What changed in your M-PESA messages
- Names: the message shows two of the sender's names instead of all three.
- Phone number: some digits are replaced with asterisks. Reports from launch show slightly different patterns, so do not rely on the visible digits to identify someone.
- Everything else stays: the amount, the transaction code, the time and your new balance appear as before.
Safaricom's 2026 Sustainable Business Report says person-to-person masking was 100% implemented in March 2026. The company's CEO gave the launch date as 24 March 2026, after approval from the Central Bank of Kenya.
Why Safaricom did it
Fraudsters used full names and numbers from payment messages to call people while posing as customer care, an agent or someone who “sent money by mistake”. Safaricom's report names social engineering as the leading threat to its customers in FY26, with in-person tricks the biggest single contributor. It reports an 82% fall in fraud incidents against a 90% target, and says 46% of reported fraud losses were recovered.
Masking is the latest step in a longer process. Safaricom says Pochi la Biashara merchants were shown less customer data from 2020, numbers on M-PESA statements were masked from 2022, and business partners using its APIs have received only the data a service needs since 2024.
How to find out who sent you money
- Find the M-PESA message for that payment.
- Forward it, unchanged, to 334 within 24 hours of receiving it.
- Follow the reply from Safaricom. Launch reports describe the reply differently, so read it rather than assuming what it will say.
What tills and paybills see
Merchants see less too. Safaricom's report says that by March 2026, 94% of customer names and mobile numbers were masked from Lipa na M-PESA merchants, with work continuing towards full masking. If you run a shop, match payments by the M-PESA transaction code and the time, not by the customer's phone number. Our reconciliation guide and customer disputes guide cover the details.
Sources
- Safaricom PLC, 2026 Sustainable Business Report (published 27 October 2026), pages 31 to 32: data minimisation, merchant masking and fraud figures.
- The Star, 18 March 2026: Safaricom CEO Peter Ndegwa on the launch date and 24-hour window
- TechCabal, 16 March 2026: what the masked message contains, as described by Safaricom