Abstract
Phishing, vishing, and broader forms of online fraud pose significant threats to Kazakhstan’s citizens, yet existing legislative and policy frameworks do not comprehensively address these increasingly sophisticated tactics. This article undertakes a comparative legal analysis of Kazakhstani legal documents, including the Penal Code, the Law «On Personal Data and Their Protection», and other relevant regulations, to examine how such crimes are defined and codified. The findings reveal that while fraud statutes broadly accommodate certain dimensions of cyber deception, explicit references to phishing and vishing remain absent or insufficiently developed, leaving enforcement agencies to interpret modern social engineering schemes through traditional legal provisions. Similarly, national cybersecurity strategies, such as the «Cyber Shield of Kazakhstan», recognise social engineering as a growing threat but fail to offer targeted measures for mitigating it. The article argues that these omissions, combined with the dynamic nature of cybercrime, create enforcement ambiguities. By highlighting critical gaps and ambiguities in current legislation, this analysis underscores the need for an updated legal framework capable of keeping pace with evolving cybercriminal methodologies, ultimately ensuring more robust protection for both individuals and institutions.