Imagine waking up to discover that your phone number which is tied to your banking apps, your KRA portal, and your daily life has been quietly handed over to a total stranger. Even worse, any money you left in your mobile wallet has vanished into a corporate black hole Safaricom casually refers to as an “archive.”

This isn’t a hypothetical tech nightmare. It is the exact ordeal shared by a Kenyan named Khalila Salim in a viral LinkedIn post. After misplacing her SIM card, Khalila went for a routine SIM swap, only to be told bluntly by customer care that her line had already been sold. The terrifying part? Safaricom failed to notify her bank, meaning her private financial alerts were now delivered straight to the phone of the number’s new owner.

When confronted, Safaricom’s support team offered a standard corporate defense:

“If a line had any remaining balance at the time of deactivation, it is typically archived. The original owner can visit a Safaricom Shop to claim it...”

This response exposes a massive, multi-billion-shilling question that every M-Pesa user needs answered: What exactly is this “archive,” how long is it legally enforceable, and what happens to the massive fortunes left behind by users who abandon their lines or pass away?

When Safaricom states that funds are “archived,” they aren’t talking about a magical vault where your money sits forever. They are referring to an internal suspense account.

Typically, if a SIM card remains completely inactive for 120 days, Safaricom automatically deactivates it and recycles the number back into circulation. However, because your M-Pesa wallet is a financial account regulated by the Central Bank of Kenya (CBK), Safaricom cannot legally absorb your cash into its corporate profits.

Instead, they decouple the M-Pesa balance from the recycled physical SIM card and lock it into their internal archive. It’s likely that the regulatory blueprint governing this process comes from a combination of the Unclaimed Financial Assets Act and Safaricom’s operational implementation of mobile money compliance under the Central Bank of Kenya (CBK) guidelines.

How long is it enforceable?

If your line is sold to a new owner, your money remains in Safaricom’s internal archive for a strict statutory period of two years. This is the general industry standard. During this two-year window, you (the original owner) can walk into any Safaricom retail shop with your identity documents, pass the verification checks, and have those archived funds pushed to a new, active line. This is what Safaricom mentiioned in the exchange with Khalila. But what happens if those two years lapse? This is the dark corner of the system that catches families of deceased Kenyans off-guard. If a subscriber passes away and their family doesn’t know their M-Pesa PIN or if a Kenyan moves abroad and completely forgets an old line, the clock keeps ticking.

Once the two-year mark hits without any transaction or claim, Safaricom is legally mandated by the Unclaimed Financial Assets Act to surrender those idle funds. Every year, by November 1st, Safaricom bundles all mobile money balances dormant for over two years and remits them directly to the Unclaimed Financial Assets Authority (UFAA). Once the money is handed over to the authority, Safaricom washes its hands of it. You can no longer claim it at a Safaricom shop; you have to file a formal claim with the government authority.

What makes Khalila’s case explosive right now is a recent, massive legal shift. In March, the Kenyan High Court issued a landmark ruling explicitly banning the recycling of phone numbers. The court declared that in our modern fintech-driven economy, your phone number is no longer just a utility tool. It is officially your digital identity.

While Safaricom’s customer care reps are still reciting the old playbook relying on the 120-day deactivation guideline, the High Court just upended that entire framework. By allowing a recycled line to receive live bank alerts meant for a previous owner, Safaricom isn’t just committing a customer service blunder; they are staring down a severe breach of the Data Protection Act.

Safaricom captures our email addresses, alternative numbers, and next-of-kin data during the KYC (Know Your Customer) registration process. Yet, when a line is facing deactivation, they choose to send warnings exclusively to the very line that is actively offline or missing.

“Why not send a message? Even to the alternate line? Why not send a message to the bank?... It's the customer that sustains both parties through transaction fees and tax.”

Safaricom’s defense that they do not notify third parties like banks because customer data across institutions is managed independently feels like a lazy cop-out. In an era of advanced API integration and open banking, cutting off a phone number that acts as a financial gateway without cross-institutional communication is highly reckless.