CBK Approves Phone Number Masking in Lipa na M-Pesa Transactions

The Central Bank of Kenya (CBK) has approved Safaricom’s request to mask customers’ full names and phone numbers in Lipa na M-Pesa transactions, marking a significant shift in how personal data is handled on Kenya’s most widely used mobile money platform.

The change applies to payments made through Lipa na M-Pesa Till numbers and PayBill accounts.

Previously, when a customer completed a transaction, the merchant received a confirmation message displaying the customer’s full registered name and complete mobile phone number.

Under the new framework, merchants will now only see the payer’s first name and a partially masked phone number, such as 07XX XXX 123.

The move is aimed at strengthening data privacy and limiting the exposure of personally identifiable information during routine transactions.

Safaricom, which operates the M-Pesa platform, sought regulatory approval from the CBK before implementing the update.

With the regulator’s formal clearance, the masking feature is now set to be rolled out across the system.

The decision comes amid growing scrutiny over how companies handle personal data under Kenya’s Data Protection Act, 2019.

The Office of the Data Protection Commissioner (ODPC) has, in recent years, increased enforcement efforts, investigating complaints and issuing penalties to organisations found to be mishandling personal information.

For years, privacy advocates have raised concerns that the automatic sharing of full names and phone numbers during Lipa na M-Pesa transactions exposed customers to risks, including unsolicited marketing messages, spam, and potential fraud.

Because merchants could view complete contact details, some customers reported receiving promotional SMS messages after making payments, even where they had not consented to marketing communication.

Under the revised system, merchants will still be able to confirm receipt of payment using partial identifying details, but without access to the full phone number.

The change effectively removes the need for customers to show merchants their SMS confirmation messages as proof of payment, a practice that often exposes additional personal details on the user’s device.

The update is also expected to align M-Pesa operations more closely with principles of data minimisation, a core requirement under Kenya’s data protection framework, which requires that only necessary information be collected and shared for a specific purpose.

While the masking applies to customer-facing transaction confirmations, questions remain within Kenya’s developer and fintech community regarding backend integrations.

Safaricom’s Daraja API, which powers many Lipa na M-Pesa integrations for businesses and third-party applications, currently returns transaction details that may include customer mobile numbers and KYC (Know Your Customer) names in callback responses.

It remains to be clarified whether these details will also be masked at the API level or restricted only to customer and merchant-facing notifications.

If the backend systems continue to transmit full details to integrated platforms, developers may need to adjust their data handling processes to comply with evolving privacy expectations.

Kenya has one of the highest mobile money penetration rates in the world, with millions of daily transactions processed through M-Pesa.

As digital payments become increasingly embedded in everyday commerce, from small retail purchases to utility payments and school fees, the protection of personal data has become a central policy issue.

The CBK’s approval signals a regulatory endorsement of stronger privacy safeguards within financial technology systems. It also reflects broader efforts by authorities to balance innovation in digital finance with consumer protection and cybersecurity.

Safaricom has previously introduced limited masking features in select products, but the latest move institutionalises the protection across core Lipa na M-Pesa services.

For consumers, the change means greater control over personal information during everyday transactions.

For merchants and developers, it signals a shift toward stricter data governance standards in Kenya’s digital payments ecosystem.

The rollout of the masking feature is expected to take effect in the coming weeks, with Safaricom updating its systems to reflect the new privacy framework across Till, PayBill and potentially peer-to-peer transactions.

Read Also: Phone Number Masking Set to Transform M-Pesa Security Standards – Business News