Nairobi: A Man Secretly Withdraws KSh 57 Million From NCBA Bank Accounts Before Being Arrested

A Kenyan IT graduate has been arrested in Nairobi in connection with an alleged banking scam involving KSh 57.5 million at NCBA Bank’s Rwanda operations.

Evans Nandwa, who works for technology firm Ronford Digital Limited, is suspected of exploiting authorised access to the bank’s computer systems to enable questionable financial transactions.

Investigators say Nandwa received access to NCBA Rwanda’s main computer system on June 6, 2025. The access was reportedly granted to facilitate scheduled maintenance and upgrades to the bank’s mobile money link with MTN Rwanda.

The Directorate of Criminal Investigations’ Banking Fraud Investigations Unit alleges that the system’s computer code was altered about three minutes after the access was activated, using login credentials assigned to Nandwa.

According to court documents, the changes affected the system’s processing of withdrawals through MTN Rwanda’s mobile money platform. The altered code allegedly identified 70 specific accounts and allowed transactions to proceed without the usual verification checks.

Detectives suspect the accounts were fake and that some were associated with duplicated or fraudulently registered SIM cards obtained using stolen identification information.

Investigators say the alleged irregularities persisted between June 6 and June 14, during which 260 transactions were processed through MTN Rwanda’s network. The transactions allegedly resulted in payments amounting to approximately KSh 57.5 million.

The scheme reportedly came to light when the bank’s financial records were reconciled. Although MTN Rwanda’s records showed the transactions, NCBA’s internal system did not contain corresponding withdrawals from the accounts involved.

After identifying the discrepancy, NCBA reportedly suspended third-party access and launched an investigation into changes made during the maintenance exercise. Its engineers examined the system’s code and access logs to determine how the suspicious transactions had been enabled.

The DCI subsequently connected the alleged system alterations to credentials assigned to Nandwa, leading to his arrest in Nairobi.

He was later taken to Milimani Law Courts, where he appeared before Magistrate Benmark Ekhubi.

Authorities are still investigating the origin of the 70 accounts, the destination of the funds and whether other people helped carry out the alleged scheme.

The case remains under investigation, and Nandwa is presumed innocent unless proven guilty in court.

Newsdigital300 feedback-opera-news-app@opera.com