CBK 2024: KSh 1.6B lost to banking cyber-fraud — what Kenyan SMEs should know

The Central Bank of Kenya's 2024 Financial Sector Stability Report is not bedtime reading. But if you run an SME, three numbers in it should change how you pay suppliers.

The three numbers

353 banking cyber-fraud cases. That is more than double the 173 cases recorded in 2023. Banking cyber-fraud — phishing, social engineering, account takeover, and fake payment instructions — is accelerating.

KSh 1.6 billion actually lost. Not "exposed" or "attempted." Actually taken. The total amount exposed across all reported banking cyber-fraud categories was KSh 1.963 billion; of that, KSh 1.594 billion was not recovered.

KSh 810.7 million from mobile-banking fraud alone. That is the single largest category, ahead of card fraud (KSh 263.3M) and online-banking fraud (KSh 111.8M). For Kenyan SMEs, mobile money is not just a convenience — it is the attack surface.

Why SMEs are the easiest target

Large banks and corporates have fraud teams, vendor verification processes, and insurance. SMEs have WhatsApp, M-Pesa, and a deadline.

The most common SME scam is not a Hollywood-style hack. It is a message that looks like it came from a supplier:

• "We have changed our paybill. Please send to this new number."
• "The old till is under maintenance. Use this one for today."
• "Invoice attached. Kindly settle before close of business."

The request is urgent, the sender looks familiar, and the amount is small enough not to trigger a second approval. By the time the real supplier asks why they have not been paid, the money is gone.

What the CBK numbers imply for your business

Three practical takeaways:

1. Mobile money is now the highest-loss channel. Every M-Pesa payment should be treated as a fraud risk until verified.
2. The problem is growing faster than awareness. Cases more than doubled year-on-year. SMEs that adopt verification habits now will be safer than those that wait.
3. Recovery is unlikely. The fact that 81% of exposed funds were actually lost means prevention is the only real protection.

A 30-second habit that changes the odds

Before you pay a new supplier, check three things:

1. Does the paybill or till number match the registered organisation name?
2. Has the payment detail changed recently with no prior warning?
3. Does anything about the request feel rushed or unusual?

If the answer to any of those is unclear, pause. Call the supplier on a number you already have. A 30-second verification beats a month of trying to recover money.

Source and next steps

All figures above are from the Central Bank of Kenya Financial Sector Stability Report 2024. SME supplier and payment fraud is typically under-reported, so the real numbers are likely higher.