Part 2 of an ongoing series of reflections following Ficha Uchi Phase 4

This is the 2nd in a series of reflections from Ficha Uchi’s fourth phase, From Awareness to Action. Across our engagements in Lamu, Tana River, Taita Taveta and Kilifi, one key issue keeps surfacing: the growing circulation and exploitation of personal data. The issue is not unique to Kenya; these issues are reshaping the landscape of financial fraud, identity theft, profiling, manipulation, and digital exploitation. The question, therefore, is no longer simply how much people know about protecting their data, but how we confront a world where knowing someone’s personal information can mean knowing precisely how to deceive them.

The global and regional picture: Profiling and impersonation are costing people billions

Impersonation fraud is a growing global concern, with US consumers losing US$3.5 billion in 2025 to scammers posing as trusted individuals, businesses and institutions according to the Federal Trade Commission report. Criminals exploit personal information, trust and fear to create convincing scams, while AI makes fake messages, images, audio and videos increasingly realistic.

These threats are further compounded by the widespread collection, sharing and misuse of personal data, often without adequate safeguards. A September 2026 Swansea University study found that 86% of 624 UK-licensed gambling websites audited potentially breached data protection requirements. Many collected personal information before obtaining consent and shared identifiers with third-party marketing platforms. 

The risks of personal data misuse are also evident in cases of impersonation and identity theft in the United States. Under Operation Ghostbusters, the Department of Justice announced charges alleging that criminal networks used stolen identities to submit fraudulent student aid applications and divert financial aid. Some alleged networks involved Kenyan nationals. Similarly, in October 2026, the FBI attributed the theft of more than US$6 billion in cryptocurrency from Binance to North Korean actors through identity theft. These attacks often involve social engineering, fake recruiters and investors, phishing and compromised credentials, underscoring the importance of strong passwords, multi-factor authentication and caution when sharing personal information online.

Beyond the immediate financial losses, these crimes can have lasting consequences for victims, including fraudulent records, reputational damage and the burden of proving that their identities have been stolen or misused. These cases demonstrate that the growing threat to personal data extends beyond breaches and unauthorised access. Profiling, when combined with AI, interconnected digital platforms and weak data governance, can expose individuals to manipulation, impersonation, financial exploitation and discrimination. As technology makes it easier to collect, analyse and weaponise personal information, data protection must evolve from simply safeguarding information to protecting people’s privacy, dignity and autonomy.

Profiling and Identity Theft in Africa

Across Africa, fraud is becoming increasingly organised, targeted and identity-driven, with personal data playing a growing role in how criminals identify and exploit their victims. TransUnion’s 2026 fraud trends report found that Kenya had the highest median consumer fraud loss among surveyed countries (Namibia, Rwanda, South Africa and Zambia). The report further highlights the growing use of impersonation, account takeover and social engineering. The scale of this threat is further underscored by INTERPOL’s Operation Red Card, which resulted in more than 650 arrests across Africa. In Kenya, arrests were linked to fake investment schemes that used fabricated account statements and dashboards to deceive victims, alongside cases involving phishing, identity theft and fraudulent digital investment platforms.

At the heart of these crimes is the exploitation of personal information, digital identities and online behaviour for financial gain, often with serious consequences for individuals and communities. Information shared across digital platforms, including names, phone numbers, photographs, locations, financial details and personal interests, can be pieced together to build detailed profiles of individuals. Once these profiles are established, they can become powerful tools for further exploitation. Criminals may use them to impersonate trusted people or institutions, manipulate victims into revealing sensitive information, facilitate identity theft or carry out targeted financial scams. This demonstrates how profiling, impersonation and identity theft are interconnected, with each potentially reinforcing the other and making individuals increasingly vulnerable to digital exploitation.

Back at home: How Scammers Know More About You Than You Think

The Ficha Uchi campaign has taken data protection conversations beyond Mombasa and Kwale to Lamu, Tana River, Taita Taveta and Kilifi. In discussion with TVET learners and community participants alike, a question kept surfacing: how does my personal data end up in the hands of strangers who seemed to know so much about me? How are they able to fool and manipulate me into falling for scams? Participants likewise raised deeper questions about how to identify perpetrators, reclaim control over compromised personal data, and seek redress when their personal data is violated. This reveals a critical but often overlooked dimension of data protection where personal data can be weaponised to manufacture trust, influence behaviour, and exploit human vulnerability.

This is what profiling looks like. Scammers collect and analyse information about individuals to identify patterns and predict their behaviour, interests, financial circumstances, vulnerabilities or preferences. Such information can be  used to monitor people’s online activities, anticipate their behaviour and target them with personalised advertisements or fraudulent messages. Criminals can also piece together personal information to impersonate individuals, gain access to their accounts and manipulate them by exploiting their financial circumstances, relationships, fears or personal needs.

Scammers may gather information about people before approaching them. They can use publicly available photographs, social media posts, family connections, business details or information shared in previous interactions to create a believable story. Some impersonate people the victim knows, while others pose as officials, service providers, business partners or people offering assistance.

In some cases, fraudsters create fake online profiles using other people’s photographs and videos. In others, they build confidence gradually, learning about a person’s circumstances before requesting money, identification documents, account details or other personal information.

This is particularly dangerous when the target is an older person, someone facing financial difficulties or anyone in a vulnerable situation. A person seeking help may be more willing to trust someone who appears to understand their circumstances.

During the Lamu session, students identified identity theft and the deliberate targeting of vulnerable individuals as factors that make people more susceptible to scams. Similar concerns emerged in Taita Taveta, where students highlighted how scammers use fake profiles, as well as other people’s photographs and videos, to deceive unsuspecting individuals. During a community data protection session in Taita Taveta town, an elderly man shared how he lost KES 7,500 to individuals posing as health workers. He had been seeking assistance to find a doctor and arrange surgery for his leg, but those he believed would help him instead took advantage of his situation.

The information we share casually can become part of a much bigger picture in the wrong hands. A photograph, a phone number, an identification document or a social media post may seem harmless on its own. Combined with other details, however, it can help a fraudster construct a convincing identity or make a fraudulent request appear legitimate. This is why personal data protection is not all about keeping your personal information private but being aware of the consequences of what we share, who receives it and how it could be used.

From Silence to Action: Encouraging Victims to Report Fraud

When people are conned, they may feel embarrassed, blame themselves or fear that others will judge them for being careless. Some worry that their families or communities will question their decisions. Others remain silent because they do not know where to seek assistance.

That silence can leave others exposed to the same methods. A person who shares their experience can help reveal how a scam operates, what information was used to gain their trust and which warning signs others should look out for. Their experience can help families, institutions and communities recognise patterns before more people are affected.

This does not mean victims should be pressured to disclose painful experiences publicly. They should be treated with dignity, and their privacy should be respected. Sharing can take place privately with trusted people, through appropriate reporting channels or anonymously where possible. What matters is creating an environment where being conned is not treated as a reason for humiliation, but as an opportunity to learn, seek help and prevent further harm.

During the Ficha Uchi sessions, participants were reminded that data protection violations and related concerns can be reported to the Office of the Data Protection Commissioner. The ODPC team explained reporting options, including its official website, email and telephone channels, and shared information to help participants understand where to turn when their personal data is misused.

People who suspect that their information has been misused should preserve relevant evidence, such as messages, transaction records, screenshots and suspicious profile details, where it is safe to do so. They should contact their financial service provider promptly if money or an account is involved, secure compromised accounts and report suspected data protection violations through the ODPC’s official channels.

Reporting a scam does not guarantee that lost money will be recovered, but it allows the relevant authorities to assess the complaint and determine what action can be taken. In cases involving data protection violations, victims may also pursue compensation where applicable. Most importantly, being scammed is never a reason to blame or shame the victim. The responsibility lies with the person who deliberately carries out the deception, not the individual who was targeted.

Why communities need data protection champions

Awareness cannot depend on occasional campaigns or one-off training sessions. Personal data is shared every day, through mobile money transactions, social media, online applications, business dealings and conversations with service providers. People need regular reminders about the risks and practical guidance on what to do when something seems suspicious.

This is where community data protection champions can make a difference. During the Lamu TVET engagement, one student expressed a desire to become a champion, saying, “I would like to help my fellow students and older members of my community understand how to protect their personal data and recognise the tricks scammers use to con people.” In Taita Taveta, another student shared how she helps her peers avoid online scams, especially suspicious links shared in WhatsApp groups. 

These are encouraging signs of how awareness can move beyond a training room and into everyday life. A data protection champion does not need to be a lawyer, a technology expert or an official. They can be a student who reminds classmates not to share verification codes, a community volunteer who helps an older neighbour identify a fake profile, a teacher who discusses online safety with learners or a local leader who encourages people to verify payment requests before sending money.

Champions can help people recognise common warning signs, understand their rights, know where to report concerns and share practical lessons from real experiences. They can also help bridge the information gap for older people and others who may have limited access to digital literacy resources.

Data protection is also about accountability

As digital services expand across banking, education, healthcare, mobile money, e-commerce and public administration, organisations are collecting more personal information than ever before.

This creates opportunities for innovation and improved service delivery. But it also creates responsibilities. Organisations must ensure that the personal data they collect is necessary, handled securely, used for legitimate purposes and protected against unauthorised access or disclosure. They must also be transparent about how people’s information is used and respect the rights of individuals.

The global conversation around AI governance is reinforcing these concerns. As automated systems increasingly rely on personal data to make predictions, generate recommendations and influence decisions, questions about consent, fairness, transparency and accountability become even more important.

People should not have to surrender control over their personal information simply because they want to access a service, apply for a loan, pursue an education or participate in the digital economy. Data protection is therefore not only an individual responsibility. It is a shared responsibility between individuals, businesses, public institutions, technology platforms and regulators.

The way forward: From awareness to accountability and action

The growing misuse of personal data calls for a response that goes beyond individual vigilance. While people must be encouraged to verify identities, question suspicious requests and think carefully about what they share, the responsibility for protecting personal data cannot rest on individuals alone.

We believe that building a safer and more inclusive digital society requires action at several levels:

Empower individuals and communities: Strengthen digital and data literacy so people can understand their rights, recognise scams and manipulation, question suspicious information and make informed decisions.

Promote responsible data practices: Encourage organisations to collect only what is necessary, explain how information is used, obtain meaningful consent and put safeguards in place against misuse.

Strengthen accountability and redress: Ensure people can report violations, challenge decisions and seek remedies without fear, stigma or unnecessary barriers.

Address emerging digital threats: Integrate discussions on profiling, AI-generated deception, misinformation and disinformation into data protection education, policy conversations and digital governance frameworks.

Invest in community-led awareness: Support local data protection champions, civil society organisations, educators and community institutions to translate data protection principles into practical knowledge that resonates with different audiences.

Kenya’s Data Protection Act provides an important framework for protecting personal information and upholding data subject rights. However, legislation alone is not enough. Its impact depends on public awareness, institutional accountability, effective enforcement and meaningful opportunities for people to exercise their rights.

Through Ficha Uchi, the Open Institute is working with communities to bridge the gap between policy and practice. By combining creative engagement, practical learning and collaboration with the Office of the Data Protection Commissioner, the initiative seeks to equip people not only to protect their personal information but also to recognise misuse and take action.

Ultimately, data protection is about protecting people, their dignity, their choices and their ability to participate safely in society. As digital technologies continue to evolve, our response must evolve too. We must move from simply raising awareness to building a culture of accountability, informed decision-making and collective responsibility