IT graduate creates 70 ghost accounts and withdraws 57 milllion from NCBA bank

A Kenyan IT graduate has found himself at the centre of a major cross-border banking fraud investigation after detectives allegedly linked his system credentials to suspicious changes made to the computer systems of NCBA Bank’s Rwanda subsidiary.

Evans Nandwa, an employee of technology consultancy firm Ronford Digital Limited, was arrested in Nairobi and presented before the Milimani Law Courts following investigations into an alleged KSh57.5 million fraud involving the bank’s mobile-money operations in Rwanda.

According to court documents, the case dates back to June 6, 2025, when Nandwa was reportedly granted authorised access to the bank’s live backend systems during a scheduled maintenance exercise.

The access was allegedly intended to facilitate maintenance and upgrades involving NCBA Rwanda’s mobile-money connection to MTN Rwanda.

However, investigators from the Directorate of Criminal Investigations (DCI) Banking Fraud Investigations Unit allege that only about three minutes after the access was activated, Nandwa’s credentials were used to make changes to part of the bank’s core application code.

The alleged modification reportedly affected the system’s logic for processing withdrawals through the MTN Rwanda mobile-money network.

Investigators claim the altered code was programmed to recognise 70 specific accounts.

According to the allegations contained in court documents, transactions originating from the selected accounts would receive a successful response while bypassing some of the system’s normal validation procedures.

As a result, the system allegedly failed to properly establish whether the accounts had sufficient funds or whether the transactions were legitimate before processing them.

The DCI further alleges that the 70 accounts were ghost profiles, with some reportedly connected to cloned or fraudulently registered SIM cards created using stolen identification details.

The investigators believe that limiting the alleged loophole to a relatively small number of accounts may have helped the transactions continue without immediately triggering the bank’s security systems.

The alleged activity reportedly continued from June 6 to June 14, 2025, before a discrepancy was detected during a reconciliation exercise.

According to investigators, records obtained from MTN Rwanda showed that 260 transactions involving the 70 accounts had resulted in approximately KSh57.5 million being paid out.

However, NCBA’s internal records allegedly did not contain corresponding legitimate debits from the accounts or other documentation supporting the transactions.

The significant mismatch reportedly prompted the bank to launch an internal investigation.

NCBA subsequently revoked third-party access credentials and began examining changes made to its systems during the maintenance period.

Engineers reportedly conducted a forensic examination of the application code and access logs as investigators sought to establish how the alleged transactions had been processed.

Activity allegedly traced to Nandwa’s credentials

The DCI Banking Fraud Investigations Unit later took over the criminal investigation.

Detectives allegedly traced the suspicious modification to activity carried out using credentials assigned to Nandwa.

He was subsequently arrested in Nairobi and presented before the Milimani Law Courts, where he appeared before Magistrate Benmark Ekhubi.

The allegations against Nandwa remain subject to the court process, and being charged does not in itself establish guilt.

The case has nevertheless drawn attention to the potential risks associated with privileged access to financial institutions’ live systems, particularly where banking platforms are connected to mobile-money networks.

As the court proceedings continue, investigators are expected to pursue further evidence to establish how the alleged system modification was made, who may have benefited from the transactions and whether other individuals were involved in the scheme.