Cyber criminals have complicated Uganda’s financial services sector, exposing weaknesses in law enforcement systems and putting technology investment pressures on companies.
At least 65 foreign nationals, mainly originating from Asia, were arrested and deported by Uganda’s Department of Immigration and Citizenship Affairs during the first half of this year, over allegations of involvement in cybercrime.
The group was accused of running an illegal call centre that targeted people living in different Asian countries through phone call-based scams. But details surrounding financial losses attributed to this criminal gang, victim numbers and the duration of their activities were not available by press time.
Another group of 50 Nigerians was arrested during the first six months of 2026 over alleged involvement in phone call-based scams. The group was tracked down to a church located in the northern region, according to local sources.
In addition, 1,000 Chinese nationals were arrested earlier in July over reported involvement in cyber crime. Their arrest came after a major cyber attack that affected Stanbic Bank Uganda and MTN Uganda’s online transaction platforms for an entire weekend.
The incident disrupted various services that included bank to wallet transactions, Automated Teller Machine (ATM) and internet banking services offered by Stanbic Bank plus airtime, data access services and mobile money services managed by MTN Uganda.
The number of cybercrime cases reported in Uganda stood at 286 in 2022, data from the Uganda Police Annual Crime Report for 2025 shows. Overall cybercrime cases increased from 245 recorded in 2023 to 474 registered in 2024. The overall number of cybercrime cases reported in 2025 stood at 412.
An estimated Ush41 billion ($10.8 million) was lost to cybercrime in 2024, while more than 20 licensed financial institutions were affected by the crime, according to the Uganda Police Force.
A total of 110 banking fraud cases were recorded in 2024, with a combined financial value of Ush5.3 billion ($1.39 million), data from the Uganda Bankers Association shows. Seven of the reported banking fraud cases were handled by the Office of the Directorate of Public Prosecutions (ODPP) in 2024 while one case was filed in court by the government prosecutor during the same period.
Signs of growing cybercrime risks appear quite notable in banking industry circles. For example, overall operational, fraud and loss expenses incurred by DFCU Ltd, the parent company of DFCU Bank, grew from Ush135 million ($35,645) in 2024 to Ush452 million ($119,346) in 2025, according to DFCU Ltd’s annual report for 2025. “We revamped the control environment in order to curb fraud losses and this will help minimise financial risks in our business. Fraud losses are also subject to insurance compensation,” said Hope Nakhayenze, chief risk officer at DFCU Bank. “The level of cybercrime in Uganda is becoming a big concern to us. There is need for wider collaboration between regulators, financial institutions, law enforcement agencies and the judiciary so as contain the problem before it gets out of hand. Commercial banks have embraced the idea of briefing each other whenever a cybercrime attack happens in order to shield the industry from extreme danger. This is big departure from the past where banks would prefer burying issues of cybercrime under the carpet regardless of the magnitude of the incident,” observed Peter Kawumi, Cellulant Ltd CEO.
Financial losses associated with cybercrime were estimated at $1.3 trillion worldwide. “This scenario presents an opportunity for innovation which is tied to a big challenge at the same time. Cybercrime will pile pressure on technology professionals over innovation of AI systems that can reinforce cyber security systems within companies and improve surveillance activities as well," argued Allan Rwakatungu, TYMS Ltd CEO.
"We need to be cautious about turning Uganda into a soft target for cyber criminals because it might complicate economic risk exposure that is being felt in other sectors. Prosecution of cybercrimes is not easy in Uganda. I know of cases that were taken to court and judges struggled to examine the evidence, were at pains trying to allocate criminal liability and come up with an appropriate sentence.” “Cyber criminals tend to disguise their location very often and that makes it difficult to verify their exact presence. A local hacker might disguise their identity as a foreigner that is targeting local entities for purposes of concealing their tracks. We have advised the banks to upgrade their cloud computing security protocols, technology outsourcing arrangements and client data access protocols," said Dr Kenneth Egesa, communications director at Bank of Uganda.
"Banks are required to report every fraud incident to us and also share the information with their peers in order to minimise impact on the industry. Cyber criminals are very mobile and this complicates investigations. For example, those Chinese might have moved from Senegal, then to Ghana before arriving in Uganda. How do you segment criminal evidence across different jurisdictions?” he added.
