Rwanda’s digital finance boom has brought millions of people into the formal economy. But the same digital transformation that has made financial services faster and more accessible has also created new opportunities for fraudsters. A National Bank of Rwanda survey in October 2025 found that 84% of digital financial service users had received scam messages during the previous year. Among them, 18% suffered actual financial losses, representing 15% of all users surveyed, according to Consultative Group to Assist the Poor (CGAP). These figures reveal a troubling paradox: the technologies expanding financial inclusion are also creating new avenues for theft. Criminals impersonate bank employees, claim that transfers were made by mistake or persuade victims to disclose confidential information. What appears to be an ordinary mobile-money transaction can quickly become a cybercrime. With 96% of Rwandan adults now financially included and 86% using mobile money, cybersecurity is no longer simply a technical issue. It has become a question of public trust. Rwanda is not without legal protection. Law No. 60/2018 on Prevention and Punishment of Cyber Crimes specifically criminalises phishing. Article 36 provides for imprisonment of one to two years and fines of up to Rwf 3 million for unlawfully obtaining confidential information through websites or electronic messages. The law also addresses unauthorised access and other computer-related offences. The problem, therefore, is not simply the absence of domestic legislation. The real difficulty begins when the crime crosses a border. Imagine a Rwandan victim receiving a fraudulent message from a criminal operating in another country. The telephone number may be registered elsewhere, while the stolen money passes through several jurisdictions or disappears into cryptocurrency. Rwanda’s law can define the crime. But investigators still need answers to more difficult questions: Who controlled the account? Where did the communication originate? Can a foreign service provider preserve the relevant electronic evidence? Can another country assist in freezing or recovering the stolen assets? This is where international cooperation becomes indispensable. The Budapest Convention: A 25-year-old treaty in a new digital world The Budapest Convention is now 25 years old. Describing it simply as “outdated” misses an important point. Its technology-neutral approach has allowed it to remain relevant despite major technological changes, while its mechanisms for international cooperation continue to provide an important foundation for investigating cybercrime. The Convention was created before smartphones became part of everyday life, before mobile money became central to many African economies, and before cryptocurrency and generative AI transformed the digital environment. Cybercrime, meanwhile, continues to evolve. Criminals operate across jurisdictions, use AI to scale deception, and move illicit assets through increasingly complex financial networks. Rwanda joined the Budapest Convention on Cybercrime on 10 January 2025, becoming its 78th Party. The Convention, opened for signature in 2001, was the first international treaty specifically addressing computer crime and electronic evidence. For Rwanda, however, the Convention does not replace domestic legislation. Rather, it provides a common framework for criminalising certain conduct, obtaining electronic evidence and facilitating international cooperation. The central question is therefore not whether Rwanda has laws against digital fraud. It does. The more difficult question is whether Rwanda and its international partners can obtain the evidence, trace the money and bring offenders to justice when the crime does not remain within Rwanda’s borders. A Rwandan legal researcher’s perspective These challenges have also attracted the attention of François Régis Nshimiyimana, a Rwandan legal researcher and PhD candidate in Law at Károli Gáspár University in Hungary, whose doctoral research focuses on the use of electronic evidence in cybercrime, comparatively examining Rwanda and three EU countries: Germany, Estonia and Hungary. Nshimiyimana previously served for approximately 14 years in the Rwandan Judiciary, including as a judge and President of a Primary Court, and has also served at an Intermediate Court and as a member of the Judicial High Council. His professional judicial experience has therefore given him a practical perspective on criminal justice and the challenges surrounding evidence. His research on emerging cyber threats has also been published in Belügyi Szemle / Academic Journal of Internal Affairs. His article, “Adapting the Budapest Convention to address emerging cyber threats,” examines how ransomware, cryptocurrency-related crime, artificial intelligence and Internet of Things vulnerabilities are challenging existing approaches to cybercrime and electronic evidence. Cryptocurrency illustrates the challenge particularly well. Digital assets can move across borders almost instantly, requiring investigators to use blockchain analysis to trace transactions. Artificial intelligence presents another layer of difficulty: AI can generate convincing phishing messages, automate social engineering and allow fraud to reach thousands of potential victims. The criminal conduct itself may already fall within existing laws. The greater challenge can be identifying, collecting, authenticating and interpreting the electronic evidence. The Council of Europe has emphasised that the Convention’s technology-neutral provisions can also apply to emerging technologies, including AI. The issue, therefore, is not simply whether existing law “covers” AI. It is whether legal and investigative systems can respond effectively to the new ways in which crimes are committed and evidence is created. For Rwanda, this is becoming an increasingly important conversation. As digital financial services continue to expand, protecting citizens requires more than strong domestic legislation. It requires effective electronic-evidence mechanisms, capable investigators, international cooperation and legal frameworks that can respond to crimes that move faster than national borders. Rwanda’s digital transformation has made financial services accessible to millions. The next challenge is ensuring that those millions can continue to trust the digital economy they have gained. The author is Károli Gáspár University of the Reformed Church in Hungary.
