As every M-Pesa user has become accustomed to, paying at a till number or through Paybill means the merchant on the other end gets more than just a payment alert. Your full name and phone number go along with it automatically, with no opt-out.
For most people that went unnoticed, but for others, it opened the door to unsolicited calls, spam messages, and worse. That chapter is now coming to a close.
The Central Bank of Kenya (CBK) has officially authorised Safaricom to roll out phone number masking across M-Pesa, as reported by the Business Daily. Under the new system, merchants will still receive a payment notification; however, instead of seeing your full number, they will see a masked version, something like 0722XXXXXX. The payment goes through exactly as before; what changes is how much of your personal data travels with it.
This aligns M-Pesa with Kenya’s Data Protection Act 2019, which requires that personal data collected during any transaction be limited strictly to what is necessary. Sharing a customer’s phone number every time they buy groceries or pay a utility bill has long been considered excessive under that standard. A number harvested today becomes a marketing list or a fraud tool tomorrow. Masking plugs that leak at the source.
This is not entirely new territory for Safaricom. Its Pochi la Biashara service has already hidden customer numbers from sellers. The CBK’s latest approval simply extends that same standard of privacy across the wider M-Pesa ecosystem, closing a gap that had existed for years.
For businesses, the adjustment is largely procedural. The familiar practice of asking a customer to “show the confirmation message” is being phased out. Both Safaricom and the Office of the Data Protection Commissioner are actively discouraging it.
Instead, merchants are expected to verify payments through their own M-Pesa business apps, USSD codes such as *334#, or integrated point-of-sale systems. The transaction still goes through; only this time merchants will simply have to confirm it on their own devices instead of asking to see your phone.
For small traders, this is an unexpected bonus. Many have been unknowingly collecting customer data, including the names and phone numbers with every transaction, without realising that doing so carries legal obligations under the Data Protection Act. Masking removes that risk quietly, in the background, without requiring any action on their part.
For users, the rollout should feel seamless; payments work exactly as before, only quieter. As your money moves, your number only stays with you.
