The legal framework
Sections 28 and 29 of the Computer Misuse and Cybercrimes Act 2018 cover identity theft and impersonation. The practical risk in Kenya runs through SIM swap: control of the phone number gives control of mobile money and of bank one-time passwords. Mobile operators and banks both operate fraud reporting lines.
Kenya has specific offences for identity theft and impersonation under the Computer Misuse and Cybercrimes Act, but the dominant pattern is not classic identity theft: it is the SIM swap, in which an attacker takes over your mobile number and with it your mobile money wallet and bank verification messages. Speed is everything, and the mobile operator matters more than the police in the first minutes.
Key points
| Statute | Computer Misuse and Cybercrimes Act 2018, sections 28 and 29 |
|---|---|
| SIM swap | The main attack route; report an unexplained loss of signal immediately |
| Mobile money | Report to the operator's fraud line at once to attempt a reversal |
| Credit | Credit reference bureaus must provide a free report each year |
| Data protection | Report the underlying breach to the Data Protection Commissioner |
| Enforcement | DCI cybercrime unit |
| Mobile money reversal | Only possible if reported within minutes |
| Credit reference bureaus | One free report per year from each |
In practice
- If your phone suddenly loses network for no reason, treat it as a SIM swap and call your operator immediately.
- Report to the mobile money operator's fraud line before anything else: reversals are only possible early.
- Open a case with the DCI and obtain an OB number.
- Request your credit reference bureau reports and dispute unknown loans.
- Call your operator from another phone the moment you lose network unexpectedly.
Where to go
- DCI cybercrime unit.
- Mobile operator fraud lines.
- Office of the Data Protection Commissioner.
Worth knowing
Digital lending apps make it easy for someone with your identity documents to take loans in your name: check all three credit reference bureaus, not just one. Digital lending apps make it easy to take loans against a stolen identity. Check all bureaus, not just one, because they hold different records.
Frequently asked questions
What is a SIM swap and how do you stop it?
An attacker persuades or bribes an operator to move your number to their SIM, which gives them your one-time passwords and mobile money. If your phone suddenly loses network for no reason, treat it as an emergency: call the operator from another phone and have the line suspended.
What should you do in the first hour?
Call your bank and freeze the affected accounts and cards, change the passwords on your email first and then on everything linked to it, and turn on two-factor authentication. Take screenshots of everything before anything is deleted. Then report to the police and keep the reference number: banks, lenders and telecom operators will ask for it before they reverse anything.
Official sources and links
- eCitizen — official government services portal