Start here: distinguish exposure from misuse
A leaked ID image or personal record creates risk; it does not by itself prove someone has used your identity. Look for unfamiliar loans, mobile lines, account changes, debt demands, tax activity or profiles pretending to be you. Check unexpected messages directly with the organisation using an independently verified contact.
If money is moving, contact your bank or mobile-money provider immediately. If your number suddenly stops working, contact your mobile operator from another phone or visit its official service centre. Secure your main email from a trusted device because it may control account recovery.
Step 1: contain access to affected services
Notify each affected provider. Explain which activity you do not recognise. Ask its fraud team to secure the account, investigate new accounts or applications and explain its dispute requirements.
Restore account control. Change exposed passwords, revoke unfamiliar sessions and check recovery email addresses, phone numbers and authentication methods. Follow the account compromise playbook if access was stolen.
Protect identity documents. If a national ID, passport or other document is lost or misused, contact the issuing authority through its official channel for the relevant reporting and replacement process. Do not send another ID copy to an unverified caller.
Step 2: record and report the misuse
Create one private incident log with dates, disputed transactions or account identifiers, provider contacts and case references. Keep original messages and copies of statements showing the activity. Store identity evidence securely and redact unrelated details when making routine enquiries.
Report suspected identity crime to police and retain the report reference and any documentation provided. Use NC4 incident reporting guidance and current contact channels for cyber-related activity. Check the intake notice before submitting; a preview form does not lodge an operational report.
If your concern involves unlawful processing or misuse of personal data, review the ODPC complaint process. A privacy complaint is separate from a bank dispute or police report. Use the route appropriate to the issue and retain each acknowledgement.
Step 3: dispute false records in writing
Ask the provider for its formal process to dispute an account, debt, transaction or application you did not authorise. Identify the specific record, explain the mismatch and provide only the evidence requested through its secure channel. Ask for written acknowledgement and the next review date.
If a lender or credit-reference bureau shows a record you do not recognise, contact both the lender and the relevant bureau through their official processes. Ask how the disputed record will be investigated and corrected. Keep copies of correspondence rather than relying on a telephone conversation alone.
Do not assume procedures from another country apply in Kenya. Options such as credit freezes, replacement documents and fraud markers depend on the provider and applicable local process. Ask what protection is available in your circumstances.
Step 4: check the wider impact
Review bank and mobile-money statements and relevant service profiles for unfamiliar changes or applications.
Check important email, government-service and financial accounts. Revisit recovery details after restoring control of a phone number.
Report impersonating social profiles through the platform's official process and warn affected contacts separately.
If workplace records were exposed, alert the responsible security or privacy team. Share facts privately rather than circulating the leaked material.
Recovery check: track unresolved items
Keep a checklist of each disputed record, its owner, case reference, promised follow-up and outcome. Recovery may take several provider interactions; account access returning does not automatically remove a false debt or correct an identity record. Request confirmation when a dispute is resolved and check that the correction appears in the relevant system.
Continue watching for unfamiliar activity and messages referring to the incident. Decline unsolicited offers to “clean” your identity for a fee. For future sharing, provide only the personal data needed through a verified channel and follow everyday protection guidance.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.