Written By | Torch Media Africa
AI-driven scams, mobile-money fraud and ransomware are growing faster than the defences meant to stop them.
Search
Africa's digital-economy story is usually told in terms of how much has been built: subscriptions, fibre kilometres, mobile-money volumes, startup funding. The numbers are impressive. INTERPOL's African Cyberthreat Assessment Report 2026 counts more than 1.1 billion mobile subscriptions on the continent and over US$1.1 trillion in digital transactions in 2025. More than 570 million people now use the internet for banking, government services, health care or education.
Every one of those connections is also a point of attack. Two INTERPOL publications from the past three months, the threat assessment released on 3 August and the results of Operation Serengeti III announced on 22 October, describe the same imbalance. Criminal capability, increasingly automated with artificial intelligence, is growing faster than the institutions, laws and skills meant to contain it. This article argues that cybersecurity is no longer a niche IT concern. It is part of the infrastructure of trust that Africa's digital economy depends on, and the gap is now imposing a measurable 'fraud tax' on users, businesses and governments.
What INTERPOL Found: AI as the Accelerant
The 2026 assessment's headline finding is that AI is now linked to more than half of recorded cybercrime in Africa. Several outlets put the figure at 55% of reported cases. 'AI is automating every stage of a cyberattack, from reconnaissance and phishing to extortion and evasion,' said Neal Jetton, INTERPOL's Director of Cybercrime. Synthetic voices that imitate executives, phishing emails written by language models with no tell-tale spelling errors, and synthetic identities built from a mix of real and fabricated data are now routine tools. The report notes that synthetic identities are used to open bank accounts, obtain mobile loans and register SIM cards under false names.
The losses have risen sharply. Reported cybercrime losses rose from US$192 million in 2024 to US$484 million in 2025, an increase of about 150%. Identified victims rose from 35,000 to 87,000. In parts of West and Southern Africa, respondents estimated that cybercrime made up more than 30% of all recorded crime. INTERPOL warns that inconsistent national reporting makes a full total impossible, so these figures are almost certainly too low. Many victims never report, and many agencies cannot classify what they receive.
The assessment also maps how threats differ by region:
Ransomware has already disrupted essential services: weather systems, customs operations, electricity networks and telecom providers. Nigeria, Uganda and Namibia reported suspected or confirmed attacks on critical infrastructure and public services. Coverage of the report also notes that 72% of surveyed countries identified scam centres operating within their borders, concentrated in West and Southern Africa. These are industrial-scale call-centre operations of the kind previously associated with South-East Asia.
Serengeti III: Enforcement at Continental Scale
The enforcement response is growing. Between 29 June and 31 August 2026, investigators from 21 countries (20 African states and the United States) ran Operation Serengeti III under INTERPOL coordination. The operation produced 1,462 arrests and disrupted 10,909 malicious networks. More than US$105 million in illicit funds was recovered. Investigators identified 65,929 victims and linked the networks to losses of more than US$385 million.
The individual cases show how varied the threat has become. In Uganda, authorities broke up two transnational fraud rings and arrested 365 foreign nationals. The rings ran rotating call centres with scripted conversations and fake trading platforms aimed at pensioners in Asia, which means African territory was being used to defraud people on another continent. In Angola, investigators shut down two illegal cryptocurrency-mining centres, seizing more than 2,000 mining devices and six illegal power transformation stations worth over US$1 million. That case connects cybercrime to electricity theft. In Nigeria, one suspect had harvested about 2.1 million email addresses for phishing and BEC. Another investigation traced more than US$2.4 million in suspected proceeds of a messaging-app investment scam, much of it laundered through cryptocurrency. Other cases included a malicious mobile-loan app in Tanzania, a vehicle-import fraud network on social media in Gabon, and 30 arrests in the Republic of Congo.
The operation was supported by private partners including Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Meta and the Global Anti-Scam Alliance. It was co-funded by the EU–Council of Europe GLACY-e project. That dependence is a lesson in itself: much of the threat intelligence that makes African operations possible comes from foreign vendors and donors.
Kenya: A Window Into the Volume Problem
Kenya publishes some of the most detailed national data on the continent, through the Communications Authority's National KE-CIRT/CC. In the 2025/26 financial year (July 2025–June 2026), it detected 11.12 billion cyber threat events, up from 8.62 billion the year before. DDoS attacks were the fastest-growing category, up 114.3%. In January–March 2026 alone, the centre logged about 3.37 billion events. System attacks made up roughly 96% of them, and the Authority issued 20.58 million advisories. The April–June quarter recorded about 2.36 billion events.
These numbers need careful reading. They count detected threat events, mostly automated scanning and attack attempts, not confirmed breaches. They still show the background pressure on any connected system in a country where M-Pesa carries a large share of economic activity. Quarterly declines can reflect better filtering and attacker behaviour as much as improved defence. The yearly trend is clearly upward.
The Capacity Gap
The weakest point in Africa's cyber defence is people and institutions. INTERPOL found that 92% of surveyed law-enforcement agencies cited a lack of technical expertise as the main barrier to adopting AI tools. Many lack the funding, specialist staff and forensic tools to investigate deepfakes or synthetic identities. Cooperation among police, platforms, telecom operators, banks, fintechs and mobile-money providers is limited. Differences in legal procedures and slow information-sharing let criminal networks move money and operations across borders faster than evidence can follow.
The legal framework is still incomplete. The African Union's Malabo Convention on Cyber Security and Personal Data Protection was adopted in 2014. It came into force only on 8 June 2023, after Mauritania became the 15th state to ratify. The Democratic Republic of Congo's ratification took effect in June 2025. Even with recent additions, only a minority of the AU's 55 members are parties. Many countries are updating national laws: reports on the INTERPOL assessment say 17 African countries passed updated cybercrime legislation in 2025. But laws without trained investigators, prosecutors and judges have limited effect.
A Market Taking Shape, Slowly
Where there is risk, there is also demand for defensive products. Nigerian startup Cybervergent closed a US$3 million seed round in March 2026, co-led by Ventures Platform and Atlantica Ventures. It says it serves more than 150 organisations across West, East and Southern Africa with AI-driven compliance and data-security tools. In February, investor Uwem Uwemakpan predicted in TechCabal that 2026 would be the year cybersecurity 'will emerge as a standalone investment category in African tech'. The evidence so far suggests a slow start. Startup trackers count only a few dozen African cybersecurity companies with disclosed funding, mostly at seed or Series A. The largest recent rounds are in the low tens of millions of dollars, which is small next to the hundreds of millions that go to fintech.
This is a strategic weakness. African fintechs, banks and governments buy most of their security from global vendors. That is often sensible, but it leaves gaps in local knowledge: local-language social engineering, USSD and SIM-swap attacks, agent-network fraud and informal cash-out channels. These are the threats a domestic industry would understand best.
Why This Is an Economic Question
The fraud tax is paid in several ways. There are direct losses, such as the US$484 million in reported 2025 losses and the US$385 million linked to Serengeti III networks. There are the costs of defence and insurance, and of slower transactions as payment providers add verification steps. The biggest cost may be lost trust. First-time digital users who lose savings to a fake loan app or a mobile-money scam often go back to cash. That undermines the financial-inclusion gains that mobile money, digital ID and instant payment systems were designed to deliver. When ransomware takes down customs systems, power utilities or telecom networks, the damage spreads to trade, revenue collection and public services.
What a Serious Response Looks Like
Conclusion
Africa has built digital rails at remarkable speed, and the criminals have built on them too. INTERPOL's 2026 numbers show losses rising about 150% in a year, more than half of cybercrime linked to AI, and scam centres in most surveyed countries. The 1,462 arrests in Serengeti III show that coordinated action works. The 92% skills gap and limited Malabo ratification show how far ad hoc coordination is from lasting capacity. If the next stage of Africa's digital transformation is about trust as much as access, cybersecurity belongs alongside fibre, data centres and digital ID as foundational infrastructure, and it should be funded that way.
