Safaricom has received regulatory approval from the Central Bank of Kenya (CBK) to introduce number masking on M-PESA messages, marking a major privacy upgrade for users of the country’s most widely used mobile money platform.
The update will conceal a sender’s full mobile number when customers pay merchant Till or PayBill accounts, displaying only partial digits instead.
How the Number Masking Will Work
Under the new system, merchants who require a customer’s full mobile number must formally request it within the platform. Customers will then have the option to approve or decline the disclosure.
Safaricom says the feature is designed to close a long-standing privacy gap where phone numbers have traditionally served multiple roles — as an identity, account reference and merchant tracking tool.
Backed by Data Protection Law
The regulator approved the rollout in February following months of internal engagement between Safaricom and financial authorities.
The CBK noted that the move aligns with the data minimisation principle under the Data Protection Act 2019, which requires organisations to collect and process only the personal data necessary to deliver a service.
While merchants often use phone numbers to identify returning customers, regulators emphasised that the number itself does not determine whether a payment succeeds.
More Privacy Features Could Follow
Safaricom says the approval paves the way for extending similar protections to additional payment flows over time, including person-to-person transfers and broader business payments.
The company maintains that the feature will reduce unnecessary exposure of personal data while keeping transactions fully traceable through user-approved disclosure when genuinely required.
