Digital Identity at Risk: Where can Kenyans turn for protection?

NAIROBI, Kenya, Nov 6 — Identity theft accounted for Sh168.17 million in actual losses recorded in Kenya’s banking sector in 2025, according to the Central Bank of Kenya (CBK), highlighting the financial risks associated with compromised personal information.

The CBK’s Financial Sector Stability Report 2025 recorded sixty-three banking-sector fraud cases classified as identity theft, up from fifty-six in 2024.

Although actual losses under this category declined from Sh199.08 million in 2024, losses across all banking-sector fraud categories increased from Sh1.59 billion to Sh1.90 billion over the same period.

For victims, the consequences can extend beyond lost money to compromised accounts, unauthorised transactions, misuse of personal details and the challenge of establishing who was responsible.

The figures cover reported banking-sector fraud and do not represent every instance of identity theft or personal-data misuse in Kenya. Nor do they establish how each incident occurred or whether every case involved a data breach.

One case documented by the Office of the Data Protection Commissioner (ODPC) illustrates how personal information can be misused even without a documented fraudulent withdrawal.

In a complaint lodged with the regulator, Mwikali Nzyoka alleged that Kenya Women Microfinance Bank had disclosed her loan status, identification details, workplace and telephone number to other financial institutions without her consent.

According to an ODPC determination dated April 21, 2025, Nzyoka began receiving unsolicited calls in September 2024 from individuals claiming to represent Co-operative Bank of Kenya.

One caller allegedly informed her that Kenya Women Microfinance Bank was selling customer loans to other banks, while another claimed that her information had been obtained from the microfinance institution.

The calls raised concerns about how other financial institutions had obtained details of her existing loan.

In her complaint, Nzyoka referred to “the unauthorized disclosure of my personal data and the emotional distress it has caused me.”

The microfinance bank disputed that the alleged breach originated from its systems and identified other possible sources of the information.

However, after investigating the complaint, the ODPC found that Kenya Women Microfinance Bank, Family Bank and Co-operative Bank of Kenya had unlawfully processed her personal information.

The determination did not establish that money had been withdrawn fraudulently from her account or identify the technical method through which the information was obtained.

It nevertheless demonstrated how the unauthorised use of personal information can expose individuals to unwanted contact and leave them seeking accountability from institutions entrusted with their data.

How digital identities are compromised

Digital identity comprises information used to identify or verify a person when accessing services. It may include identification details, telephone numbers, email addresses, financial information and account credentials.

Criminals may obtain such information through phishing, social engineering, identity theft, SIM-swap fraud or unauthorised access to digital systems.

Phishing involves using deceptive messages, websites or links to trick individuals into revealing passwords and other confidential information.

In SIM-swap fraud, criminals seek to transfer a victim’s telephone number to another SIM card, potentially gaining access to calls or messages used in account authentication and password recovery.

Personal information may also be exposed through weaknesses in an organisation’s systems or unlawfully disclosed by people with access to it.

The Communications Authority of Kenya’s National KE-CIRT/CC Cybersecurity Report for July to September 2026 recorded approximately 2.696 billion detected cyber threat events, a 14.45 per cent increase from the preceding quarter.

The Authority identified phishing, social engineering, credential theft and exploitation of system vulnerabilities among the threats affecting digital systems and users.

However, detected threat events should not be confused with confirmed successful attacks or the number of individuals whose identities were stolen.

Similarly, not every incident involving identity theft results from an organisational data breach. An individual may be deceived into disclosing credentials without an organisation having unlawfully disclosed personal information.

Conversely, personal information may be exposed or processed unlawfully even where the affected individual has not suffered a direct financial loss.

Establishing what happened is therefore essential to determining which institutions may be responsible and what remedies are available.

Who is responsible for protecting personal data?

Kenya’s Data Protection Act, 2019, establishes obligations for organisations that collect, use, store or otherwise process personal information.

The law requires data controllers and data processors to comply with data-protection principles and implement appropriate safeguards when handling personal information.

The ODPC oversees implementation and enforcement of the law, receives complaints and investigates alleged violations of personal-data rights.

Where a bank or mobile-money account is affected, the financial service provider may need to investigate suspicious transactions and help secure the account. If the incident involves suspected unauthorised control of a mobile number, the telecommunications provider may also need to investigate.

In its 2025 annual reporting, Safaricom identified social engineering, fraudulent SIM swaps, digital identity theft and mobile application takeovers among the risks affecting M-PESA customers.

The company reported that it had established fraud-management programmes and technological controls to monitor activity on its platforms, alongside a customer protection arrangement intended to support remediation for eligible incidents resulting from failures in its products or processes.

However, this does not mean every customer who loses money through fraud automatically qualifies for reimbursement. The circumstances of each incident and the findings of an investigation remain relevant.

The distinction matters because identifying the immediate source of a fraudulent transaction does not necessarily establish how an identity was compromised or whether an organisation violated data-protection law.

Where should victims turn?

For someone who suspects their digital identity has been compromised, the immediate priority is to limit further harm and preserve evidence.

If a bank or mobile-money account is involved, the individual should contact the provider through its official channels, report suspicious activity and ask how the account can be secured.

Victims should retain transaction records, suspicious messages, emails, screenshots and complaint reference numbers that may help establish what happened. Passwords, PINs and one-time passwords should never be shared with people claiming they can recover lost funds or investigate an incident.

Suspected criminal impersonation or fraud may also need to be reported to law enforcement.

Where the concern involves unlawful collection, use or disclosure of personal information, an individual may lodge a complaint with the ODPC.

Under the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021, complaints may be submitted electronically, in writing or through other permitted channels.

The regulator requires relevant details about the alleged violation, including the institution involved, the nature of the complaint and any harm suffered. Supporting material such as correspondence, transaction records and screenshots may also be provided.

The ODPC’s published service charter provides for acknowledgment of complaints within seven working days. Following preliminary review, the office may admit a complaint, advise that the matter falls outside its mandate or refer it to another appropriate institution.

Where an investigation establishes a violation, the regulator may issue a determination, direct corrective action or order compensation where legally justified.

The Data Protection Act provides for the investigation of complaints within 90 days, subject to applicable legal requirements and the circumstances of the matter.

The National KE-CIRT/CC, hosted by the Communications Authority, provides a separate route for reporting cybersecurity incidents such as phishing, malicious software and unauthorised system access.

It coordinates technical responses and issues advisories but does not replace criminal investigations or determine compensation claims under the Data Protection Act.

The different reporting routes serve distinct purposes: a cybersecurity incident report does not automatically establish a data-protection violation, while a complaint to the ODPC is not a substitute for reporting suspected criminal conduct to law enforcement.

What protection does the law provide?

Section 65 of the Data Protection Act provides for compensation where a person suffers damage because of a contravention of the law.

Damage may include financial loss and non-financial harm, including distress. However, compensation is not automatic whenever fraud occurs. The circumstances must establish a relevant contravention, damage and the applicable basis for liability.

The ODPC’s determination involving Nzyoka illustrates how the provision can be applied.

After finding that Kenya Women Microfinance Bank, Family Bank and Co-operative Bank had unlawfully processed her personal information, the regulator ordered the three institutions to pay a combined Sh650,000 in compensation.

Kenya Women Microfinance Bank was ordered to pay Sh250,000, while Family Bank and Co-operative Bank were each directed to pay Sh200,000.

The ODPC also ordered that an enforcement notice be issued against Kenya Women Microfinance Bank.

The compensation was for unlawful processing of personal information, not reimbursement for a documented fraudulent withdrawal.

The parties were given 30 days to appeal the determination to the High Court.

The case demonstrates that victims can seek regulatory intervention and compensation where unlawful processing is established, but it also highlights the importance of following up on whether decisions are implemented.

Closing the protection gap

Figures released by Data Commissioner Immaculate Kassait in January 2026 indicated that the ODPC had received 9,061 complaints relating to alleged violations of personal-data rights since the establishment of the country’s data-protection framework.

The office had issued 357 determinations, 134 enforcement notices and 20 penalty notices. Kassait also reported 184 compensation orders and 84 cases resolved through Alternative Dispute Resolution.

These figures cover different types of complaints and cannot be treated as the total number of identity-theft or financial-fraud incidents reported to the regulator.

They nevertheless point to the growing importance of data-protection enforcement as more Kenyans rely on digital services.

For individuals, precautions such as using unique passwords, enabling multi-factor authentication where available, keeping devices updated and verifying requests for confidential information through official channels can reduce some risks.

But individual vigilance cannot eliminate threats arising from weaknesses in organisational systems or the unlawful handling of information by institutions.

Protecting digital identity therefore requires organisations to handle personal information responsibly, regulators to investigate complaints effectively and law-enforcement agencies to pursue suspected criminal conduct.

For someone whose identity has already been compromised, the decisive question is not simply where to report the incident, but whether the system can establish what happened, address the harm and provide a meaningful route to redress.