Someone took a loan in my name: what the law says
Computer Misuse and Cybercrimes Act 2018, Penal Code, Data Protection Act 2019 and CRB Regulations 2020 · sources read 5 Oct 2026
Using someone else's ID, password or other identity details to borrow is a crime (identity theft and impersonation), punishable by a fine of up to KSh 200,000, up to 3 years in jail, or both. Report it to the police, tell the lender in writing that the debt is not yours, and dispute any CRB listing: if the check is not finished in 21 days, the listing must be deleted.
- How long
- The CRB dispute must be investigated within 21 days, or the disputed listing is deleted
- Where
- Any police station or DCI office for the crime; the CRB and the lender for the listing; the Data Commissioner for data complaints
Steps
- Report the fraud at a police station or a DCI office. The DCI investigates cyber-enabled crimes such as electronic fraud.
- Tell the lender, in writing or verbally at the address it gives for such notices, that the loan information is wrong. It must then not send that information to a CRB until it has dealt with your complaint.
- Write to the CRB that shows the loan and say you dispute it because you never took it.
- Ask the lender to correct personal data that is inaccurate or misleading. If it refuses, you can complain to the Data Commissioner, orally or in writing.
- If you are not happy with how the CRB dispute was resolved, you can refer it to the Central Bank of Kenya.
Watch out
- Since 4 November 2025 the law defines identity theft as using another person's identification details, such as their name, ID number, SIM card, bank card or account details, address or password.
- Pretending to be another person to defraud someone is also a separate offence under the Penal Code.
- A CRB may charge you for investigating a dispute if your dispute turns out to be false.
- The identity theft offence (section 29) is still valid. In March 2026 the Court of Appeal struck down only sections 22 and 23 of the Computer Misuse and Cybercrimes Act and rejected the challenge to the other sections.
Who this covers
- Anyone whose credit report shows a loan or information they believe is wrong.
Official sources (8)
- Computer Misuse and Cybercrimes Act (No. 5 of 2018) new.kenyalaw.org · read 5 Oct 2026
- Penal Code (Cap. 63) probation.go.ke · read 3 Oct 2026
- The Banking (Credit Reference Bureau) Regulations, 2020 (L.N. 55 of 2020) centralbank.go.ke · read 3 Oct 2026
- Data Protection Act (No. 24 of 2019) odpc.go.ke · read 3 Oct 2026
- Public Complaints dci.go.ke · read 3 Oct 2026
- Investigative Services dci.go.ke · read 3 Oct 2026
- Computer Misuse and Cybercrimes (Amendment) Act, 2025 (No. 17 of 2025), Kenya Gazette Supplement No. 170 (Acts No. 17) parliament.go.ke · read 4 Oct 2026
- Bloggers Association of Kenya (BAKE) v Attorney General & 6 others, Civil Appeal 197 of 2020, [2026] KECA 430 (KLR) new.kenyalaw.org · read 5 Oct 2026