Safaricom, Kenya’s largest telco, will begin masking phone numbers in M-PESA send-money notifications, limiting how much personal data appears in transaction alerts on Kenya’s largest mobile money platform.
The update, which will go live at the end of March 2026, affects the confirmation messages customers receive after sending or receiving money. Instead of displaying a full mobile number, the alert will now show a partially hidden version of the sender’s number.
The change targets a common fraud tactic where scammers collect phone numbers from payment confirmation messages and later contact users while posing as agents, customer care staff, or mistaken senders.
The approach relies on social engineering that is common in Kenya. 46% of consumers say they have been targeted by fraudulent calls, texts, or online messages, according to a 2025 TransUnion report.
What customers will see in M-PESA notifications
Safaricom told on Friday that under the update, the sender’s phone number will appear in a masked format.
A number such as 0722123000 will appear as 0722*000** in the transaction message.
The sender’s first and second names will still appear in the notification so recipients can identify who sent the money.
Other details in the message will remain unchanged. These include the amount sent, transaction code, time of the transaction, and account balance update.
How customers can verify a sender
Recipients who want to confirm the sender’s identity can still do so through Safaricom’s verification service.
Customers can forward the transaction message to 334, Safaricom’s shortcode that checks whether the payment details match the company’s system records.
The service returns a message confirming whether the transaction is valid.
Why Safaricom is masking phone numbers
The change limits how easily phone numbers can be copied from M-PESA alerts and reused.
Fraudsters often collect numbers from transaction messages and later use them to attempt scams or send unwanted messages.
Masking the digits reduces the amount of personal information shared in everyday transactions. It also aligns with data minimisation, a privacy principle that requires companies to display only the personal information necessary for a service to function.
M-PESA handles billions of shillings in transactions every day across Kenya, meaning even small changes to transaction alerts can affect how millions of customers interact with the service.
