements to data security, compliance and trust are expected to complement ongoing innovations in the fintech space.
