Digital Identity at Risk: Where can Kenyans turn for protection?

Kenyan banking sector suffered Sh168.17 million in losses due to identity theft in 2025, as reported by the Central Bank of Kenya (CBK). This figure represents a decline in losses from the previous year, but an increase in total banking-sector fraud cases, which rose from 56 in 2024 to 63 in 2025. The consequences of identity theft extend beyond financial loss, encompassing unauthorized transactions, misuse of personal details, and the difficulty in determining responsibility.

The figures reported by the CBK do not encompass all instances of identity theft or personal-data misuse in Kenya. One notable case involved Mwikali Nzyoka, who reported that Kenya Women Microfinance Bank disclosed her loan status, identification details, workplace, and telephone number to other financial institutions without her consent.

The Office of the Data Protection Commissioner (ODPC) confirmed that Kenya Women Microfinance Bank, Family Bank, and Co-operative Bank of Kenya had unlawfully processed Nzyoka's personal information. These incidents underscore the vulnerabilities of digital identities and the importance of protecting personal data. Kenya's Data Protection Act, 2019, mandates organizations to adhere to data-protection principles and implement safeguards when handling personal information.

The ODPC is responsible for enforcing the law and investigating alleged violations. Financial service providers must also investigate suspicious transactions and secure compromised accounts, while telecommunications providers may investigate unauthorized control of mobile numbers. Safaricom, for instance, has established fraud-management programs and technological controls to safeguard M-PESA customers against risks such as social engineering, fraudulent SIM swaps, and identity theft.