Kenyan banks lose Sh1.9 billion to fraud as card theft overtakes mobile banking and recovery rates collapse

Kenyan bank fraud losses reached a record Sh1.9 billion in 2025 as criminals exploited weaknesses in card payments, mobile banking and online transaction systems, adding to the cost of securing the country’s expanding digital financial services industry.

Fresh disclosures by the Central Bank of Kenya (CBK) show that money stolen from banks increased by 19.4 percent from Sh1.59 billion in 2024, continuing a sharp rise from Sh412.47 million recorded in 2023. Reported fraud cases increased to 385 from 353, while the amount exposed to fraudulent activity, representing money targeted before recovery efforts, rose to Sh2.03 billion from Sh1.96 billion.

The losses came as card fraud overtook mobile banking scams as the largest source of stolen funds. Banks lost Sh645.2 million through card fraud, more than double the Sh263.3 million recorded in 2024, even as reported incidents declined to 16 from 24.

The CBK identified cybercrime as one of the most significant emerging operational risks facing financial institutions, citing increased incidents of fraud, data privacy concerns, cyberattacks and cybersecurity threats during the year. The regulator also reported a decline in the recovery of stolen funds, exposing banks to greater financial losses from attacks targeting their payment infrastructure and customers.

Card fraud overtakes mobile banking losses

Card fraud recorded the sharpest increase in financial losses among the categories monitored by the CBK. The Sh645.2 million lost in 2025 represented approximately 34 percent of the total money stolen from banks during the year, making card-related fraud the largest contributor to banking fraud losses.

Mobile banking fraud ranked second, with losses declining to Sh634.3 million from Sh810.7 million in 2024. Reported incidents also fell to 136 from 146, although the channel remained a major source of financial exposure as customers continued using mobile platforms to access banking services and transfer money.

Online banking fraud moved in the opposite direction, with reported cases increasing to 132 from 106 and losses rising to Sh157.5 million from Sh111.8 million. Internet scams recorded a sharper increase, with incidents climbing to 22 from nine, while the amount stolen jumped to Sh86.5 million from Sh6.1 million.

Computer fraud losses increased to Sh212.5 million from Sh203.4 million, while identity theft cases rose to 63 from 56. Losses associated with identity theft declined to Sh168.2 million from Sh199.1 million, showing that the financial impact varied across different forms of banking fraud.

The increase in card fraud comes against a backdrop of vulnerabilities in payment authentication systems. A July 2025 investigation covered by TechTrendsKE detailed a Financial Reporting Centre account of a bank fraud involving contractors who allegedly downgraded a 3-D Secure payment authentication system to 2-D Secure, removing OTP verification. Fraudsters subsequently created unauthorised wallets and siphoned Sh517 million from customer wallets, with the proceeds moved through cryptocurrency.

The payment security challenge has also attracted new industry partnerships. On October 30, Kenswitch announced a partnership with Wibmo, a PayU company, to provide financial institutions connected to its payment network with access to EMV 3-D Secure authentication through an Access Control Server.

The arrangement supports online card authentication across Visa and Mastercard networks, allowing participating institutions to strengthen verification when customers make e-commerce transactions. Kenswitch said the partnership would also support the routing of more online transactions through domestic payment infrastructure.

Banks recover just 6.25% of money exposed to fraud

The decline in fraud recovery presents another financial challenge for Kenya’s banking industry. Of the Sh2.03 billion exposed to fraudulent activity in 2025, banks recovered just Sh127.43 million, leaving Sh1.9 billion lost to criminals.

This means that approximately 93.75 percent of the money targeted by fraudsters was lost, compared with a recovery rate of 18.8 percent in 2024, when banks recovered Sh368.8 million. The amount recovered therefore declined by approximately 65.5 percent within a year, despite the increase in the value of funds exposed to fraud being relatively modest.

The deterioration in recovery performance adds pressure on financial institutions, which must absorb fraud-related losses while investing in systems to protect customer accounts and maintain confidence in digital transactions. The CBK said rising actual losses could affect banks’ profitability and their capacity to build capital.

The financial consequences extend to insurance costs. Leonard Chichir, Britam General’s acting chief operating officer and head of underwriting and reinsurance, told Business Daily last year that premiums for electronic computer crime insurance policies had surged and nearly doubled amid rising thefts.

He said annual premiums for large banks averaged Sh80 million, with some institutions paying as much as Sh400 million depending on their deposits, customer numbers, staff size and the level of protection sought. Banks were also taking up electronic computer crime policies under the Bankers Blanket Bond, which covers losses arising from criminal acts such as theft and forgery.

Payment authentication and SIM swaps expose security gaps

The growth in digital banking fraud has placed greater attention on the relationship between banks, telecommunications companies and payment service providers. Mobile identity has become an important part of financial account security because customers rely on their phone numbers to receive OTPs, authenticate transactions and recover access to banking services.

A July 2026 High Court ruling involving Safaricom and Diamond Trust Bank illustrated the financial consequences of weaknesses across this interconnected system. The case involved Mercy Wairimu Kariuki, who lost Sh4.4 million through unauthorised mobile banking and Pesalink transactions following an unauthorised SIM replacement.

The court upheld joint liability, allocating 60 percent of the responsibility to Safaricom and 40 percent to DTB, after finding that both institutions had breached their respective duties of care. The ruling highlighted the responsibilities of telecommunications operators and banks in protecting customers whose financial accounts depend on mobile identity and authentication systems.

SIM swaps, phishing and social engineering remain among the methods used by criminals to compromise customer accounts. Fraudsters can impersonate financial institutions, manipulate customers into sharing confidential information or exploit compromised credentials to initiate transactions.

The Kenya Bankers Association runs Kaa Chonjo, a card and online safety awareness campaign aimed at educating customers on the secure use of online, mobile and card transactions. The lobby says the initiative seeks to improve the use of digital transaction channels by addressing security risks that affect customer confidence and adoption.

AI and digital payments add to cybersecurity risks

The CBK linked the growing cybersecurity threat to the rapid digitalisation of payments and money transfers, which has widened access to financial services while creating more opportunities for criminals to exploit weaknesses in connected systems.

Mobile money providers had 44.4 million active customers in December 2025, up from 36.9 million a year earlier. The expansion of mobile financial services has increased the number of customers interacting with digital payment infrastructure, while banks continue moving more transactions to online and mobile channels.

The regulator warned that cyberattacks were becoming more sophisticated, with criminals using different techniques to infiltrate banking and payment systems. It also identified social media as a growing risk because misleading information and distorted narratives about financial products and institutions can spread rapidly and undermine confidence in the financial system.

Artificial intelligence and machine learning have added another dimension to the threat. The CBK said the adoption of emerging technologies, alongside shared services and third-party technology providers, had elevated cybersecurity risks across the financial sector.

“Rising cases of cyber fraud, scams through social engineering and phishing, misinformation and disinformation about financial products and institutions using artificial intelligence, pose real risks to the financial sector stability,” the CBK said.

The regulator’s concerns come as Kenyan institutions confront the use of AI to produce convincing impersonations, fake communications and fraudulent investment promotions. TechTrendsKE’s coverage of the 2026 Safaricom Cybersecurity Summit examined how deepfake videos, cloned voices and fake executive calls are complicating identity verification for organisations.

The CBK’s own adoption of AI also illustrates the growing importance of governance around financial technology. In October 2026, the regulator’s AI strategy coverage detailed nearly 300 AI use cases across 14 departments, including machine learning applications and economic nowcasting.

The security implications extend to third-party technology providers that support financial institutions. Banks depend on external infrastructure and service providers to run payment processing, customer authentication and other digital operations, making the security of interconnected systems an important part of financial sector resilience.

CBK steps up financial sector cybersecurity oversight

The scale of the threat is reflected in national cybersecurity statistics. Data from the Communications Authority of Kenya showed that cyberattacks targeting internet users more than doubled to 8.62 billion in the year ended June 2025, from 3.52 billion in the previous year. System attacks accounted for 96.2 percent of the detected threats.

The CBK said it had stepped up sensitisation and capacity-building initiatives for payment service providers on emerging cybersecurity threats, money laundering and terrorism financing. It has also connected its data warehouse to payment service providers’ systems to improve the timeliness and accuracy of supervisory reporting.

In March 2025, the regulator established a financial stability committee to formulate and implement policies addressing risks arising from the financial sector’s interconnected, complex and cross-border operations. The committee meets quarterly to assess domestic and international risks with systemic importance to the sector.

The CBK said the committee also played a key role in establishing cybersecurity operations centres and tools designed to capture cyber vulnerabilities and attacks, helping financial institutions mitigate risks across the financial system.

The regulator’s wider oversight agenda also includes the proposed National Payment System Bill, 2026, which seeks to strengthen supervision of payment service providers and give the CBK broader powers to inspect their systems and records and intervene where providers threaten customers or financial stability.

The growing exposure to digital fraud presents banks with the challenge of protecting customer funds while retaining the efficiency and cost savings associated with electronic transactions. As card payments, mobile banking and online financial services expand, the effectiveness of authentication systems, fraud detection capabilities and coordination between financial institutions and technology providers will remain central to protecting Kenya’s banking sector.