Fraudsters stole a record Sh1.9 billion from banks in Kenya last year, highlighting the growing financial pain of cybercrime as crooks exploit loopholes in electronic payment channels to make a killing.
Fresh disclosures by the Central Bank of Kenya (CBK) show the amount of money lost to fraudsters in 2025 was 19.4 percent higher than the previous year’s Sh1.59 billion, continuing a trend since 2023 when Sh412.47 million was lost to fraud.
The 2025 record cash loss came as reported fraud cases rose to 385 from 353 a year earlier, while the amount exposed to fraud – money targeted by fraudsters before recovery efforts – increased to Sh2.03 billion from Sh1.96 billion.
The rising threats and losses through card fraud, online and mobile banking fraud, computer fraud, internet scams, and identity theft mean that cybercriminals are increasingly exploiting loopholes in digital transaction channels.
The crooks are deploying strategies such as SIM-swaps, malware, phishing schemes, and identity cloning to steal from banks and their customers.
“Perhaps the most significant and emerging operational risk facing the financial sector is associated with cybercrime. The incidences of fraud, data privacy concerns, cyber-attacks, and cybersecurity threats increased in 2025, while recovery of the amount stolen declined,” the CBK said.
The full extent of banks’ losses through fraud could be higher because some lenders may opt not to report for fear of reputational damage. Many banks often prefer to quietly reimburse affected customers to avoid triggering panic among depositors.
Losses through card fraud, which mainly occurs when a person uses someone else’s card or card details without permission to transact, recorded the sharpest increase in losses. The amount more than doubled to Sh645.2 million from Sh263.3 million, even as reported cases declined to 16 from 24.
Cash losses through card fraud overtook mobile banking scams, where Sh634.3 million was lost in the review period, down from Sh810.7 million in 2024. The number of mobile banking fraud cases also dipped to 136 from 146.
Online banking fraud cases rose to 132 from 106, while losses increased to Sh157.5 million from Sh111.8 million. Internet scams recorded a faster jump, with cases rising to 22 from nine and losses surging to Sh86.5 million from Sh6.1 million.
Computer fraud losses increased to Sh212.5 million from Sh203.4 million, while identity theft cases rose to 63 from 56. Losses associated with identity theft, however, declined to Sh168.2 million from Sh199.1 million.
The Sh1.9 billion losses to fraudsters represent 93.75 percent of the Sh2.03 billion that was exposed to fraud, meaning that only Sh127.43 million or 6.25 percent was recovered.
The recovery level is lower than in the previous year, when 18.8 percent or Sh368.8 million of the stolen amount was recovered.
The regulator links the growing cybercrime threat to the rapid digitalisation of payments and money transfers, which has widened access to financial services but also created more vulnerabilities for criminals to exploit.
“The cyberattacks are becoming sophisticated, using a variety of techniques to infiltrate banking and payment systems,” the CBK said.
“The prevalent use of social media also exacerbates risks to the banking sector by rapidly propagating and distorting information and sentiments that are detrimental to confidence in the financial system.”
Data from the Communications Authority of Kenya (CA) showed the number of cyberattacks targeting internet users in the country more than doubled to 8.62 billion in the year ended June 2025, up from 3.52 billion in the prior year, with system attacks contributing 96.2 percent of the threats—much to the concerns of firms such as banks.
The CBK says the use of emerging technologies has brought efficiency gains and lowered transaction costs. However, it adds, the use of technologies such as machine learning and artificial intelligence (AI), together with shared services and third-party technology service providers, has elevated cyber risks.
“Rising cases of cyber fraud, scams through social engineering and phishing, misinformation and disinformation about financial products and institutions using artificial intelligence, pose real risks to the financial sector stability,” said the CBK.
The expansion of digital payments has increased the scale of potential exposure. Mobile money providers had 44.4 million active customers in December 2025, up from 36.9 million a year earlier, while banks continue to shift more customer transactions to digital platforms.
The CBK said it has stepped up sensitisation and capacity-building initiatives for payment service providers on emerging cyber-security threats, money laundering and terrorism financing. It has also linked its data warehouse with payment service providers’ systems to improve the timeliness and accuracy of supervisory reporting.
Strengthening cyber resilience, supervisory technology and regulatory frameworks will be critical to preserving confidence in the financial system, the regulator said.
The Kenya Bankers Association (KBA) runs a card and online safety awareness campaign dubbed Kaa Chonjo as part of efforts to curb fraud.
“It seeks to empower consumers of financial services with information on secure use of online, mobile, and card transactions, besides contributing towards alleviating fraud in the financial services sector,” the lobby says.
“Through the campaign, we also seek to enhance transaction channels usage by addressing security risks that affect utilisation. aimed at championing industry development through innovation and advocacy.”
In March last year, the CBK established a financial stability committee to formulate and implement financial sector policies that can help banks navigate risks coming from the highly interconnected, complex and cross-border operations.
“The committee meets quarterly to assess domestic and global risks with systemic importance to the financial sector. The committee also played a key role in the establishment of cybersecurity operations centres and tools to capture cyber vulnerabilities and cyber-attacks to mitigate cyber risks in the financial sector,” said the CBK.
The rising losses present banks with the twin challenge of protecting customer funds while sustaining the cost savings and efficiency gains associated with digital banking.
The increasing fraud losses are also pushing up the cost of insurance protection for banks, with insurers warning that cybercrime cover is becoming more expensive and harder to secure.
Leonard Chichir, the Britam General acting chief operating officer and head of underwriting and reinsurance, last year told the Business Daily that premiums for electronic computer crime policies had surged and nearly doubled amid rising thefts.
He said annual premiums for large banks averaged Sh80 million, with some paying as much as Sh400 million, depending on their deposits, customer numbers, staff size and the level of protection sought.
Mr Chirchir noted that banks were increasingly taking up electronic computer crime policies under the Bankers Blanket Bond, which covers losses arising from criminal acts including theft and forgery.
