On March 24, 2026, Safaricom officially rolled out a data minimisation feature on its mobile payment platform M-PESA, which partially masks customer phone numbers in transactions.
The feature, approved by the Central Bank of Kenya (CBK), covers Till, PayBill and P2P (Person-to-Person) payment channels. Under the new system, full mobile numbers of senders will no longer appear in M-PESA transaction notifications, replaced by partially masked versions — for example, the number 0722123000 will be displayed as 0722000*; meanwhile, the sender’s first and last names will still be shown in notifications to help recipients identify the sender. All other information, including transaction amount, date and time, and reference number, remains unchanged.
Peter Ndegwa, Chief Executive Officer of Safaricom, stated: “We have an obligation to ensure the highest level of digital security for our customers. This feature is a significant step forward in combating fraud.” If a recipient needs to view the sender’s full information, they can forward the transaction SMS to Safaricom’s short code 334 for verification. Such requests must be submitted within 24 hours of receiving the funds and require the explicit consent of the sender. This update aims to crack down on a common fraud tactic where scammers collect phone numbers from payment confirmation messages, then contact users by impersonating customer service representatives or people who made erroneous transfers to carry out social engineering attacks.
Safaricom noted that its data minimisation journey began with Pochi la Biashara in 2020 and has advanced year by year since then: it strengthened internal employee access controls for customer information in 2021, rolled out number masking for M-PESA statements in 2022, and implemented data minimisation at the API level in 2024. For the A2P SMS ecosystem, the masking of phone numbers in M-PESA transaction SMS means that customer identity verification based on M-PESA transaction confirmation messages will be restricted, and A2P service providers that rely on such SMS for customer authentication will need to adjust their business processes.
