By 
The Directorate of Criminal Investigations (DCI) has warned Kenyans that the cash stacks, hired luxury cars and trading dashboards flaunted on social media can be bait for fraud, in an advisory aimed at what it called "Masharp Boys/Girls." The alert, issued on Monday, September 28, comes as official data show investment, forex and crypto schemes among the most frequently reported forms of online fraud in the country, and as regulators prepare for a November 4 deadline that will require crypto firms serving Kenyans to hold a licence.
What the DCI said
The statement, posted on the agency's X account in an informal mix of English and Sheng, described an online ecosystem built around forex trading, cryptocurrency, arbitrage, sure-bet betting, Telegram signals and the US dollar as the ultimate status symbol. The DCI said the lifestyle on display (premium drinks, nights out, international trips, cash stacks and luxury vehicles, many of them hired) is often used to sell an image of success.
The agency said some of that flex sits on top of fake investment platforms, phishing links, counterfeit cryptocurrency wallets, identity fraud, deepfakes and other forms of social engineering. It described trading dashboards showing "phantom profit," and warned that participants in fraudulent schemes face serious legal consequences under cybercrime and fraud laws. Its closing line summed up the message: "Easy money, easy go. Plus lifetime dire consequences."
The alert is a public advisory, not an enforcement announcement. It names no individual or company, reports no arrests and gives no loss figures.
What the data says about the rise
The National Computer and Cybercrimes Coordination Committee (NC4) presented an analysis of reported computer fraud cases for February to July 2026 at its 36th meeting, chaired by Principal Secretary Raymond Omollo. Of 102 cases, investment and forex schemes accounted for 16 (15.7%) and cryptocurrency scams for 12 (11.8%), making investment-type fraud the second largest category after mobile money fraud. Seventy of the 102 cases (68.6%) were logged between May and July, with July the busiest month at 27. The sample is small and reflects reported cases only, so it shows what was reported to authorities rather than the full scale of losses. The committee said it would focus intelligence work on investment, forex and crypto schemes.
The Capital Markets Authority (CMA) has issued a string of warnings this year. In a May 8 investor alert it directed unlicensed online forex brokers and money managers to stop operating and onboarding Kenyan investors, and said victims of unlicensed firms have little recourse. On July 24 it warned that fraudsters were impersonating licensed firms on social media and fake websites. In a notice dated September 11 it named 15 entities, including CBEX and QVSE, as operating unlawfully, and said they were under DCI investigation.
Earlier in the year, Interpol's Operation Red Card 2.0 (December 8, 2025 to January 30, 2026) led to 27 arrests in Kenya linked to fake investment schemes promoted through messaging apps and social media, according to Interpol.
Scale is also visible on the crypto side. Chainalysis estimated that Kenya received about $19 billion in crypto inflows between July 2024 and June 2025, second in East Africa by transaction value behind Ethiopia, as reported by TechCabal.
How the schemes work
The pattern described by the DCI, Interpol and victims is consistent. Interpol said the Kenyan schemes it targeted used messaging apps, social media and fictitious testimonials, with victims lured by initial deposits as low as $50 (about KES 6,500). Victims were shown fabricated account statements or dashboards, and withdrawal requests were then blocked.
The low entry point matters. A young person with a smartphone and a few thousand shillings on M-Pesa can be onboarded within minutes, and mobile money was involved in 51 of the 102 fraud cases NC4 reviewed, whether as the payment channel or the destination for stolen funds.
Referral incentives amplify the spread. In the CBEX collapse of April 2025, which the Nigerian Economic and Financial Crimes Commission (EFCC) linked to losses of more than $840 million across Nigeria, Kenya and Egypt, early users reportedly received payouts and were encouraged to recruit others, and some were required to refer new members to access profits. A Kenyan government worker told AFP he first encountered CBEX on Telegram, lost roughly KES 2.1 million (about $16,000), mostly borrowed from a bank, and that another investor had introduced 25 relatives and friends to the platform. Once a scheme collapses, victims are often approached again by supposed recovery agents, which AFP's Kenyan interviewee also described.
The economic backdrop
Officials and analysts have linked the appeal of such schemes to the job market, though the DCI alert itself does not make that argument. World Bank modelled estimates put Kenya's youth unemployment rate (ages 15 to 24) at 15.25% in 2025, against an overall rate of about 5% in 2024. Those headline figures understate the pressure on young workers. A 2026 labour market report from Work.ke, drawing on KNBS Economic Survey 2025 and ILO estimates, said roughly 90% of the 782,300 new jobs created in 2024 were informal, and that nearly one in three young Kenyans is estimated to be not in employment, education or training.
Commentary on the CBEX collapse attributed its spread to a mix of high unemployment and inflation, distrust of banks and low financial literacy, alongside aggressive digital marketing. That is one outlet's reading rather than a measured finding, and there is no public study that isolates economic hardship as the cause of participation in these schemes.
Who is losing money
The premise that victims are mostly unemployed young people is plausible but not yet documented. No regulator or law enforcement agency has published an age or employment breakdown of investment-fraud victims in Kenya.
What is on the record points to a wider group. The DCI's alert focuses on young people drawn to the lifestyle content, and its warning that "others drag people down with them" suggests some participants become recruiters. But the victims who have spoken publicly about CBEX include a government employee, a finance professional who told TUKO she had invested over KES 1 million, and investors who said they were introduced through colleagues and friends. A 2024 study by the National Crime Research Centre on ICT crimes, based on respondent perceptions across all cybercrime types rather than investment fraud specifically, listed offenders as predominantly youths (50.1%) and victims as including the elderly (39.4%), the uninformed (28.2%) and major business players (21.0%).
The picture that emerges is of young people as a prime audience and, in some cases, as promoters, and of victims across age and income groups whose losses are often financed by loans. Confirming who bears most of the losses would require case-level data from the DCI, the CMA or the NC4.
The credibility question
The DCI issues its advisory at a time of strained public confidence in the agency. Human Rights Watch's World Report 2026 said plain-clothed security forces reportedly abducted and forcibly disappeared people suspected of organising or supporting protests, and described the June 2025 arrest by DCI officers of blogger Albert Ojwang, who died in custody. Interior Cabinet Secretary Kipchumba Murkomen told the Senate in April that 206 Kenyans remained unaccounted for since 2022, said some alleged abductions had been staged, and cited a new anti-abduction unit within the DCI. The DCI itself concluded in April that former Cabinet Secretary Raphael Tuju's reported abduction was staged. The scam advisory does not refer to any of these matters.
What the law now covers
Contrary to the idea of an unregulated market, Kenya now has a licensing framework for crypto businesses, though it is new and largely untested. The Virtual Asset Service Providers (VASP) Act, 2025 took effect on November 4, 2025, designating the CBK and the CMA as regulators. The CBK and CMA said at the time that no VASPs had been licensed pending implementing regulations. The National Treasury gazetted the VASP Regulations, 2026 (Legal Notice No. 134) in July, creating ten licence categories, and existing providers have until November 4, 2026 to comply, according to Cytonn and legal commentary. Online forex trading has been licensed by the CMA under the Capital Markets (Online Foreign Exchange Trading) Regulations, 2017.
Licensing does not by itself stop unlicensed operators, particularly offshore ones or those working through Telegram and WhatsApp groups. The CMA has said that dealing with unlicensed entities means "no license equals no accountability," and Nairobi law firm Njogu Associates has noted that a regulator's warning cannot reverse a completed transfer or compel a foreign shell company to refund victims. The DCI and CMA both advise the public to check a firm's licence status on the CMA's online register before sending money.
Comments