Kenya Tightens Mobile Money Privacy as CBK Approves M-Pesa Masking

The Central Bank of Kenya (CBK) has approved Safaricom’s plan to mask phone numbers in M-Pesa transactions, a move designed to enhance privacy and align mobile money services with Kenya’s Data Protection Act 2019.

The initiative will cover peer-to-peer transfers, PayBill, and Till payments, with the rollout expected in February 2026.

Under the new system, customers’ full phone numbers will no longer be displayed in merchant transactions.

Merchants will receive payment confirmations showing only a masked number, such as 0722XXXXXX.

According to Safaricom, “The payment process remains unchanged; only the visibility of personal phone numbers is limited to protect user privacy. Recipients may request full details, but only with the sender’s consent.”

Alignment with Data Protection Standards

This update aligns M-Pesa with Kenya’s Data Protection Act 2019, which requires that personal data collected during any transaction be strictly limited to what is necessary.

Also Read: CBK Reveals Banks Offering Cheap Loans to Kenyans in 2026 [FULL LIST]

Sharing a customer’s phone number every time they buy groceries or pay a utility bill has long been considered excessive under that standard.

A CBK spokesperson stated, “The focus will be on enhancing safeguards on how payment data is collected, stored, and shared.”

“The overall objective is to ensure payments data is used safely and securely to enhance user privacy and reduce fraud.”

Impact on Businesses and Users

For businesses, the adjustment is mostly procedural.

Merchants will no longer ask customers to “show the confirmation message” to verify payments.

Instead, they are expected to confirm transactions via M-Pesa business apps, USSD codes such as *334#, or integrated point-of-sale systems.

“For small traders, this is an unexpected bonus. Many have been unknowingly collecting customer data, including names and phone numbers, without realising the legal implications under the Data Protection Act.”

“Masking removes that risk quietly, in the background,” said a representative from the Office of the Data Protection Commissioner.

For users, the change should be seamless. Payments will continue to work as before, but personal data will remain protected.

Also Read: Safaricom Expands Its Popular Data Bundle

Addressing Data Misuse Concerns

The CBK’s move comes amid growing scrutiny over digital data privacy.

In 2024, over 5,000 complaints were recorded regarding data misuse, with a third linked to financial institutions.

Masking phone numbers at the source is expected to significantly reduce such complaints.

Safaricom has previously implemented similar privacy measures in its Pochi la Biashara service, and the CBK’s approval now extends the protection across the wider M-Pesa ecosystem.

Follow our WhatsApp channel for instant news updates