Nairobi: A Man Secretly Withdraws KSh 57 Million From NCBA Bank Accounts Before Being Arrested

A Kenyan information technology graduate has been arrested in Nairobi over an alleged KSh 57.5 million banking scam involving NCBA Bank’s Rwanda operations.

Evans Nandwa, an employee of technology firm Ronford Digital Limited, is accused of abusing authorised access to the bank’s computer system to facilitate suspicious transactions.Nandwa had been granted access to NCBA Rwanda’s main computer system on June 6, 2025.

His access was intended to support planned maintenance and upgrades involving the bank’s mobile money link with MTN Rwanda.

However, investigators from the Directorate of Criminal Investigations Banking Fraud Investigations Unit allege that his login details were used about three minutes after the access was activated to alter part of the bank’s computer code.

The suspected changes reportedly affected the way the system handled withdrawals through MTN Rwanda’s mobile money service.

Court documents indicate that the altered code was designed to recognise 70 selected accounts.

Transactions from those accounts could allegedly be approved without the usual checks to confirm whether the accounts had enough money or were genuine.Investigators suspect the 70 accounts were fake profiles. Some were allegedly connected to duplicated or fraudulently registered SIM cards that had been created using stolen identification information.

The alleged scheme went unnoticed for several days. Between June 6 and June 14, investigators say 260 transactions involving the accounts were processed through the MTN Rwanda network.

The transactions allegedly resulted in about KSh 57.5 million being paid out.

The suspected fraud came to light during a reconciliation of the bank’s records. MTN Rwanda’s records reportedly showed the transactions, while NCBA’s internal records lacked matching withdrawals from the affected accounts.

The discovery prompted NCBA to suspend third-party access and examine changes made to its systems during the maintenance period. Engineers later reviewed the computer code and access records as part of a forensic investigation.

The DCI subsequently linked the suspicious changes to login credentials assigned to Nandwa.

He was arrested in Nairobi and taken to the Milimani Law Courts, where he appeared before Magistrate Benmark Ekhubi.

Investigators are continuing to establish how the accounts were created, where the money was transferred and whether other people participated in the alleged scheme.

Nandwa has not been convicted. The allegations against him remain before the court and will be tested through the legal process.

If you liked this story, please follow or tip the author to help them write more!

ProfHamo feedback-opera-news-app@opera.com