INTERPOL's 2026 Report: AI Now Powers 55% of African Cybercrime. Kenya Is in the Firing Line.

Africa's cybercrime problem is no longer a series of isolated incidents. It is an industrialised, borderless ecosystem, and artificial intelligence is now automating every stage of an attack. That is the headline finding from INTERPOL's African Cyberthreat Assessment Report 2026, a 40-page document built on survey data from 36 African member countries, released on 3 August 2026 in Lyon.

For Kenya, the numbers carry a specific gravity. East Africa — Kenya included — is now flagged in the report as a hub for mobile money fraud and infrastructure-targeted ransomware. That is the worst possible combination for an economy where mobile money transactions run into the trillions of shillings per year, and where critical infrastructure (banks, telcos, the national grid, county governments) has spent the last two years digitising at a pace that the cyber defences have not matched.

The financial toll tells the story. African cybercrime-related losses more than doubled in 12 months, rising from USD 192 million to USD 484 million. The number of confirmed victims rose from 35,000 to 87,000 over the same period. The drivers are AI-enabled scams, credential harvesting, and automated social engineering campaigns at a scale no individual fraudster could have mounted five years ago.

The five shifts the report documents

1. AI is the engine, not the accessory. Fifty-five per cent of reported African cybercrimes now involve AI. That includes AI-generated phishing emails that mimic executive tone and internal jargon with near-perfect fidelity, AI-driven reconnaissance that maps corporate networks in hours instead of weeks, and AI-assisted extortion tooling that customises ransom demands per victim.

2. East Africa is a target zone. The report identifies mobile money fraud and infrastructure-targeted ransomware as the dominant East African threat pattern. The combination matters because M-Pesa, Airtel Money, and similar platforms are now foundational infrastructure, not just consumer products. A successful ransomware attack against a major telco or bank disrupts a payments rail that tens of millions of Kenyans rely on daily.

3. Synthetic identity fraud has arrived. The most consequential shift is the rise of synthetic identities. Criminals now combine real personal data harvested from data breaches with fabricated elements (phone numbers, addresses, employment records, even biometric spoofing) to create entirely new personas. These AI-generated identities have been used to open bank accounts, secure mobile loans, and register SIM cards under false names. The danger is that they can bypass advanced biometric verification systems because the underlying identity looks plausible from every angle.

4. The human cost has exploded. Approximately 600,000 digital sextortion cases tied to AI deepfakes and synthetic media were recorded across the continent in 2025. That is the human cost, measured in millions of individual victims, not in percentages.

5. The legislative response is fragmented. In 2025, 17 African countries enacted or amended cybercrime legislation. Kenya's own Computer Misuse and Cybercrimes Act (CMCA) was reviewed, and the Communications Authority has been tightening customer identification rules at cyber cafés (effective 14 August 2026). But the gap between digital adoption and cyber resilience continues to widen. INTERPOL's Director of Cybercrime, Neal Jetton, put it bluntly: "Cybercrime has emerged as one of the most significant criminal threats to the region. AI is automating every stage of a cyberattack."

What this means for Kenyan founders, fintech operators, and CISOs

For Kenyan fintech and mobile money operators, the report is a five-alarm fire and an opportunity in equal measure. The threat surface is now AI-driven, AI-scaled, and AI-targeted. Perimeter defences that worked against human attackers are no longer sufficient. The specific risks fall into four audiences:

For CISOs and security leaders: AI-driven attacks require AI-driven detection. Traditional rule-based security information and event management (SIEM) platforms are not designed to spot synthetic identities in real time. Kenya's larger banks and telcos should be piloting AI-enabled fraud detection now — not because it is fashionable, but because the report explicitly identifies the absence of real-time, inter-agency data sharing between banks, telecoms, and law enforcement as a dangerous blind spot. That blind spot is being actively exploited.

For fintech founders and startup operators: The synthetic identity fraud vector is the one that should reshape your onboarding stack. If your KYC flow relies on document verification alone, you are now in scope. The report describes AI-generated digital personas that can pass biometric verification. The counter-measure is layered verification: document + behavioural + device + network signals. Anything less is now table stakes for a fraudster with access to a large language model and a stolen credential database.

For investors and venture capital: Cybersecurity for African fintech is no longer a compliance line item — it is a moat. The founders building AI-driven fraud detection, synthetic identity screening, and inter-bank threat intelligence sharing for the African market are working in the most consequential category of the decade. Watch for the Series A rounds in African AI cybersecurity startups in the next 12 to 18 months.

For Kenyan and East African regulators: The fragmented legislative response is the report's quiet warning. Seventeen countries updated their cybercrime laws in 2025, but the report finds that "cybercrime legislation across the continent is inconsistent." That inconsistency is the attacker's advantage. Kenya has the most developed cyber law framework in East Africa, but the report's emphasis on East Africa as a mobile money fraud hub means Kenyan regulators should be leading the regional conversation on cross-border data sharing and AI-enabled fraud enforcement.

The fundamental asymmetry

The deepest finding in the INTERPOL report is not a number. It is a structural imbalance. Criminals deploy AI at machine speed. The institutions meant to stop them are still figuring out how to use AI at all. The report calls for standardised digital forensic capabilities, enhanced cross-border cooperation, investment in AI literacy among law enforcement officers, and formal public-private partnerships.

Four high-impact operations coordinated by INTERPOL in 2025 — Serengeti 2.0, Contender 3.0, Sentinel, and Red Card 2.0 — collectively led to more than 1,500 arrests and the recovery of over USD 100 million. These are real wins, and they matter. But the report is honest about the scale of the problem they highlight: the industrialisation of cybercrime, powered by AI, is outpacing the capacity of African law enforcement to respond.

For Kenya, the path forward is clear in concept and hard in execution. AI-enabled fraud detection at the telco and bank level. Cross-bank, cross-telco, cross-border data sharing on confirmed fraud signals. KYC stacks that can detect synthetic identities. And an honest reckoning with the fact that the defensive AI arms race has already started, and most Kenyan institutions have not yet entered it.

Sources

• INTERPOL. "INTERPOL report finds AI linked to more than half of cybercrime in Africa." 3 August 2026.


• INTERPOL. African Cyberthreat Assessment Report 2026. 40-page survey-based report, 36 member countries.


• WeeTracker. "AI Turns African Cybercrime Into USD 484M Industrial-Scale Machine." 14 August 2026.


• Communications Authority of Kenya. Customer identification rules for cyber cafés, effective 14 August 2026.