Kenya's M-PESA Hides Phone Numbers to Stop Spam and Fraud

Millions of Kenyans will soon shop and send money without worrying their phone numbers will end up in the wrong hands.

Safaricom, the company behind M-PESA, announced this week it will mask customer phone numbers in all merchant payments and bank transfers by late 2026. The change protects people using Kenya's massive mobile money network, which processes 138 million transactions worth $914 million every single day.

The problem M-PESA is solving affects nearly everyone in Kenya. When you pay a merchant or transfer money to a bank, your full phone number shows up in their confirmation message. Those numbers often get reused for spam texts, unwanted marketing, or worse, fraud schemes.

Starting March 24, M-PESA will partially hide phone numbers in person-to-person payments between friends and family. Later this year, the same protection extends to the Buy Goods and Paybill services that Kenyans use for everything from grocery shopping to paying bills.

Merchants will still get payment confirmations and can track their sales. They just won't see complete phone numbers anymore, cutting off a pipeline that feeds Kenya's spam problem at its source.

The protection also covers money moving between M-PESA, banks, and competitors like Airtel Money. Every platform that touches a transaction creates another chance for data to leak, so applying the same rules everywhere makes the whole system safer.

The Ripple Effect

M-PESA didn't arrive at this solution overnight. The company has been building toward comprehensive privacy protection since 2020, when it launched Pochi La Biashara to help small traders accept payments without exposing customer details.

Each year brought another layer of protection. In 2021, Safaricom limited which employees could access customer data. The following year, it cleaned up personal information in M-PESA statements. By 2023 and 2024, big companies using M-PESA's technology got the same privacy tools.

Now the protection reaches individual merchants and everyday transactions, closing one of the last major gaps. For a service handling 37 million peer-to-peer transfers worth $209 million daily, that's meaningful protection at scale.

The change does create challenges. Some businesses use phone numbers to track payments or contact customers about orders. Safaricom CEO Peter Ndegwa acknowledges the tradeoff but stands firm on priorities.

"If you think about security and safety, there is always some level of inconvenience," Ndegwa said. "It is more important to keep everyone safe."

Businesses will need to rely more on transaction codes and their own systems to match payments with orders. Safaricom is working on tools to help resolve disputes when merchants and customers disagree about transactions, ensuring both sides can access needed information with proper consent.

The shift sets a new standard for how payment companies across Africa handle personal data, proving privacy and convenience can work together.