Why a cyber café can put your ID and passwords at risk

What a shared computer keeps

Every document you scan or download lands somewhere on the computer. ID scans, passport photos, KRA PIN certificates, payslips and birth certificates usually end up in the Downloads folder or the scanner's folder, and they stay there until someone deletes them. On a busy café computer, that folder can hold hundreds of other people's IDs.

Web browsers remember passwords when you, or the attendant, click "save". The next person to open iTax or eCitizen on that computer may find your login already filled in. Browsers also keep history, form entries and sometimes card details.

Emails left open, logins not signed out, and accounts created with the café's email address all leave access behind. An iTax account registered with the attendant's email means the attendant controls your password resets, today and in the future.

Printers and scanners can keep copies too. Some keep a memory of recent jobs, and some cafés scan to a shared folder that every computer in the room can open.

Some computers carry software that records what is typed, installed either by a careless owner or by someone with bad intentions. You cannot see it, which is why the safest assumption on any shared computer is that whatever you type might be seen.

How the information is misused

A clear scan of an ID, front and back, is enough to attempt many things in your name. Fraudsters use them to register SIM cards, apply for mobile loans, open accounts with digital lenders, and register KRA PINs or businesses. Victims often discover it only when a lender calls about a loan they never took, or a credit report shows a default.

Access to your iTax account allows someone to file returns in your name, change your email address, or see your income details. Access to eCitizen can expose applications for passports, good conduct certificates and driving licences, and the personal details they contain.

Phone numbers and ID details together make SIM-swap fraud easier, where a criminal takes over your phone number to receive the codes your bank or mobile money service sends. Once they have your number, they can reset passwords on many accounts.

The harm is not always dramatic. Sometimes an attendant simply reuses your details to fill a form faster, or registers you with their own email for convenience. That is not malicious, but it leaves you depending on someone else to get into your own accounts later. Our guide on what to do if you forgot your KRA PIN or iTax password covers that situation.

Cyber café safety: what you can do

If you use a café, stay with the computer while your work is done and watch where files are saved. Before you leave, ask for every downloaded and scanned file to be deleted, and for the recycle bin to be emptied. Make sure nobody clicks "save password", and sign out of every account.

Insist on using your own email address and phone number on every government account. If an attendant offers to use theirs to save time, say no. It is a small delay now against years of dependence later.

Change your passwords afterwards from your own phone. If you shared a password with an attendant, change it the same day. Use a different password for each important account.

Watch for warning signs: unexpected codes sent to your phone, emails about password changes you did not make, lenders contacting you about loans you did not take, or your phone suddenly losing network. Act quickly. Contact the service concerned, and report identity misuse to the police.

The Data Protection Act gives you rights over your personal data, including the right to know how it is used and to complain about misuse. The Office of the Data Protection Commissioner handles complaints against businesses that mishandle personal data.

Safer ways to get government services done

The safest option is to do the work on your own phone or computer, using your own accounts. Many government services can be completed this way with a little patience.

When you need help, choose a service that does not leave your documents on shared computers and does not keep them for longer than needed. At CyberDash, you order from your own phone, your documents go only to the person working on your order, any portal login you share is locked and deleted when the order ends, and documents are deleted 48 hours after your order is finished.

Doing the work yourself is not risk-free either if your own phone is shared or unlocked. Use a screen lock, keep your phone's software updated, and do not install apps that ask for access they do not need.

Whatever service you use, ask how long it keeps your documents and who can see them. A clear answer is a good sign. A vague one is a reason to go elsewhere.

Finally, keep your own copies of important documents somewhere you control, such as your own phone or email. You will need them again, and having them ready means you never have to rely on a scan left on someone else's computer. Our KRA PIN update and password recovery service can also put your own email back on an iTax account set up by someone else.

Common questions