Cyber criminals operating from Kenya had illegally benefited from approximately Sh12 billion in federal funding.
If you indulge many a street-smart youth in Nairobi, you will quickly catch onto their ruthless digital grit. For many of them are ready to exploit any legal or policy loophole by clicking away on their keyboards to secure cash and survive the tough city life.
According to the Interpol Global Financial Threat Assessment report released in March 2026, these operations span a wide array of deceptive tactics, ranging from Business Email Compromise (BEC) and advance payment fraud to impersonation fraud, investment fraud, and romance fraud, all executed with the singular goal of capturing cash.
It is crucial to distinguish this underground network of syndicates from Kenya’s thriving community of legitimate remote workers, software developers, and online freelancers who anchor the formal digital economy, as these transnational cyber criminals exploit global financial infrastructure for illicit cash outs.
“This is a jungle. At times we do not care who you hit. There are days you hit even your fellow cyber criminals. This is a game of finding someone who is greedier than you,” said a cybercriminal on a social media group, who spoke in confidence.
The US Department of Education recently revealed that cyber criminals operating from Kenya had illegally benefited from approximately Sh12 billion in federal funding meant for American students in college through grants and loans under the Free Application for Federal Student Aid (FAFSA) awarded to ghost learners. Despite the US tracking the FAFSA scam, it has become clear that this community of individuals relies on multiple alternative channels to look for money.
One of the primary schemes run by these local operators is advance payment fraud. In this scenario, the cyber criminals utilise popular social media platforms or other digital marketplaces to promote the sale of high demand consumer products. They then request an upfront payment for the merchandise, which in most cases is entirely nonexistent, before severing all communication channels once the transaction is complete.
While this common scam remains fundamentally basic in its execution, it has radically shifted scales as bold operators expand their reach to target unsuspecting buyers based in the West.
The scammers also go big on investment fraud by manipulating people into putting money in fake or misleading ventures, such as a fraudulent trading application entirely controlled by the perpetrators.
According to the Global Financial Threat Assessment report released by Interpol in March 2026, these operators successfully trap victims by promising exceptionally high financial returns, misrepresenting how the investments work, and creating a false sense of extreme urgency.
Online platforms like Reddit, Discord, Telegram, WhatsApp and social media platforms like X and Facebook have provided communication channels for these cybercriminals.
A man using a computer at a Cyber café in Mulot, Bomet County.
The more experienced folk communicate through the dark web – a hidden layer of the internet which hides user identities and locations, only accessible through specialised software.
In those communication channels, operators frequently explain exactly how this profitable scam is mechanized, technically making their expertise available to the public.
One of the most common con schemes involves cryptocurrencies – a form of virtual money traded and transferred online through highly secured digital networks, and without government oversight.
Their setup allows hiding of identities, a move that has triggered debate globally on their potential use for moving proceeds of crime and corruption.
In the con scheme, someone pretends to have accidentally leaked a master password for a digital wallet in a public platform.
When an unsuspecting target enters this password on their own device, they discover a huge wallet balance.
The technical design of cryptocurrencies requires anyone trying to move that money to first deposit a smaller amount to cover transaction charges commonly referred to as “gas fee”.
The moment the unsuspecting user parts with the gas fee, an automated software, known in technical terms as sweep bots, carry that deposited amount within a fraction of a second. The millions remain, and the sweep bots await the next greedy target.
This scheme nets several targets, especially those new to the cryptocurrency world.
This digital illusion has left a trail of devastating financial wreckage among local investors who believe they are participating in legitimate peer to peer trading.
A victim shared a painful testament of how the conmen took Sh30,000 from him in January 2026 through a variation of this trading trap.
The operators asked him to execute cryptocurrency trades on their behalf, structuring the investment into tiers where a single transaction level, known as a slap, costs Sh15,000.
To trade a perceived volume of Sh600,000, the victim paid for two slaps, fully believing he had finally made it big before realising the entire setup was an elaborate scam designed solely to harvest his upfront deposits.
At the same time, the “sharp boys” and “baddies” will at times engage in romantic fraud, with them buying several active accounts of dating apps such as Tinder.
Cybercrime in Kenya
In these cases, they will download pictures on social media and pose, waiting for an victim on the other end to match.
The scam capitalises on chatting with a person looking for love on the other end and earning their trust before starting to request some funds by mentioning an emergency.
This avenue, however, has been flooded to the extent of Kenyans in the scam meeting fellow scammers on the platforms, leading to a dead end.
But in the haze of finding means to eat, the con artists are not afraid to hit their fellow cyber criminals, including those out there looking for guidelines on netting targets.
In some of the peer communities, the scammers will create a sense of urgency or demand by pitching a scam idea, looking for those to con.
Here they bring up a country, for instance Zimbabwe, and explain a scheme that involves buying Zimbabwean sim cards and their correlating identity numbers so that they can use them on applying for digital loans.
A group claims to be selling the numbers, only for buyers to get to the seller’s inbox and be scammed.
Lawyer Shadrack Kipkorir explains that dealing with cybercrime in Kenya has a long way to go due to its complex nature.
“The primary challenge from my lens is want of capacity on the premise that modern high level cybercrimes rely on complex digital footprints, anonymity tools, and encrypted environments. It is also complicated by constant advancement in technology and countries such as ours lag behind. Of course it does not help that our country still faces challenges emanating from compromised investigations and corruption in the judiciary,” said Mr Kipkorir.
“Extradition is an option. Case in point is the extradition of the Akasha brothers to the US. Another case that is alive is the one of the trio Peter Omari, Francis Asanyo and Elvis Obaigwa accused of cybercrime offences against the US. The same is a legal process which requires the surrender of a suspect to authorities of a foreign country for prosecution purposes by a way of a court order. Sovereign states collaborate to bring criminals to book, but the same must adhere to international human rights,” he added.
Lawyer Benjamin Njeru holds that weak legal framework makes it hard to stop such cybercrimes.
He notes that the Computer Misuse and Cybercrimes Act of 2018, despite being recently amended in 2025, completely fails to tackle the core technical realities required to combat sophisticated attacks or untangle encrypted footprints.
Mr Njeru adds that the lawmakers were largely focused on policing online speech when passing legislation, not nicking advanced digital fraud in the bud. That, he says, left several gaps which allow cybercrime to continue thriving.
Cybercriminals are exploiting online academic writing platforms used to produce essays for American students.
“When we talk of such technology, we are not really equipped, because the intention of the lawmakers was not to nip that tech first in the bud, it was to make sure that the internet is not used to harass or insult high level politicians. We hardly ever have that law used to curb such levels of crime, and a section of that Act was recently declared unconstitutional in a case by the Bloggers Association of Kenya that has gone all the way to the Supreme Court,” says Mr Njeru.
He, however, explained that despite cybercrime being difficult to control, the country can work on litigation to tighten regulations for providers whose channels are used to transfer money stolen through fraud.
“What Kenya can do is to develop a piece of legislation that focuses specifically on the regulation of tech, which means that internet service providers and key stakeholders in the technology business are legally required to monitor suspicious activity to the best of their ability. We must realise that we are limited because the law has not caught up with us in terms of technology, especially regarding things like VPNs (Virtual Private Networks), identity masking, and the whole dark web.” he says.
Mr Njeru holds that owing to the evolving nature of that realm, the law should allow for flagging of cybercriminals and provide for harsh punishment for repeat offenders. He warns, however, that Kenyan authorities are not well-equipped to investigate the most complex cybercrimes.
Beyond strict containment and reactive policing, he advises the legal landscape to also offer progressive pathways to reform the highly skilled talent driving these local syndicates.
He argues that simply tossing brilliant young tech minds into Kenya’s overcrowded correctional facilities does nothing to secure the digital economy, especially when the law itself provides mechanisms to redirect their technical grit into legitimate state capacity.
According to Mr Njeru, the state should actively pivot away from traditional convictions in favour of alternative justice system frameworks that utilize rehabilitation over pure punishment.
“When a young person is brought to court and charged with a cybercrime, it is not in the best interest of the public to simply jail them. Legally speaking, the Director of Public Prosecutions can use mechanisms like diversion or plea agreements so that the matter does not go to a full trial. Our laws provide for these pathways where the court can find a way to avoid a conviction and instead have them serve another useful purpose in society. At the end of the day, these are very young individuals, some not even 18 years old, and what they do is technically brilliant. Instead of pushing them down a criminal rail track, we can have them serve the community or work within government institutions to turn their skills into meaningful action,” says Mr Njeru.
Follow our WhatsApp channel for breaking news updates and more stories like this.
