At 9.15 am on a Monday, a Nairobi‑based distribution company received an email that appeared to come from a regular supplier, requesting a change of bank account before settling an outstanding invoice.

The email used the correct supplier name, matched the invoice details and cited an imminent payment deadline, prompting the finance officer to update the details and authorize the transfer.

By lunchtime the money had been transferred to an account controlled by criminals, and a call to the genuine supplier confirmed that no bank details had been changed.

The incident forced the company to alert its bank, investigate the transaction, and find a way to meet its genuine supplier obligations, turning a routine payment into a financial and operational crisis.

Experts note that cyber threats often exploit ordinary business processes such as email, SMS and payment approvals, and that AI‑driven fraud, including deep‑fake impersonation, is on the rise.

PwC’s Cyber Digest warns that AI‑enabled attacks are reshaping the cybersecurity landscape, increasing the need for firms to strengthen defenses and plan for the financial fallout of cyber incidents.

For SMEs, an unexpected loss can strain cash flow, while larger organisations may expose weaknesses in internal controls, supplier verification and risk management.

Key preventive measures include independently verifying any change to supplier payment details using previously confirmed contact information, requiring appropriate approvals for transactions, and restricting access to financial systems.

Employees should be trained to report suspicious communications immediately, and firms should confirm contact procedures with banks, such as Equity’s customer‑verification protocols.

Equity Insurance offers a Cyber Liability cover that can protect against specified financial losses from covered cyber incidents, including data breaches, ransomware, regulatory fines and, where permitted, business interruption.

Businesses are advised to assess their critical systems and processes, then review existing safeguards and insurance arrangements to ensure adequate coverage for cyber‑related financial exposure.

A fraudulent email can be sent in seconds, but recovering from its consequences may take much longer, underscoring the importance of both preventive controls and cyber‑liability insurance for Kenyan firms.