Nairobi Residents' Photos Stolen to Create Fake Loan Accounts

Mary W., a 34-year-old vegetable trader at Gikomba Market, found out in May that her National ID photograph had been lifted and pasted onto a mobile lending app profile in her name. She had never downloaded the app. By the time she reported the matter to the Directorate of Criminal Investigations office on Kiambu Road, three Fuliza transactions totalling Ksh 47,000 had already been flagged against her credit file with Metropol CRB.

Her story is not isolated. Community health volunteers, boda boda operators and market traders across Nairobi's high-density neighbourhoods are increasingly raising alarms about what digital rights advocates are calling a "duplicate image crisis", the systematic scraping and reuse of government-issued ID photos, social media profile pictures and Huduma Namba registration images for fraudulent digital identities. The problem has sharpened in 2026 as Kenya's expanding digital finance ecosystem collides with weak enforcement of the Data Protection Act, which came into force in November 2019 but whose implementing regulations remain partially unenforced.

Ground-Level Anger in Mathare and Eastleigh

Walk through Section Three in Mathare on a Saturday morning and the frustration is immediate. Residents there say they first became aware of the problem in late 2025, when a local savings and credit cooperative, the Mathare Community Sacco registered along Juja Road, began receiving queries from members whose photographs had appeared on fraudulent guarantor forms for digital loans from at least two fintech platforms operating out of Karen. "People here have nothing to put up as collateral. Their face is all they have in this system," one Sacco official told The Daily Nairobi, speaking on condition of anonymity because an investigation is ongoing.

In Eastleigh's Section Four, where the density of mobile money agents is among the highest in any Nairobi neighbourhood, a paralegal working with the legal aid organisation Kituo cha Sheria said her caseload involving photo duplication complaints tripled between January and June 2026. She described one recurring pattern: photographs originally submitted to the National Registration Bureau being re-scraped from government e-citizen portal thumbnails and reused in Know Your Customer bypass schemes. Kituo cha Sheria filed a formal complaint with the Office of the Data Protection Commissioner on April 17, citing at least 23 documented individual cases from Eastleigh and Kibera alone.

Down in Kibera's Soweto East village, a youth-led civic tech group called Sauti Digital, which operates out of a converted shipping container near the Olympic Primary School junction, has been running digital literacy sessions since February. Volunteers there say they see five to eight new cases of image misuse every week during their Saturday drop-in clinics. The group has documented that most victims are women aged 25-45, many of whom submitted biometric data during the Huduma Namba mass registration exercise that ran between 2019 and 2021.

What the Numbers Show, and What Comes Next

Kenya's Data Protection Commissioner received 1,847 formal complaints in the 2024-2025 financial year, a 61 percent increase over the prior year, according to the office's annual report published in March 2026. Analysts at iHub, the Ngong Road-based tech research and co-working space, estimate that fewer than 12 percent of those complaints resulted in any enforceable action against a company. Maximum penalties under the Act stand at Ksh 5 million or one percent of annual turnover, figures that advocates say are too low to deter large fintech operators.

The Communications Authority of Kenya held a stakeholder forum at the Kenya School of Government in Upperhill on June 18, where it signalled a review of digital onboarding standards for licensed lenders. A new directive, expected before September 30, would require all licensed digital credit providers to implement liveness-detection verification, meaning a static photograph alone would be legally insufficient for account creation.

For Mary W. at Gikomba Market, bureaucratic timelines feel remote. She has spent Ksh 3,200 on transport and lost four trading days since May trying to clear her credit record. Her advice to neighbours is blunt: check your Metropol or TransUnion credit report now, a standard consumer report costs Ksh 650 online, and file a complaint with the Data Protection Commissioner's portal before the fraud compounds. The window to dispute fraudulent entries, she learned the hard way, closes faster than anyone tells you.