Next Wave: The end of the phone numbers in M-PESA as we know it

Cet article est aussi disponible en français

For nearly two decades, the M-PESA transaction chime has come with a quiet trade-off on your privacy. Every time you send money or pay a bill, you hand over your full name and a direct line into your digital life.

By late 2026, Safaricom plans to end this era of radical transparency. In a phased rollout starting with peer-to-peer (P2P) transfers next week and expanding to merchant payments and bank transfers by next year, your phone number will not be visible.

If you are a privacy advocate, this is a long-overdue victory. If you are a small business owner who reconciles books via SMS, it’s a logistical nightmare. But if you look closely at the mechanics, you’ll see this is a fundamental, long-overdue change to the Kenyan financial trust model.

The change is technically simple but socially transformative. Once the money hits the recipient’s wallet, the notification will no longer display the full 10-digit number. Instead, they will see a redacted version, something like 0722000***.

The sender’s two names remain visible (if you have three names, it will just display two names from March 24 onwards), providing a human anchor to the transaction, but the call to action (the phone number) is gone.

If a merchant or a recipient genuinely needs to call you, perhaps you left your umbrella at the counter, or you did not pay your entire bill, they can no longer just tap the number in their SMS inbox. They have to initiate a formal request for your identity via a new verification protocol (forwarding to 334), which prompts you on your phone. You then have to explicitly grant them permission to see your number.

Critics have been asking: If this is so good for safety, why wasn’t it done earlier? The answer is that M-PESA’s early success was built on the very transparency it is now dismantling. In a country where formal bank accounts were rare, the phone number was the only know-your-customer (KYC) tool available to the public. If you sent money to the wrong person, you could call them. If a shopkeeper doubted that you had paid, they could see that your number matched the one on your SIM. The system’s friction was reduced by this mutual visibility.

But the world has changed and Safaricom is no longer just a telco but a systemic financial institution. With the Data Protection Act of 2019 and the subsequent 2024 amendments, the legal risk of leaking 40 million people’s numbers every single day became an existential threat.

The Office of the Data Protection Commissioner (ODPC) has become increasingly aggressive, and Safaricom, which holds more personal data than perhaps any other entity in the region, realised that being a leaky bucket was no longer a viable business strategy.

The primary target here isn’t the annoying marketing SMS from businesses (though that will drop) but the professional fraudster.

Kenya has long dealt with a specific kind of social engineering. Scammers pull phone numbers from transaction alerts, then sound convincing when they call. They pose as legitimate actors to trick you into reversing fake transactions or giving up your PIN.

Safaricom is effectively stopping these scams by masking the phone number. A fraudster can see that “Person X” paid KES 1,000, but without the phone number, they cannot reach him.

While the security benefits are clear, the contrarian view reveals a significant looming hurdle: financial reconciliation.

Next Wave continues after this ad.

Techstars Startup Week FCT 2026 will run from March 30 to April 3 in Abuja, Nigeria, bringing together founders, developers, investors and creatives for five days of workshops, panels, pitch sessions and mentorship. The event forms part of the global Techstars Startup Week network and spotlights Abuja’s growing startup scene.

Visit here for more details

For millions of Kenyan SMEs, the M-PESA SMS is the accounting system. Schools use the phone number to match fees to students; landlords use it to match rent to tenants; water companies use it to credit accounts.

When those numbers go dark, the manual way of doing business in Kenya breaks.

1. The big guys are fine: Large companies (like Kenya Power or Safaricom itself) use APIs that already mask data, or use account numbers (Paybills) for reconciliation.

2. The small guys are in trouble: small businesses that use services like Pochi La Biashara (a service that allows small business owners like kiosks, vendors or boda-boda, to separate business funds from personal money on one SIM card) will now have to find new ways to verify who paid them.

Safaricom is essentially forcing the entire economy to move from checking their messages to using formal merchant tools like the M-PESA Business App. It is a subtle push toward digital formalisation.

One key aspect of this update is the dispute-resolution mechanism. If a transaction goes wrong, the recipient has a 24-hour window to request the sender’s details.

This introduces controlled friction; in the soon-to-be-old days, a dispute was resolved over a phone call. In the new world, it will not be so easy. This protects the sender from harassment, but it could slow down the resolution of genuine errors. If you accidentally send KES 1,000 to a stranger and they simply ignore the consent request to show their number, the path to recovery becomes much more bureaucratic, involving formal police reports and Safaricom’s internal reversal desk.

“The main risk will be dispute management. The process will require an additional step, which could introduce some friction. We are working to address that by ensuring access to information where all parties are able to consent,” Safaricom’s chief financial services officer, Esther Waititu, told journalists in Nairobi on Wednesday.

“If you think about security and safety, there is always some level of inconvenience. People have built habits around how they interact with each other, but it is more important to keep everyone safe,” Peter Ndegwa, Safaricom CEO, added.

Safaricom’s move to mask numbers is an admission that M-PESA has outgrown its ‘village’ roots. It is moving from a system based on social trust (I know your number, therefore I trust you) to systemic trust (the system says it’s paid, and that’s enough).

It won’t stop all spam; scammers already have massive databases of numbers from previous leaks. It won’t stop all fraud; criminals are nothing if not adaptive. But it does raise the cost of entry for the average criminal.

By late 2026, when this rollout is complete across banks and merchants, the Kenyan digital economy will look very different. It’s a privacy tax that Kenya is finally ready to pay.

Kenn Abuya

Senior Reporter, TechCabal

Thank you for reading this far. Feel free to email kenn[at]bigcabal.com, with your thoughts about this edition of NextWave. Or just click reply to share your thoughts and feedback.

As always feel free to email a reply or response to this essay. I enjoy reading those emails a lot.

TC Daily newsletter is out daily (Mon – Fri) brief of all the technology and business stories you need to know. Get it in your inbox each weekday at 7 AM (WAT).

Follow TechCabal on Twitter, Instagram, Facebook, and LinkedIn to stay engaged in our real-time conversations on tech and innovation in Africa.