Picture a mid-sized Nairobi insurer processing a KES 4.2 million motor claim. The claims officer receives an email from the policyholder confirming new bank details for the payout. The signature matches. The thread history is intact. The payment goes out on Thursday. On Monday, the real policyholder calls asking where their money is.
This is business email compromise (BEC), and it is the single most expensive scam hitting Kenyan insurance firms right now. Unlike ransomware, there is no malware to detect. There is only a human being, reading an email that looks exactly like the hundreds of others they process every week, and acting on it.
Why Kenyan Insurers Are a Prime BEC Target
Insurance sits at an unfortunate intersection: high-value payments, predictable workflows, and heavy reliance on email for claims correspondence. Attackers know the pattern. A broker emails a loss adjuster. The adjuster emails the insurer. The insurer emails the claimant. Everyone copies everyone. Bank details move around in attachments and signatures.
Several factors make the sector especially exposed:
- High email volume per claim — a single motor or medical claim can generate 30 to 50 emails between brokers, assessors, garages, hospitals, and the insured.
- Delegated authority — claims officers often have payment authority up to defined limits, which attackers research and stay just below.
- Public claim triggers — a car accident, a hospital admission, or a reported fire can be learned about through social media, giving attackers context to craft a convincing email.
- Weak email authentication — many Kenyan domains still do not enforce DMARC, SPF, or DKIM properly, making spoofing trivial.
The Anatomy of a Claims Diversion Attack
Most BEC incidents against insurers follow the same four-step pattern. Understanding it is the first step to breaking it.
Step 1: Mailbox compromise
The attacker phishes a broker, a loss adjuster, or an assessor. Not the insurer directly. The weakest mailbox in the claims chain becomes the entry point. Once inside, the attacker sets up quiet inbox rules that forward or delete messages containing keywords like "payment," "MPESA," or "bank details."
Step 2: Reconnaissance
They read for days or weeks. They learn the tone, the signatures, the approval workflow, the names of claims officers at every insurer the broker deals with. They identify a live, high-value claim close to payout.
Step 3: The pivot email
At the right moment, the attacker sends an email from the compromised account, or from a lookalike domain (think `safaricomltd.co.ke` instead of `safaricom.co.ke`), with new bank details. The thread history is quoted. The signature is correct. The timing matches the real claim's progress.
Step 4: The payout
Funds hit a mule account, usually within a Kenyan tier-two bank or a mobile wallet. By the time anyone notices, the money has been layered through three or four accounts.
Expert tip: No bank-detail change should ever be accepted by email alone. Full stop. A callback to a phone number on file, not one in the email, is the single highest-ROI control you can introduce this week.
The Controls That Actually Work
Technical controls matter, but they do not catch a well-crafted email from a genuinely compromised mailbox. The last line of defence is a trained human.
- Mandatory out-of-band verification for any change to payment details, written into claims procedures and audited.
- DMARC enforcement at p=reject on your own domain, plus SPF and DKIM, to stop attackers spoofing you.
- Multi-factor authentication on every mailbox, especially for brokers and third parties you exchange payment instructions with.
- Continuous phishing simulations using realistic insurance scenarios: fake broker emails, fake assessor reports, fake bank-detail-change requests. Not generic "you won a prize" tests.
- A named escalation path so a claims officer who feels uneasy about an email has somewhere to send it in 30 seconds, without fearing they are wasting anyone's time.
Phishing Simulation Service Page
Where the Kenya Data Protection Act Fits In
A diverted payment is not just a financial loss. If the attacker accessed a mailbox containing claimant medical records, ID numbers, or vehicle details, you have a personal data breach under the Kenya Data Protection Act 2019. The Office of the Data Protection Commissioner expects notification within 72 hours of becoming aware, and expects you to demonstrate the "appropriate organisational measures" you had in place. A documented, regularly tested staff training programme is one of those measures. An untrained team is not.
Kenya Data Protection Act Compliance Services
Start With What Your Staff Would Actually Do
You cannot fix what you cannot measure. The honest question is: if a convincing bank-detail-change email arrived in your claims team's inbox tomorrow, what percentage would act on it without verification?
Find out how many of your staff would click. SecureZaidi runs a free, safe phishing baseline for up to 10 employees, with your written sign-off. Get in touch.