Kenyan cryptocurrency investors lost an estimated KSh491 million ($3.8 million) over the past year after criminals exploited a growing weakness in digital finance security: mobile phone numbers.
Instead of attempting to breach blockchain networks or cryptocurrency wallets, fraudsters are increasingly using SIM hijacking attacks to take control of victims’ phone numbers, allowing them to intercept one-time passwords, reset account credentials and access crypto exchange accounts within minutes.
The losses highlight a widening security challenge for Kenya, one of Africa’s most advanced digital economies, where mobile connectivity has become the foundation of financial transactions ranging from mobile money and online banking to cryptocurrency trading.
For millions of Kenyans, a phone number has become the digital key linking multiple financial services. That convenience has also made SIM cards attractive targets for criminals who exploit weaknesses in identity verification systems operated by telecom providers.
In a SIM-swap attack, fraudsters convince a mobile operator to transfer a victim’s number to a new SIM card under their control. Once the transfer is completed, security messages and authentication codes sent through SMS are redirected to the attacker, giving them access to accounts tied to the number.
The method is relatively inexpensive compared with traditional cyberattacks and often remains unnoticed until funds have already been moved.
Crypto Growth Creates New Fraud Front
Kenya’s expanding cryptocurrency market has created a lucrative target for digital criminals. As more investors entered the sector after 2020, attackers increasingly moved away from attempting to compromise crypto wallets and instead focused on exploiting gaps in identity verification and customer authentication.
Authorities have intensified efforts against SIM-swap networks, with several arrests reported in 2026.
In June, detectives arrested a suspect linked to a SIM-hijacking operation that allegedly stole more than KSh450,000 from a victim. A month later, another investigation resulted in the arrest of eight suspects accused of involvement in a KSh1.2 million M-Pesa SIM-swap fraud scheme.
The cases reflect a broader trend across Africa, where the rapid expansion of digital payments has created new opportunities for financial crime.
Court Raises Pressure on Banks and Telecom Firms
Kenya’s financial and telecommunications sectors are also facing increased scrutiny over their responsibility to prevent such attacks.
In June 2026, the High Court ruled that Safaricom and Diamond Trust Bank (DTB) were jointly liable for a customer’s KSh4.4 million loss after criminals gained access through a SIM hijacking incident.
The decision reinforced the principle that telecom operators and financial institutions have a duty to protect customers against foreseeable security threats, even when fraudsters operate outside their direct networks.
The ruling is expected to influence how banks and mobile operators approach customer authentication, fraud monitoring and digital security investments.
SMS Security Model Faces Growing Questions
The latest losses underline a major shift in cybersecurity: protecting digital assets is no longer only about securing passwords or encryption systems.
A mobile phone number now serves as an entry point to bank accounts, mobile wallets, email services and cryptocurrency platforms. As digital finance expands, regulators and companies are under pressure to move beyond SMS-based verification, which remains vulnerable to SIM-swap attacks.
For users, security experts increasingly recommend stronger authentication methods, including authentication applications and hardware-based security tools, to reduce dependence on phone numbers.
Kenya’s experience shows the next battle in digital finance may not be fought inside blockchain networks, but around the systems that determine who controls access to them.
