How Identity Fraud Happens in Kenya & How to Protect Yourself

When many Kenyans hear of the term identity theft, the first instinct is that an institution - a bank, a government agency, or a telco has had a system breach. But more often than not, identity fraud starts closer to home — with our everyday online habits.

Take the example of Amani, an influencer in Nairobi. Excited about her first international trip, she posted a photo of her ticket on Instagram — complete with all the details visible. Unbeknownst to her, one of her followers used the details to access the airline’s booking system and made changes to her reservation.

And that’s just one way things can go wrong when our personal data is easily available online

In another all-too-possible scenario, imagine someone who regularly shares “soft life” content — spa days, brunches, online shopping. Over time, without realising it, they post both sides of their debit card: the front during a flashy unboxing, and the back weeks later while showing off a shopping receipt. A scammer doesn’t need much more than that. Just a little patience, and they can piece it together — and clear the account before the victim even notices.

In all these cases, the first instinct is always that there is a systematic problem somewhere. But the biggest cause is not really the systems but fraudsters who rely more on human error than high-tech hacking.

What Is Identity Fraud?

Identity fraud happens when someone uses your personal data — like an ID number, KRA PIN, mobile number, or login credentials — to impersonate you, steal from you, or commit crimes in your name.

It often begins when we overshare without thinking: trusting an app too quickly, forgetting to delete a file at the cyber cafe, or casually dropping sensitive info on social media.

How It Happens

1. Free Apps with Hidden Agendas
   Many “free” apps ask for permissions they don’t really need — like a photo editing App having access to your messages or contacts. Once granted, they quietly collect and resell your personal data.  Many people have never checked what access their apps have. You might be shocked to find an old photo app still reading your messages.
2. Cyber Cafés and Public Computers
   You scan your ID, apply for a job, or log onto eCitizen, then forget to delete your file. The next user might be a scammer.
3. Posting Sensitive Info Online
   Birthday shoutouts, holiday plans, bank cards, or even ticket barcodes — all these details can be weaponised by someone with bad intentions.
4. Public Wi-Fi, and Free Promotions
   Many popular betting platforms, giveaways, or "survey" apps ask for sensitive data like your ID number or phone number for “verification.” Meanwhile, free public Wi-Fi — from matatu stages to cafés — exposes you to hackers intercepting your information as you browse or transact.
5. Public Meetings, Office Lobbies, and Event Sign-Ins
   Whether it is signing in at a government office, a building reception, or an event registration desk, many Kenyans give out full names, phone numbers, ID numbers, and emails without thinking twice. That information often sits in unsecured files and can be copied or photographed in seconds.

How to Protect Yourself Against Identity Fraud

You don’t need to be a tech expert to stay safe online — just smart habits and a bit of caution. Here’s how to take back control:

1. Pause Before You Share

Before you fill out a form, sign up on a website, or hand over your ID or KRA PIN — pause. Ask yourself: “Is this really necessary?” 

If you’re applying for a job, shopping online, or entering a raffle — does that organisation genuinely need all that information? Many fraud cases start with oversharing.

2. Limit App Permissions

Many apps — including photo editors, loan apps, and games — ask for access they don’t need. 

Take a few minutes today and:

• Go to your phone settings
• Open “App Permissions”
• Revoke access to your contacts, messages, microphone, or camera for apps that shouldn’t need them. This one action could block scammers from accessing the personal data they use to impersonate you.
  
  

3. Think Twice Before You Post

Your social media might be giving fraudsters more than you think:

• Posting your boarding pass? Someone can scan it and access your flight details.
• Birthday shoutouts? That could be part of your password or security question.
• A humblebrag with your new Visa card? A scammer just needs a second post with the back to use it. Before you share, ask: “Could someone misuse this info?”
  

4. Delete Files After Use

Scanned ID, payslip, NHIF card, or application letters — these are goldmines for scammers. 

Whether you used a cyber café, a friend's computer, or borrowed a phone, always delete files and log out when you’re done. Better still, carry a flash disk and scan your documents on your own device.

5. Know and Use Your Rights

Under the Data Protection Act, you have legal rights in Kenya:

• You can ask any organisation what personal data they hold about you
• You can demand correction or even deletion

If your data is misused, you can report it to the Office of the Data Protection Commissioner (ODPC). Your data is your property — don’t let anyone treat it like theirs.