- Singapore, the UK and Australia offer lessons in tackling rising cyber fraud.
- Stronger bank coordination and real-time transaction monitoring could help prevent losses.
- Clearer reimbursement rules and faster responses could strengthen customer protection in Kenya.
Kenya’s banks lost approximately Ksh1.59 billion to reported fraud in 2024, yet other countries show that coordinated action can limit such losses. Singapore, the United Kingdom (UK) and Australia have recovered or prevented billions through shared responsibility and cooperation across sectors, although none has eliminated fraud.
Their experience nevertheless offers practical lessons for Kenya. Cybercrime can be mitigated through coordinated action involving banks, telecommunications companies, regulators, law enforcement and consumers.
Singapore has established specialised anti-scam policing and intervention mechanisms involving financial institutions and other partners. In 2024, its Anti-Scam Command and partners recovered more than S$182 million in scam losses and prevented at least another S$483 million through proactive interventions with victims.
At an illustrative exchange rate of S$1 to Ksh100, the averted losses would be approximately Ksh48.3 billion, while the recovered amount would be about Ksh18.2 billion. These are approximate conversions, not figures reported by Singaporean authorities.
Singapore’s experience is relevant to Kenya because it shows the importance of acting before a fraudulent transaction is completed. A warning delivered after a victim has transferred money may be too late, especially when criminals quickly move funds between accounts. Kenyan banks could strengthen similar interventions by detecting high-risk transfers, contacting customers to verify suspicious instructions and coordinating rapidly with receiving institutions.
READ:
World Potato Congress opens in Kenya with call for investors
Meanwhile, the UK has strengthened financial institutions’ responsibility for preventing authorised push-payment fraud, in which victims are deceived into transferring money to criminals. Under rules introduced in October 2024, eligible victims can receive reimbursement of up to £85,000, subject to conditions and exceptions. The framework places responsibilities on sending and receiving payment service providers, encouraging them to improve fraud detection and cooperate in preventing losses.
UK Finance reported that criminals stole approximately £1.17 billion through authorised and unauthorised fraud in 2024. Banks also prevented £1.45 billion in unauthorised fraud, equivalent to approximately Ksh240.7 billion at an illustrative exchange rate of £1 to Ksh166. This represents fraud prevented, not money recovered, and the UK still experiences substantial fraud.
For Kenya, the lesson is that banks should not focus only on whether a customer entered the correct PIN. They should also examine whether a transaction displayed warning signs that could reasonably have triggered additional checks. Clearer rules on investigating disputed transfers and allocating responsibility where a bank fails to meet security obligations could also help.
Australia has pursued a coordinated approach involving financial institutions, telecommunications providers, regulators and law enforcement. A 2025 analysis published by Westpac, drawing on a BDO comparison, reported that Australia’s scam losses were down 52 per cent in 2024. This is a reported comparison from a bank-sponsored analysis, rather than a universal measure of cybercrime.
This experience suggests that banks cannot tackle fraud in isolation. A criminal may obtain a victim’s telephone number, send a deceptive message, impersonate a trusted person and then persuade the victim to transfer money. Preventing the final transfer may therefore require telecommunications companies, digital platforms and banks working together. Stronger mechanisms for identifying fraudulent numbers, reporting suspicious messages and sharing threat intelligence could help Kenya.
Experience in these countries points to several practical measures. First, banks should detect suspicious transfers in real time by monitoring unusual transactions, new beneficiaries, unfamiliar devices and sudden changes in customer behaviour. High-risk transfers should trigger additional checks.
Second, banks should introduce stronger authentication. Multi-factor authentication and secure device registration can reduce account takeovers, while SMS one-time passwords alone may not suffice against SIM swaps or social engineering. In addition, customers should receive immediate alerts on significant transactions, new device registrations and security setting changes.
Banks should also maintain round-the-clock emergency support and act quickly when fraud is reported. They should preserve transaction records, investigate complaints and urgently contact receiving institutions to trace or freeze stolen funds. Finally, complaint handling should be transparent, with case reference numbers and clear escalation routes.
ALSO READ:
Banks cannot eliminate every scam, particularly when criminals manipulate victims into authorising transactions. Customers must therefore remain alert. They should never disclose PINs, passwords or one-time codes to callers or people contacting them through SMS, email or WhatsApp, and should avoid suspicious links.
Unexpected requests for money should be independently verified, even when a caller sounds like a relative, employer or bank employee. Artificial intelligence (AI) can imitate familiar voices, making a separate verification channel essential. Customers should also use strong, unique passwords, enable multi-factor authentication and review statements regularly.
The growing impact of cybercrime raises a difficult question: who should bear the loss when a criminal steals money from a bank account? Customers must protect their credentials and report suspicious activity. Banks must maintain security controls, monitor transactions and respond effectively to warnings. A fair framework should weigh each case’s circumstances, the evidence, the customer’s actions and the bank’s security measures.
Singapore’s shared-responsibility approach and the UK’s reimbursement framework show how governments can set clearer expectations for financial institutions. Any Kenyan framework would need to reflect local banking practices and legal requirements. Furthermore, the Central Bank of Kenya and other authorities have a role in promoting fraud prevention, supervising institutions and ensuring accessible complaint channels.
Regional cooperation is equally important. Criminals may operate in one country, contact victims in another and move stolen money through accounts elsewhere. Banks, telecommunications providers and law enforcement need effective channels for sharing information.
Ultimately, Kenya’s priority should be to combine stronger bank security, rapid fraud response, effective regulation and public awareness. Banks must make it harder for criminals to access accounts and move stolen money, while telecommunications companies must help disrupt fraudulent communications. The true test of digital banking will be how confidently people can use it, knowing their money is protected by effective security and meaningful avenues for redress.
By Hillary Muhalya
Get more stories from our website: Sacco Review.
For comments and clarifications, write to: Saccoreview@
Kindly follow us via our social media pages on Facebook: Sacco Review Newspaper for timely updates
Stay ahead of the pack! Grab the latest Sacco Review newspaper!
