A Kenyan bank lost Sh517 million ($4 million) after its IT systems were compromised by contractors who downgraded its card security configuration, enabling unauthorized wallet creation and subsequent laundering of the stolen funds through cryptocurrency.
According to a new report by the Financial Reporting Centre (FRC), the incident ranks among the rising cases of bank fraud in Kenya involving manipulation of card systems and digital wallets. While the FRC did not name the bank or the contractors involved, it confirmed that the breach was made possible by altering the bank’s card security system from a secure setup to a weaker 2D configuration, bypassing essential protocols such as One-Time Password (OTP) authentication.
This downgrade allowed the attackers to generate unauthorized digital wallets, which were used to funnel funds from customer accounts. The money was then converted into cryptocurrency, primarily USDT (Tether), and moved across decentralized platforms, complicating efforts by authorities to trace or recover the assets.
The use of cryptocurrency has seen a growing trend in financial cybercrime in Kenya, where digital currencies are increasingly being used to obscure the movement of stolen funds. Cryptocurrencies, particularly stablecoins like USDT, are favored by criminals due to their speed, borderless nature, and pseudo-anonymity.
- How Banks in Kenya Are Losing Millions to Insider Fraud Schemes
- Equity Bank Fires Staff Over Suspected Insider Fraud
- How Kenyans Are Having Their IDs Used in Tax Scams
Between 2021 and 2023, the FRC received over 14,000 suspicious transaction reports (STRs) involving more than Sh6.9 trillion. Of this, over Sh6.3 trillion, more than 90%, was routed through banks. The report also highlights common methods used by fraudsters, including splitting transactions to avoid reporting thresholds, using shell companies, and leveraging unregulated cryptocurrency platforms to launder money.
Kenya’s position as the largest cryptocurrency market in East Africa, combined with the rapid adoption of mobile banking and digital payments, has created a complex risk environment for both customers and regulators. In February 2024, Kenya was placed on the Financial Action Task Force (FATF) grey list due to gaps in its anti-money laundering and counter-terrorism financing frameworks. In response, the Central Bank of Kenya (CBK) conducted a sector-wide survey in December 2024 to evaluate compliance with preventive measures. Findings from that survey showed that digital lenders, in particular, lack the robust screening systems used by commercial banks.
The CBK has also issued cybersecurity guidance and pushed for tighter third-party vendor oversight. However, outsourcing IT services without stringent vetting continues to expose banks to internal and external threats.
Globally, fraud involving digital currencies is on the rise. A 2023 report by the FBI showed that cryptocurrency-related fraud losses totaled $5.6 billion, a 45% increase from the previous year. In Kenya, the FRC’s 2023 risk assessment on virtual asset service providers recommended regulatory action to reduce exposure to fraud, money laundering, and terrorism financing risks.
Despite these warnings, Kenya’s cryptocurrency market remains largely unregulated, leaving gaps that can be exploited by both local and international actors. Scams such as the Worldcoin iris scan controversy, which was suspended in 2023, illustrate how digital innovation, when poorly regulated, can open doors to financial abuse.
Jefferson Wachira is a writer at Africa Digest News, specializing in banking and finance trends, and their impact on African economies.