By 
M-PESA Data Minimization Upgrade Deepens Customer Privacy
As digital payments continue to scale across Kenya, privacy is fast becoming as critical as convenience. In a decisive move to strengthen customer protection, Safaricom PLC has rolled out a new data minimization feature for M-PESA person-to-person (P2P) transactions, marking a significant evolution in how personal information is handled on the platform.
The upgrade, which went live on March 24, 2026, reflects a broader industry shift toward embedding privacy directly into financial services, without disrupting the seamless experience users have come to expect.
Less Data, More Protection
At the core of the update is a simple but impactful change: reducing the amount of personal information visible during transactions.
Under the new system, M-PESA users will no longer see full phone numbers in transaction notifications. Instead, numbers will appear partially masked for example, 0722*000—limiting the exposure of sensitive data. Additionally, customer names have been reduced from three names to two, striking a balance between privacy and identification.
Crucially, transaction details such as amount, date, and transaction ID remain fully visible, ensuring transparency is not compromised.
This shift aligns with global data protection principles that advocate for sharing only the minimum necessary information in any transaction.
Tackling Fraud and Unwanted Contact
The implications of this move extend beyond privacy into fraud prevention.
By masking phone numbers, Safaricom is effectively cutting off a common entry point for scammers who harvest contact details from transaction messages. This reduces risks associated with social engineering, spam calls, and unsolicited marketing messages—issues that have grown alongside mobile money adoption.
With over 14.1 million daily P2P users and 37 million daily transactions, even small vulnerabilities can scale rapidly. Minimizing exposed data significantly lowers that risk.
M-PESA Data Minimization Upgrade Deepens Customer Privacy
Introducing User-Controlled Verification
To ensure trust and accountability are maintained, Safaricom has introduced a recipient verification feature via code 334.
This allows users to request the sender’s full details if needed. The process is user-driven:
- A recipient can forward the transaction message to 334
- The sender receives a prompt requesting consent to share their full name and phone number
- The sender can either approve or decline the request
This opt-in approach places control firmly in the hands of users, reinforcing consent as a central pillar of digital transactions.
A Strategic Evolution of M-PESA
The P2P update is not an isolated initiative. It builds on Safaricom’s ongoing journey toward data minimization across its ecosystem.
From earlier efforts such as minimizing data visibility for internal staff, to updates in M-PESA statements and API integrations for businesses, the company has been progressively tightening how customer information is accessed and shared.
The latest rollout extends these protections to everyday users arguably the most critical layer of the mobile money ecosystem.
Building Trust in a Digital Economy
As Kenya’s digital economy expands, trust remains its most valuable currency. Safaricom’s move signals a recognition that safeguarding user data is not just a regulatory requirement, but a competitive advantage.
By embedding privacy into the design of M-PESA transactions, the telco is not only protecting its customers but also reinforcing confidence in mobile money as a secure and reliable financial tool.
In an environment where convenience often comes at the cost of privacy, this update proves that the two do not have to be mutually exclusive.
Comments