Fraudsters stole a record KSh1.9 billion from banks in Kenya in 2025, according to the Central Bank of Kenya (CBK).

The loss was 19.4 per cent higher than the KSh1.59 billion reported for 2024 and continued a rise that began in 2023 when KSh412.47 million was lost.

Reported fraud cases increased to 385 in 2025 from 353 a year earlier, while the amount exposed to fraud grew to KSh2.03 billion from KSh1.96 billion.

Losses from card fraud more than doubled to KSh645.2 million, up from KSh263.3 million, even though reported cases fell to 16 from 24.

Mobile-banking scams accounted for KSh634.3 million in losses, down from KSh810.7 million in 2024, with cases slipping to 136 from 146.

Online-banking fraud cases rose to 132 from 106 and losses climbed to KSh157.5 million from KSh111.8 million.

Internet-scam incidents increased to 22 from nine, with losses surging to KSh86.5 million from KSh6.1 million.

Computer-fraud losses rose to KSh212.5 million from KSh203.4 million.

Identity-theft cases grew to 63 from 56, while losses fell to KSh168.2 million from KSh199.1 million.

Only KSh127.43 million, or 6.25 per cent of the KSh2.03 billion exposed, was recovered, compared with a recovery of KSh368.8 million, or 18.8 per cent, in the previous year.

The CBK said the most significant emerging operational risk for the financial sector is cybercrime, noting that incidences of fraud, data-privacy concerns, cyber-attacks and cybersecurity threats increased in 2025 while recovery of stolen amounts declined.

The regulator added that cyber-attacks are becoming sophisticated and that the prevalent use of social media exacerbates risks to the banking sector by rapidly propagating misinformation that harms confidence.

Data from the Communications Authority of Kenya showed cyber-attacks targeting internet users more than doubled to 8.62 billion in the year ended June 2025, up from 3.52 billion the year before, with system attacks accounting for 96.2 per cent of the threats.

The CBK warned that the use of emerging technologies such as machine learning and artificial intelligence, together with shared services and third-party providers, has elevated cyber risks.

Mobile-money providers reported 44.4 million active customers in December 2025, up from 36.9 million a year earlier, as banks shift more transactions to digital platforms.

The central bank said it has stepped up sensitisation and capacity-building for payment-service providers on emerging cyber-security threats and has linked its data warehouse with providers’ systems to improve supervisory reporting.

The Kenya Bankers Association runs a card and online safety awareness campaign called Kaa Chonjo to empower consumers with information on secure use of online, mobile and card transactions.

In March 2025 the CBK established a financial-stability committee to formulate policies for systemic risks and to set up cybersecurity operations centres and tools to capture vulnerabilities and attacks.

Leonard Chichir, acting chief operating officer and head of underwriting and reinsurance at Britam General, said premiums for electronic computer-crime policies had surged and nearly doubled, with annual premiums for large banks averaging KSh80 million and some paying up to KSh400 million.