Artificial intelligence now enables 55% of reported cybercrimes across Africa, with financial losses more than doubling to $484 million, according to INTERPOL’s African Cyberthreat Assessment Report 2026 — but the more intractable finding sits beneath the headline number: the continent’s governing legal instruments were drafted before the technology now driving the majority of attacks existed.
The 40-page report, released Monday from Lyon and based on survey data from 36 African member countries, describes a shift from isolated criminal incidents to what it calls an industrialised, borderless ecosystem. Losses rose from $192 million in 2024 to $484 million, driven largely by AI-assisted scams, credential theft and automated social engineering.
“AI is automating every stage of a cyberattack from reconnaissance and phishing to extortion and evasion,” said Neal Jetton, INTERPOL’s Director of Cybercrime, adding that coordinated action between countries can still identify and dismantle criminal infrastructure.
A continent-wide map of specialisation
The report finds regional patterns rather than a uniform threat. East Africa has emerged as a hub for mobile money fraud and ransomware targeting critical infrastructure. Central and West Africa see prolific business email compromise and romance scams targeting both corporate and individual victims. Southern Africa’s high connectivity and advanced digital economy make it a magnet for global threat actors — with South Africa specifically identified as exposed.
INTERPOL documented over 600,000 sextortion cases, with perpetrators frequently deploying AI-generated synthetic media. Seventy-two percent of surveyed countries reported scam centres operating within their borders, concentrated in Southern and West Africa.
The synthetic identity problem drew particular attention. Criminals have moved beyond stealing existing credentials to fabricating entirely new personas — combining genuine personal data with AI-generated elements to produce digital identities capable of defeating advanced biometric verification. In Tanzania and Kenya, such identities have proven realistic enough that bank verification protocols failed to detect them. South Africa saw a high-profile demonstration of the same capability when criminals used voice and video cloning to impersonate Reserve Bank Governor Lesetja Kganyago, directing citizens toward fraudulent investment platforms.
The treaty gap
The legal architecture meant to govern this is showing its age. The African Union Convention on Cyber Security and Personal Data Protection — the Malabo Convention — relies on definitions drafted in the early 2010s. AI-driven social engineering, synthetic identity generation and deepfake-enabled fraud have no explicit coverage under the original text.
The UN Convention against Cybercrime, adopted in Hanoi and signed by African states including South Africa, Nigeria, Uganda, Rwanda, Mali and Zimbabwe, presents a similar problem: it lacks targeted mechanisms for AI-enabled offences, leaving enforcement agencies without a framework calibrated to what they are actually facing.
That is a categorically different problem from underfunding or understaffing. A capacity gap can be closed with investment; a definitional gap means prosecutors may be unable to charge conduct that is plainly criminal in substance but falls outside the enumerated offences. INTERPOL’s own assessment notes that cybercrime legislation across the continent remains fragmented.
Skills, and what enforcement has managed anyway
Law enforcement AI readiness is, in INTERPOL’s phrasing, alarmingly low. Research cited alongside the report suggests 92% of agencies lack technical AI expertise, with only 8% of intelligence analysts holding advanced AI capability — figures worth treating as indicative rather than definitive, as they come from academic work rather than the INTERPOL assessment itself.
Despite that, coordinated operations have produced results. Four INTERPOL-led operations during 2025 — Serengeti 2.0, Contender 3.0, Sentinel and Red Card 2.0 — yielded more than 1,500 arrests, the seizure of hundreds of electronic devices and the recovery of over $100 million.
The report’s recommendations follow from the diagnosis: standardised digital forensic capabilities, stronger cross-border collaboration, investment in AI literacy for law enforcement personnel, and formal public-private partnerships. It also flags the absence of real-time data sharing between banks, telecoms and law enforcement as a structural blind spot that synthetic identity fraud exploits directly.
The assessment forms part of INTERPOL’s African Joint Operation against Cybercrime initiative, funded by the UK’s Foreign, Commonwealth and Development Office, with data contributed by Fortinet, Mastercard, the Shadowserver Foundation, S2W and TrendAI.
The scale problem
Africa recorded more than 1.1 billion mobile subscribers in 2025. Each one represents both digital inclusion and attack surface. The report’s underlying warning is that AI-driven cybercrime is not merely more sophisticated but more scalable — a single operation can now target multiple countries simultaneously, at a speed that fragmented national legislation and under-resourced agencies were never designed to match.
Updating the Malabo Convention, or building AI-specific protocols on top of it, would take years of AU negotiation. The criminal capability it needs to address arrived this year.
