Nairobi Residents Discover Photos Stolen for Fraudulent Loan Applications

A woman in Mathare North says she discovered last March that her photograph had been used in at least three mobile loan applications she never filed. A boda boda operator in Kawangware found his face on a fake M-Pesa agent registration. Neither of them reported it immediately, because neither of them knew who to call.

Duplicate image fraud, the practice of copying personal photographs from social media profiles, ID documents and digital onboarding forms and repurposing them in fraudulent registrations, is surfacing with fresh urgency across Nairobi's lower-income neighbourhoods. The issue has drawn renewed attention partly because of the rapid expansion of digital financial services under Kenya's ongoing IMF-backed fiscal programme, which has pushed more Kenyans onto formal mobile platforms while enforcement infrastructure has lagged behind adoption rates.

For residents already navigating tight household budgets and the legacy distrust of government institutions sharpened by the 2023 Gen Z tax protests, discovering that your face has been commercially stolen carries a particular sting. It is not just a privacy violation. It can crater a credit score, generate debt collectors and, in some cases, flag an individual to law enforcement for fraud they did not commit.

Where It Hits Hardest

The complaints are clustering in specific parts of the city. In Korogocho, near the Outer Ring Road junction, community paralegals at the Pamoja Trust office say they have logged an uptick in residents presenting with confusing loan default notices since January 2026. Pamoja Trust, which works on informal settlement upgrading across Nairobi, began tracking the pattern after caseworkers noticed repeating descriptions: a photograph taken during a Huduma Centre registration or a digital wallet sign-up, later appearing on a fraudulent account.

In Kibera, volunteers with the Muungano wa Wanavijiji network, a federation of slum dwellers active since the 1990s, describe a parallel problem tied to WhatsApp profile pictures. Residents who set public or semi-public profile images say those photographs are being screenshotted and submitted to quick-loan apps that use minimal KYC, or Know Your Customer, verification. The apps, several of which operate outside the Central Bank of Kenya's licensed digital lender list published in October 2023, require only a face image and a national ID number to disburse loans of between Ksh 500 and Ksh 5,000.

Community members say the asymmetry is maddening. The fraud takes minutes. Clearing it can take months.

The Evidence Gap

Kenya's Data Protection Act came into force in 2019, and the Office of the Data Protection Commissioner has processed complaints since 2021, but residents in these neighbourhoods consistently say they do not know the office exists or how to reach it. The commissioner's offices are located on Upperhill Road, a significant distance, financially and psychologically, from Mathare or Korogocho. Filing a formal complaint requires documentation that informal workers often cannot easily produce.

The Central Bank of Kenya, in its December 2025 digital credit market report, noted that unlicensed lending platforms continued to operate via third-party app distribution channels despite regulatory action taken against several firms in 2024. That report did not specifically quantify image fraud, but consumer advocates say the two phenomena are directly linked: lax biometric verification on unlicensed apps creates the exact conditions that make stolen photographs viable credentials.

Digital rights researchers at the Kenya ICT Action Network, known as KICTANet and based in Westlands, have been calling for mandatory liveness detection, a facial movement test that confirms a submitted image is a live person, not a static photograph, across all digital lending platforms. South Africa's Financial Sector Conduct Authority mandated similar standards for regulated lenders in 2024, and advocates here argue Kenya's CBK should follow.

For residents in the meantime, the practical options are limited but real. Setting WhatsApp profile pictures to contacts-only costs nothing and removes the easiest source of image theft. Checking the CBK's published register of licensed digital credit providers before using any loan app takes under two minutes. And logging complaints with the Data Protection Commissioner, whose online portal accepts submissions at odpc.go.ke, creates a paper trail that has, in documented cases, helped individuals dispute fraudulent debt records.

None of that addresses the deeper problem. But for the woman in Mathare North, it is somewhere to start.