Kenya’s Bank Fraud Hit Record Sh1.9B, Recoveries Down to 6%

Kenyan bank customers lost a record Sh1.9 billion to fraud in 2025. That is up 19.4% on 2024 and 4.6 times the 2023 level. At the same time, the share of stolen money that banks got back collapsed, from 18.8% to 6.25%.

Nigeria’s fraud losses fell in 2025. Kenya’s went the other way. This report reads the new Central Bank of Kenya (CBK) figures closely, and sets them beside the wider picture of digital scams across the country. Four findings stand out. First, losses have risen two years in a row. Second, the money is harder to recover: banks got back only Sh127.43 million of the Sh2.03 billion exposed. Third, card fraud overtook mobile banking as the biggest source of loss, yet it came from only 16 cases. Fourth, bank figures show only a thin slice of the problem. A survey estimate puts losses to cybercrime at close to Sh30 billion in a single quarter.

Start with the three-year picture. The CBK counts the amount exposed to fraud, the amount recovered and the amount lost. We worked out 2023 recovery by taking losses from exposure.

The recovery trend is the quiet alarm in this table. In 2023, banks clawed back roughly two of every five shillings that criminals tried to take. By 2025, they clawed back about one in 16. Exposure grew by only 3.6% in 2025, but recoveries fell by 65%. So the rise in losses came less from bigger attacks than from less money being clawed back. The reasons are not in the CBK data. Other reporting describes how stolen money is pushed through chains of mule accounts and mobile money wallets. It is then cashed out at agents or switched into crypto. Kenya’s Director of Public Prosecutions, Renson Ingonga, has described “distributed networks of money mules” that move funds “through multiple mobile wallets.”

Reported cases rose only slightly, from 353 to 385. So the average loss per case went up, from about Sh4.5 million to about Sh4.9 million, by our sums. The channel figures show where the money went.

Card fraud is the headline. It rose 145% to Sh645.2 million and overtook mobile banking as the largest loss channel, at about 34% of the total. Yet card cases fell by a third, from 24 to 16. By our sums, that is about Sh40 million per case, against Sh11 million a year earlier. A few very large hits drive this line, much as one ₦31.1 billion case distorted Nigeria’s 2024 numbers. A single large card breach, or a few, can swing the whole year. That makes the channel hard to predict and easy to misread.

Mobile banking tells a different story. Losses fell 22% to Sh634.3 million and cases dipped from 146 to 136. After mobile banking lost Sh810.7 million in 2024, up 344% on the year before, the CBK may be seeing some benefit from tighter controls. But online banking is rising, with losses up 41% and cases up 25%. Internet scams jumped from Sh6.1 million to Sh86.5 million. So the pressure may be moving, not easing.

Who is behind the losses? The CBK frames them as outside cyber threats. It describes the banking sector as “resilient” and says the motive of attackers is financial gain. The wider evidence is mixed. Visa’s mid-year 2026 threats report says “criminals are increasingly targeting people rather than technology,” using impersonation, urgency and AI tools, while network security is improving. A TechCabal analysis notes that lenders often call losses “cyber threats” even when investigators find human involvement. It describes one 2024 loss of about Sh1.5 billion at a large lender that was first called a hack. Investigators later alleged that staff had colluded with outsiders to move the money in small, salary-like transfers. Those are allegations, not findings. They do show why the label “cyber” may hide an inside job, as it can in Nigeria, where the national payments body calls insider abuse the greatest threat.

Now the wider picture. The CBK figures cover bank-reported cases. They leave out most of what ordinary Kenyans face. A GeoPoll survey of Kenyans, covering July to September 2025, found that 37% had lost money to a cyber incident in the past year. Of those losses, 74% were under Sh5,000, and 6% of victims lost more than Sh50,000. Mobile money fraud was reported by 54% of respondents and phishing by 61%. The survey’s estimate of losses in that quarter was Sh29.9 billion. That is about 16 times the CBK’s figure for all of 2025. The two numbers measure different things and cannot be set against each other like for like. But they point the same way: the real cost of digital fraud in Kenya is many times what the bank statistics show. M-Pesa, with more than 30 million users and more than $50 billion in yearly transactions, is the stage on which most of it plays out.

Kenya’s case counts also look very different from Nigeria’s. The CBK counts 385 cases, while Nigeria’s payments body counted 67,518. These are not like for like. The CBK series covers fraud that banks report as cyber fraud, and the Nigerian series covers digital payments across the system. The lesson is to compare trends within each country, not raw numbers across them.

What are the rules doing? The CBK says it has run inspections on ICT risk and added indicators such as system downtime, incident response and penetration testing to its supervision. It has also committed to new rules on compensation for victims of e-money and digital wallet fraud by the end of 2026. Draft rules are expected for public comment, but no date has been set. The rules would push providers to improve fraud detection, identity checks and complaint handling. Who pays when a customer is tricked remains open, since the framework still has to settle when a user was careless and when a provider failed.

Why it matters: A record loss and a collapsing recovery rate send the same message: in Kenya, once money leaves a customer’s account, it rarely comes back. That puts the weight on prevention, speed and clear rules on who bears the loss. For customers, the practical steps are simple. Treat any call or message about a “wrong payment” or a “suspended account” as a warning sign. Never share a PIN or code. Report a loss to the bank and the provider at once, since every hour counts. For banks and mobile money firms, the lesson is to watch for mule accounts, big card hits and staff access, and to publish more of what they see. For regulators, it is to widen the data. A country where M-Pesa alone has more than 30 million users cannot judge fraud by a few hundred bank cases.

What to watch next: the CBK’s draft compensation rules, and whether they set clear liability and refund timelines. Watch the next CBK data to see if the recovery rate recovers or keeps falling. Watch whether card losses stay high or fall back once the large cases leave the data. Watch the split between bank and mobile money fraud, and whether regulators publish figures for mobile money wallets. Watch police and court action on SIM-swap and mule networks. And watch whether the pressure keeps shifting from mobile banking to online banking and scams, as the 2025 numbers hint.

Sources: TechTrends Kenya on the CBK’s 2025 fraud figures; Business Daily on the record Sh1.9bn in bank fraud; Khusoko on Kenya’s 2024 fraud losses; TechCabal on the CBK and mobile banking fraud; allAfrica on Kenya’s cybercrime economy; The Star on the GeoPoll cybercrime survey; Serrari Group on the CBK’s planned compensation rules; allAfrica on Visa’s 2026 threats report.

A note for startup founders: Don’t practice on investors. Practice on AI first. RaiseReady by Index Prima is an AI fundraising simulator for African founders: upload your pitch deck, get a readiness score and face a tough AI investor before the real meeting. Find this post, and every post we publish, at raiseready.indexprima.com.