Kenya’s mobile money boom has reshaped the financial system, but rising cybercrime now poses a growing threat. The Central Bank of Kenya’s (CBK) Financial Sector Stability Report 2024 shows that Kenyan banks suffered Sh1.6 billion in direct losses to hackers in 2024, up from Sh412 million in 2023. The total amount exposed to fraud, funds targeted before recovery, climbed nearly threefold to Sh1.96 billion, with reported cases doubling to 353 from 173.
Mobile banking absorbed the heaviest hit at Sh810 million in losses, making smartphones the prime target. CBK noted that while mobile money has democratized access to finance, its rapid uptake has turned personal devices into the frontline of cybercrime.
Between January and September 2024, mobile money platforms processed Sh6.5 trillion, a 13.2% increase compared to the previous year. Kenya now has 71.4 million mobile subscriptions and smartphone penetration of 68.3%, factors that have accelerated adoption of app-based and USSD financial services.
Methods of Fraud
Cyber fraud cases in banking in Kenya are growing in scale and sophistication. SIM swap fraud, where criminals hijack a user’s phone number to bypass two-factor authentication, remains a dominant method. In one case, fraudsters illegally registered 123,000 SIM cards using stolen identities, siphoning off Sh500 million, largely through Safaricom’s Fuliza overdraft service.
Phishing campaigns using SMS and email disguised as bank messages continue to trick users into giving up PINs and OTPs. Malware embedded in fake apps compromises mobile devices, while social engineering scams, with criminals posing as bank officials, exploit customer trust.
INTERPOL’s Operation Serengeti in 2024 linked Kenyan hackers to a Sh1.1 billion fraud scheme. The group used fraudulent scripts to alter banking protocols and launder funds through SWIFT transfers to accounts in the UAE, Nigeria, and China.
International Ranking and Exposure
Globally, Kenya ranks second in sub-Saharan Africa for mobile fraud exposure, behind Tanzania. Scams now account for 23% of digital banking crimes in the region. Nearly half of Kenyan phone owners (49%) reported receiving fraudulent messages in 2024.
A World Bank survey indicated that 80% of Kenyans were targeted by fraud in the second quarter of 2024, with only 8% filing official complaints. CBK said this underreporting skews the actual scale of losses. Banks often reimburse victims quietly to maintain confidence, but the true cost of fraud is likely higher.
Financial and Human Impact
The year’s fraud cases extended across institutions. Equity Bank lost $2.1 million (Sh270 million) to debit card fraud in April 2024, resulting in 19 arrests. In Mombasa, police dismantled a Sh1.8 million procurement scam that relied on falsified M-Pesa payment confirmations.
For users, the consequences include emptied savings, identity theft, and reduced trust in digital banking services. Fraud syndicates increasingly exploit economic hardship, recruiting individuals as “money mules” to launder stolen funds. CBK reported a 94% surge in detected laundering accounts in 2024.
Why Losses Are Rising
Weaknesses in verification and gaps in digital literacy are key drivers. Remote onboarding often bypasses physical identity checks, allowing stolen identities to be used to create new accounts. Daily SIM swaps across Kenyan telcos, create repeated entry points for account takeovers.
In sub-Saharan Africa, 31% of users struggle with mobile money platforms, creating openings for social engineering attacks. Kenya’s reputation as a digital finance hub, often referred to as the “Silicon Savannah”, has also made it an attractive target for international syndicates, particularly those operating from Nigeria.
Lessons and Safeguards
The rise to Sh1.6 billion in fraud losses in Kenya demonstrates the need for stronger defenses across the financial ecosystem. For consumers, safeguards include never sharing PINs or OTPs, enabling biometric authentication, monitoring account activity, and avoiding downloads or links from unverified sources. Analysts warn that phishing via QR codes, known as “quishing,” is an emerging risk.
Banks are being urged to allocate more resources to cybersecurity. Current spending levels, typically 5–10% of IT budgets, are considered inadequate. Advanced monitoring systems, AI-driven fraud detection, and behavioral biometrics are being recommended to flag anomalies such as unusual login locations or transaction patterns.
Regulatory and Industry Response
The government has tightened compliance requirements. The Business Laws (Amendment) Act 2024 raised penalties for banks that fail to meet cyber safeguards to Sh20 million. It also increased core capital requirements to Sh3 billion by 2025 and Sh10 billion by 2029, aimed at strengthening institutional resilience.
Enhanced Know-Your-Customer (KYC) procedures, including biometric verification, are being deployed to counter SIM swap fraud. Kenya’s National Cybersecurity Strategy (2022–2027) prioritizes cooperation between regulators, banks, telcos, and international agencies.
Telcos such as Safaricom face mounting lawsuits over SIM swap-related losses, forcing reviews of their authentication procedures. Still, experts warn that gaps in enforcement and a shortage of skilled cybersecurity professionals continue to hinder progress.
Jefferson Wachira is a writer at Africa Digest News, specializing in banking and finance trends, and their impact on African economies.