M-PESA masked phone numbers: 5 merchant mistakes to avoid

For Kenyan merchants, the phone number in an M-PESA payment SMS has been the default lookup key: find the customer, match the order, settle the dispute. According to TechCabal, Safaricom will remove the full number from merchant confirmations for Buy Goods and Paybill by the end of 2026, and will work with banks to mask it in bank and cross-wallet transfers too. Payments and confirmations stay the same. Only the number goes.

Safaricom's reason: numbers from alerts were being reused for spam, marketing and fraud. Chief Financial Services Officer Esther Waititu named the main risk herself: dispute handling gets an extra step.

Here are the five mistakes we think will cost merchants most.

Mistake 1: matching payments by phone number

The typical small-shop or online flow: the customer pays to a Till or Paybill, someone sees the SMS with number and amount, and marks the order paid. Once the number is partly hidden, two KSh 1,000 payments a minute apart become guesswork.

Fix: make the M-PESA transaction code and the Paybill account number your primary keys. If customers enter their order ID as the account number, reconciliation no longer depends on the phone at all. On a Till, which has no account field, ask the customer to submit the transaction code on the order page or in chat.

Mistake 2: assuming your API integration is unaffected

TechCabal reports that Safaricom already added similar controls to merchant-facing APIs in 2023 and 2024. If your integration is older and expects a full number in the callback, check what actually arrives today. The worst case is a CRM that uses the phone number as its primary key: masked numbers start merging different customers into one record.

Mistake 3: running support on "give us your number and we'll find it"

This hits betting, gaming and subscriptions hardest. A player writes "I paid but my balance didn't update" and the agent can no longer search by the number in the SMS. We would rewrite the support script now: ask for the transaction code, amount and time first, and treat the number as a secondary hint. Say on the checkout page that the SMS code will be needed for any query.

Mistake 4: missing the end of the Pochi la Biashara promo on 31 October

The Standard reports that from 1 August to 31 October 2026 Safaricom waived charges on Pochi la Biashara payments up to KSh 200. Larger payments carry tiered fees, which the paper does not list and refers readers to Safaricom's site for. If you take small payments on Pochi, check the tariff for your typical amount from November. It is also a good moment to consider a Till or Paybill, which give you a proper statement and less manual matching.

Mistake 5: not recalculating Buy Goods costs after August

In August Safaricom raised the free threshold for Lipa na M-Pesa Buy Goods from KSh 200 to KSh 500. Above that, the fee is 0.55%, capped at KSh 200 per transaction (The Standard).

Worked example. Say an online store takes 3,000 payments a month at an average of KSh 1,200. That is KSh 6.6 per payment, roughly KSh 19,800 a month. The KSh 200 cap kicks in at about KSh 36,400, so a KSh 50,000 payment costs the same as a KSh 36,400 one. For high-ticket merchants the effective rate is well below 0.55%. Run your own numbers in the fee calculator.

A one-week checklist for masked numbers

• Switch reconciliation to transaction codes and Paybill account numbers.
• Check which fields your callbacks actually return.
• Stop using the phone as the only customer ID in your CRM.
• Update support scripts and checkout copy.
• Recheck Pochi la Biashara tariffs from 1 November.

Masking alone should not hurt conversion, since customers pay exactly as before. The cost lands on the merchant side, in manual lookups and disputes you can't close. If you collect in Kenya through a provider, ask how it will pass payer data after the change. More on local methods on our Kenya payments page, and for sportsbooks see betting. Need M-PESA collection with clean reconciliation? Send us a request.

This article was prepared by the PayFlow editorial team with the help of AI, based on the public sources listed above. It is for information only and is not legal or financial advice; provider terms change — check current terms with an operator.