Kenya

Mobile money reaches 23.2 million adults and banks reach 14.8 million, on the 2024 FinAccess household survey. The gap in mobile money use between women and men narrowed to 1.8 percent, from 5.2 percent in 2021. Internal fraud was the leading label where money was lost in a savings cooperative (75.1 percent) or a pension scheme (66.1 percent). Accidental sending was the prevalent way mobile money was lost, at 70 percent.

In the quarter to December 2025 the incident team said users were reached by calls, texts and messages impersonating an institution, an employer, a delivery service or a government agency, with urgency around travel, promotions and bonuses. Phishing messages copied a real brand or a payment platform to harvest a mobile banking login.

An email or a text that looks as if it comes from the bank asks for a PIN or a password, and card skimmers copy the magnetic strip. The Authority's Kiswahili guide calls identity theft wizi wa utambulisho. The usual method is kuvua: a baruapepe, an email, that is laghai and asks for a name, a PIN, a national identity number or a card number. The same guide names a work-from-home fee, a foreign lottery, a forged cheque, an advance-fee loan and an investment promising a high return with no risk. SIM swaps were still among complaints in July to September 2026, some of them used to reach a financial account.

On the central bank's 2025 count the money moves on six routes. Mobile banking was 136 cases and KSh 634 million, and online banking 132 cases and KSh 157 million, together 268 of the 385 cases. Card fraud was 16 cases and KSh 645 million, about KSh 40.3 million a case. Identity theft was 63 cases and KSh 168 million. Internet scams rose from 9 cases to 22, with KSh 87 million lost. Computer fraud was 16 cases and KSh 212 million.

Once the recipient's firm has the instruction, the payer cannot revoke a retail transfer. That is the 2013 regulation. The payer's firm must carry the instruction out correctly, and its liability ends when it proves it sent the transfer on. If it is liable for a failed transfer, it restores the account, including the charges. Firms file incidents of fraud, theft and robbery with the central bank within ten days of each month end. The Bank has linked its data warehouse to those systems.

From 30 May 2025 only the operator or its agent may register a line, and the documents are checked against a government database. Registering without that check, or without authority to register subscribers, is an offence. A proxy may not register a line, except a parent or guardian for a child. Knowingly giving false information is an offence, and the operator deactivates that line. The Authority investigates a false-registration complaint within 30 days. The penalty is a fine of up to KSh 1 million or up to six months in prison, or both.

The 385 banking cases of 2025 exposed KSh 2.03 billion and lost KSh 1.90 billion, about KSh 4.95 million a case, up from KSh 1.59 billion lost on 353 cases in 2024. The stability report says the recovery rate of funds is low. The banking fraud unit starts recovery so stolen funds can be restored to the owners. After a conviction the court may order compensation and restitution of an asset gained from the offence.

The 2013 retail transfers regulation makes the payment firm liable for a transaction performed without the client's knowledge. The contract can set that liability aside where the firm proves fault on the client's side, or shows that the real client gave the instruction. Where the firm is liable because it failed to carry a transfer out correctly, it restores the debited account, including the charges.

A refund starts as a complaint to the firm. A bank acknowledges it within 48 hours and undertakes to resolve it within 7 days, and gives a timeline if that will take more than seven business days. A customer who is not satisfied may take the bank's response to the central bank, which hears both sides. A case already in court stays with the court. A complaint to a payment firm is lodged within 15 days and resolved within 60 days, free of charge except where records more than three months old have to be retrieved. A March 2026 draft, prepared with the other financial regulators, would require a firm to help reverse a payment the customer says was a mistake.

US$1.6m (KES 202.4m) of it was returned to victims, 3.1% of the money lost.

The central bank recorded 385 banking-sector fraud cases in 2025, up from 353 in 2024. The police recorded 4,350 economic crimes in the same year, down from 4,610. Payment firms file fraud incidents with the central bank each month. A national coordination committee receives reports of computer and cybercrime. It includes the central bank, the telecoms regulator, the police and the prosecutors.

A banking complaint is lodged with the bank, which acknowledges it within 48 hours, and can then move to the central bank. The central bank's fraud page names the bank and the police as the two places a report of shared banking details goes. Banks, other financial institutions and government bodies also send fraud complaints to the banking fraud unit, which takes identity theft, card fraud and unauthorised access against institutions the central bank regulates.

A phone or internet complaint is lodged with the provider and, if unresolved, moves to the Communications Authority. In July to September 2026 the Authority received 479 escalated complaints and resolved 422: 45 of 47 fraud and scam complaints, 56 of 57 on digital finance and mobile money, and 47 of 49 on cybercrime. The Kiswahili guide names the police for identity theft, wizi wa utambulisho. The incident team separately counted over 2.6 billion threat events that quarter, up 14.45 percent. The economic survey records 12.5 billion online crime incidents in 2025, up from 3.6 billion, beside the 385 banking cases.

The figure on this page is 385 banking-sector fraud cases recorded by the Central Bank of Kenya in 2025, with KSh 1.90 billion lost. The rows are computer fraud 16, internet scam 22, mobile banking fraud 136, online banking fraud 132, card fraud 16 and identity theft 63, up from 353 cases and KSh 1.59 billion in 2024. The police recorded 4,350 economic crimes beside that series, down from 4,610. Economic crimes are obtaining by false pretence, currency forgery and other fraud.

A dishonest gain or loss through a computer system is an offence under the Computer Misuse and Cybercrimes Act, 2018. The penalty is a fine of up to KSh 20 million or up to ten years in prison, or both. Using another person's password or other unique identifier is identity theft, with a fine of up to KSh 200,000 or up to three years, or both. On conviction the court may order compensation, recoverable as a civil debt.

The banking fraud unit of the Directorate of Criminal Investigations takes complaints from banks, other financial institutions and government bodies. It investigates those cases, helps prosecute, and starts recovery of stolen funds for the owners. The national coordination committee also receives cybercrime reports. The interior principal secretary chairs it, with the head of the police and the director of public prosecutions among the members. A detection count of 12.5 billion online crime incidents in 2025, up from 3.6 billion, is mostly system weaknesses and is kept beside the 385.

Mobile banking fraud is the common case: 136 of 385 cases in 2025, about a third of the cases and of the money, at KSh 634 million. Online banking fraud is close behind, 132 cases and KSh 157 million, up from 106 cases. Together the two rows are 268 cases. Card fraud is the common large loss: 16 cases and KSh 645 million, about KSh 40.3 million a case. Identity theft was 63 cases and KSh 168 million, up from 56. Internet scams rose from 9 cases to 22, with KSh 87 million lost.

A message that looks as if it comes from the bank asks for a PIN or a password. Card skimmers copy the magnetic strip. In the quarter to December 2025, calls, texts and messages impersonated an institution, an employer, a delivery firm or a government office, with urgency around travel, promotions and bonuses. Phishing pages aimed at mobile banking logins, some using a QR code or a shortened link. Complaints escalated in July to September 2026 named phishing, impersonation, fake promotions, fraudulent mobile money, marketplace scams and SIM swaps.

The Authority's Kiswahili guide calls the email script kuvua and the theft wizi wa utambulisho: a laghai email asks for a PIN, a national identity number or a card number. It also names a work-from-home fee, a foreign lottery, a forged cheque, an advance-fee loan and a high-return investment. A phone line can be registered only by the operator or its agent, against a government identity record, and a false registration is deactivated.

The interior principal secretary chairs the national coordination committee. Members include the central bank's governor, the telecoms regulator, the head of the police and the director of public prosecutions. The committee advises on mobile money. Payment firms file monthly fraud returns, and the central bank has linked its data warehouse to their systems. Since 30 May 2025 an operator checks identity documents against a government database and deactivates a line registered on false information. Banks send cases to the investigations directorate for recovery. Since 9 February 2024, finance has been treated as a critical sector.

Bank cases rose from 353 to 385 and losses from KSh 1.59 billion to KSh 1.90 billion, with KSh 2.03 billion exposed. The stability report says the recovery rate of funds is low. Police economic crimes fell from 4,610 to 4,350, and all crimes reported to the police fell 5.1 percent, to 96,038. The Authority resolved 422 of 479 escalated complaints in July to September 2026. Threat detections rose from 3.5 billion in 2023/24 to 8.6 billion in 2024/25.

Who pays is still the 2013 retail transfers regulation. The firm is liable for a transaction the client did not know about, unless it proves the client was at fault or sent the instruction. A transfer cannot be revoked once the recipient's firm has received it. A March 2026 draft, written with the other financial regulators, would require a firm to help reverse a payment the customer says was a mistake.