NAIROBI, Kenya, Oct. 12 – Kenya’s widespread use of mobile money is increasing its exposure to cyberattacks, Mastercard has warned, as rapid digital adoption across Africa outpaces efforts to strengthen cybersecurity defenses.
The warning is contained in Mastercard’s Africa Cybersecurity White Paper, which identifies Kenya’s mobile money ecosystem, particularly M-Pesa, as critical digital infrastructure that could become an attractive target for cybercriminals seeking access to personal information and financial transactions.
The report places Kenya alongside Nigeria, South Africa and Morocco as markets accounting for more than half of observed cyber threat activity across the continent, reflecting their economic importance and expanding digital ecosystems.
Kenya’s reliance on mobile money creates a distinct risk because the technology has become central to everyday transactions, from retail purchases and bill payments to business operations.
A successful attack could therefore affect consumers, merchants and financial service providers beyond the immediate loss of funds.
“Mobile money has become national infrastructure in Kenya,” said Shabir Ahmed, Senior Vice President, Customer Solutions Center Lead, Africa, Mastercard,highlighting how the growing digital footprint creates additional vulnerabilities outside traditional banking systems.
Mastercard said Africa’s digital economy is expanding rapidly, with mobile money usage growing sixfold between 2016 and 2025, while e-commerce activity increased approximately fourfold and digital banking users grew 4.7 times.
The report projects that Africa’s digital economy could reach $1.5 trillion by 2030, increasing the importance of securing financial transactions, customer data and interconnected digital services.
“Digital growth is outperforming cyber defenses,” he added,warning that expanding digital activity is creating more opportunities for attackers.
Nigeria faces elevated risks because of its large population and growing fintech ecosystem, which create significant volumes of digital transactions and potentially valuable financial data.
South Africa’s advanced banking and digital payments infrastructure makes it an attractive target for ransomware, data theft and fraud, while Morocco’s position between Europe and Africa exposes it to threats involving public institutions and strategically valuable information.
The report identifies technology, public institutions and financial services as major targets because they hold personal information, business systems and financial assets.
It also warns that smaller businesses remain particularly vulnerable. Small and medium-sized enterprises account for about 95 percent of registered businesses in Africa and roughly half of the continent’s gross domestic product, yet typically spend less on cybersecurity than large corporations.
Mastercard said strengthening cyber resilience requires more than technology, pointing to skills shortages, governance, regulation, infrastructure and cross-border cooperation as critical areas for investment.
The presentation cited approximately 200,000 unfilled cybersecurity roles across Africa, underscoring the need to develop local expertise as artificial intelligence makes cyberattacks easier to automate.
The findings come as governments and businesses seek to expand digital financial inclusion while protecting consumer confidence.
