Digital Fraud: Inside Kenya’s growing cybercrime economy

NAIROBI, Kenya, Nov 2 — A phone number, a banking password or access to a mobile-money account may appear to be ordinary pieces of personal information, but in Kenya’s expanding digital economy, they can also become valuable assets in an increasingly organised world of cybercrime. As more Kenyans use digital platforms to transfer money, access banking services and conduct business, criminals are exploiting the same systems to steal information, compromise accounts and carry out fraudulent transactions. The scale of the problem is reflected in figures published by the Central Bank of Kenya (CBK), which show that reported banking fraud cases increased from 173 in 2023 to 353 in 2024, while the amount exposed to fraud rose from approximately Sh680.9 million to Sh1.96 billion. Actual losses increased from approximately Sh412.5 million to Sh1.59 billion over the same period, representing a rise of about 286.5 per cent. “The motivation of cyber criminals targeting financial institutions is financial gains,” the CBK observed in its Financial Sector Stability Report 2024. The figures offer a glimpse into the financial consequences of cyber-enabled crime, although banking fraud statistics alone do not capture the full scale of Kenya’s cybercrime economy. Behind the reported losses is a chain of activities that can begin with stolen credentials or a fraudulent message and end with money moving through accounts and mobile wallets, leaving victims and investigators trying to establish what happened and who was responsible. From stolen information to financial gain Cybercrime is often described through the methods criminals use to target victims, including phishing, social engineering, identity theft, SIM-swap fraud and unauthorised access to online accounts. However, understanding these methods alone does not explain the financial incentives driving the offences. For criminals, obtaining personal information or gaining access to an account is often only the beginning. The ultimate objective is to use that access to extract money or obtain something that can be converted into financial value. A compromised account may be used to initiate unauthorised transactions, while stolen credentials can potentially be reused, shared or sold to other criminals. Different participants may perform different roles, from obtaining information and compromising accounts to facilitating transactions or moving proceeds beyond the reach of the original victim. The Office of the Director of Public Prosecutions (ODPP) has pointed to the use of intermediaries in these operations. In a statement on a cybercrime and fintech-fraud workshop, Director of Public Prosecutions Renson Ingonga said criminals were exploiting digital financial platforms and “the use of distributed networks of money mules to move illicit funds through multiple mobile wallets.” The statement identifies a method investigators are being trained to address, although it does not quantify the local market for stolen credentials or establish the prices at which such information may be traded. The use of intermediaries can make it difficult to identify those behind a fraudulent transaction. A victim may interact with one person or receive a message from an apparently legitimate institution, while those who ultimately access the account, receive the proceeds or organise the operation remain unidentified. Following the financial trail The scale of losses reported by the CBK suggests that digital financial channels have become a significant area of exposure for banks and their customers. Mobile banking accounted for approximately Sh810.68 million in reported fraud losses in 2024, compared with Sh182.41 million in 2023. Losses attributed to card fraud increased to approximately Sh263.29 million from Sh15.60 million, while losses associated with identity theft rose to approximately Sh199.08 million from Sh32.62 million. These categories illustrate the different ways financial crime can exploit digital access, although they should not be treated as a complete breakdown of Kenya’s cybercrime economy. Once money has been obtained fraudulently, investigators must establish who controlled the receiving accounts, how the funds were subsequently transferred and whether the account holders knowingly participated in a crime. Where money passes through multiple accounts or financial services, investigators may need to reconstruct a sequence of transactions and establish the relationships between the people and accounts involved. The ODPP has identified the preservation of digital evidence and the freezing of suspected criminal proceeds as key parts of the response. At a joint ODPP-Safaricom capacity-building workshop, Ingonga called for “seamless, legally robust and privacy-compliant mechanisms for rapid incident response,” particularly where investigations require data-preservation orders and the freezing of illicit funds. He also urged investigators and prosecutors to strengthen their understanding of telecommunications records and chain-of-custody requirements. The statement does not provide national figures on the value of funds frozen or recovered in cybercrime cases, leaving the extent to which victims and financial institutions are able to recover stolen money unclear. SIM-swap fraud SIM-swap fraud illustrates how criminals may exploit weaknesses in the systems connecting a person’s identity to their digital accounts. In a SIM-swap scheme, a criminal seeks to transfer a victim’s telephone number to another SIM card, potentially gaining access to calls or messages used in account authentication and password recovery. If successful, such access may help the perpetrator target services linked to the number, although the consequences depend on the security measures used by the affected service providers. Security agencies have announced arrests in cases involving alleged mobile-money and banking fraud. In February 2025, seven suspects were arrested in connection with a scheme involving a victim who reportedly lost Sh250,000. In July 2026, authorities also announced the arrest of eight suspects linked to an alleged SIM-swap scheme in which more than Sh1.2 million was reportedly siphoned from an M-Pesa operator in Marsabit. The cases illustrate the importance of investigating not only the initial compromise but also the transactions that followed, the people who allegedly facilitated the activity and the destination of the money. The DCI’s February 2025 statement said the seven suspects had been taken to Kiamumbi Police Station pending arraignment, while its July 2026 statement said the eight Marsabit suspects were being held at Marsabit Police Station as investigations continued. There was no further statement on the status of the investigation or an indication on whether charges were subsequently filed, whether the cases proceeded to trial or whether any of the reported losses were recovered. The cases also raise questions about safeguards used to verify SIM replacement requests and the responsibilities of telecommunications providers when criminals allegedly exploit the process. The DCI has urged M-Pesa agents and members of the public not to hand over SIM cards, mobile phones or M-Pesa handsets to customers, warning: “Fraudsters often work in groups, creating distractions while executing their scheme.” The DCI advised agents to treat unusual requests or insistence by customers on handling their phones as warning signs. The wider threat to Kenya’s digital economy The financial figures are only one measure of the challenge facing Kenya’s digital infrastructure. The Communications Authority of Kenya’s National Kenya Computer Incident Response Team Coordination Centre (KE-CIRT/CC) detected 2.538 billion cyber threat events between January and March 2025, an increase of 201.85 per cent from the preceding quarter, according to its quarterly cybersecurity report. The agency attributed the rise partly to inadequate system patching, low user awareness of threats such as phishing and social engineering, and the increasing use of artificial intelligence and machine learning technologies in cyberattacks. Detected threat events should not, however, be confused with confirmed successful attacks or proven financial losses. A detected event does not necessarily mean a system was compromised or that money was stolen. The figures nevertheless underline the volume of activity cybersecurity teams must monitor as digital services expand. For banks, telecommunications providers, fintech companies and public institutions, the challenge is to protect digital services without undermining the accessibility and convenience that have made them central to everyday transactions. For users, the consequences can extend beyond the initial loss of money to include time spent reporting incidents, attempting to recover funds, restoring account access and proving that transactions were unauthorised. Investigating crime without clear physical boundaries Cybercrime investigations may require evidence from financial institutions, telecommunications companies, digital platforms and devices used by suspects or victims. Investigators must establish who accessed an account, which devices or telephone numbers were involved, where money was transferred and whether different transactions can be linked to the same alleged operation. Digital evidence must also be collected and preserved in a form that can support investigations and, where a case proceeds to court, be presented in accordance with applicable legal requirements. The Directorate of Criminal Investigations’ digital forensic capabilities form part of Kenya’s response to offences involving electronic evidence, while the National Computer and Cybercrimes Coordination Committee (NC4) coordinates national efforts on cybercrime and cybersecurity. Kenya’s Computer Misuse and Cybercrimes Act, 2018, provides a legal framework addressing specified computer-related offences. However, investigations and prosecutions must be supported by evidence that satisfies the applicable legal standards. The effectiveness of this framework cannot be measured by arrests alone. It also depends on whether investigators can identify those responsible, establish the movement of funds, secure admissible evidence, obtain successful prosecutions where warranted and support the recovery of criminal proceeds. A concluded Kenyan case illustrates how these challenges play out in practice. In Omundo v Republic (Criminal Appeal 94 of 2023), delivered on May 6, 2024, the High Court upheld the appellant’s convictions for identity theft and impersonation, unauthorised access and accessing a computer system with intent to commit an offence under the Computer Misuse and Cybercrimes Act. The case concerned withdrawals totalling Sh732,033 from Inua Jamii ATM accounts between July 2018 and May 2022, using electronic identification and fingerprints. The prosecution relied on witness testimony and bank records, among other evidence, and the court upheld the convictions. It, however, changed the sentences to run concurrently rather than consecutively because the offences arose from the same transaction. The ruling demonstrates the importance of linking digital identity evidence and financial records to the person accused, while illustrating that a conviction and the sentence imposed are separate judicial questions. In October 2026, Ingonga called for stronger collaboration and technical capacity among justice-sector agencies to respond to cybercrime and fintech-related offences. He said: “We must all take up measures to detect, disrupt, prohibit and appropriately respond to the adapting crime typologies by cybercriminals.” The ODPP said the DPP had also called for better understanding of telecommunications evidence, data preservation and chain-of-custody requirements. The challenge for investigators is therefore not simply to identify a fraudulent transaction, but to establish the chain of responsibility behind it and produce evidence that can withstand scrutiny. Who bears the cost? When fraud occurs, the immediate loss may be visible in a victim’s bank account or mobile-money wallet, but the wider costs are harder to quantify. Victims may lose savings, business capital or money intended for household expenses, while businesses and financial institutions must spend resources on prevention, investigations, customer support and dispute resolution. The extent to which these costs are ultimately borne by victims, financial institutions or other parties depends on the circumstances of each case, the applicable rules and the decisions made when a disputed transaction is investigated. Businesses also incur costs through investments in monitoring systems, authentication safeguards, staff training and incident response. The CBK’s banking-fraud figures provide a measure of losses reported by regulated banks, but they do not quantify the wider economic cost of cybercrime, including prevention spending, investigations, operational disruption or losses suffered by individuals outside the reporting categories. Securing the digital economy Kenya’s expanding digital economy has made it easier for people and businesses to transact, access services and participate in commerce. The same connectivity, however, creates opportunities for criminals to exploit weaknesses in accounts, systems and verification processes. The financial losses recorded by the CBK show why digital fraud requires a response that goes beyond warning users to protect their passwords or avoid suspicious messages. Financial institutions and telecommunications providers must explain how they prevent unauthorised access, respond to complaints and investigate suspicious transactions, while law enforcement agencies must demonstrate how they trace proceeds, build cases and pursue those responsible. Victims, meanwhile, need clear reporting channels and transparent information about the steps available to them after an account is compromised. Ultimately, the effectiveness of Kenya’s response should be judged not only by the volume of cyber threats detected or the number of suspects arrested, but also by whether fraudulent activity is disrupted, victims receive meaningful remedies, criminal proceeds are recovered where possible and offenders are successfully prosecuted on the evidence. Understanding how stolen information becomes money — and how that money is traced, recovered or lost — is essential to understanding the true scale of Kenya’s cybercrime economy.