DCI investigates alleged RWF 654 Million Banking fraud Involving NCBA and MTN Rwanda

A technology consultant, Evans Nandwa, has been arrested and charged in connection with an alleged RWF 654 Million banking fraud involving unauthorised changes to NCBA Bank’s core application code and suspicious transactions processed through MTN Rwanda’s mobile-money network.

According to court documents and the Directorate of Criminal Investigations (DCI), Nandwa, an employee of technology consultancy firm Ronford Digital Limited, allegedly used credentials assigned to him to alter the bank’s transaction-processing system during a scheduled maintenance exercise on June 6, 2025.

The maintenance activity was intended to support upgrades and connectivity involving NCBA Bank’s mobile-money services linked to MTN Rwanda.

Investigators allege that approximately three minutes after Nandwa’s access to the bank’s live backend systems was activated, his credentials were used to modify part of the bank’s core application code.

The alleged alteration affected the system’s withdrawal-processing logic, potentially allowing certain transactions to be approved without undergoing the usual validation procedures.

Seventy accounts allegedly exploited

According to the investigation, the modified code was configured to recognise 70 specific accounts and return successful responses for transactions originating from them while bypassing standard verification checks.

This allegedly enabled transactions to proceed without properly confirming whether the accounts had sufficient funds or met the bank’s normal authentication requirements.

The DCI further alleges that the accounts were fictitious profiles, with some reportedly associated with cloned or fraudulently registered SIM cards created using stolen identification details.

Investigators suspect that limiting the alleged manipulation to a specific group of accounts may have helped the activity evade immediate detection.

260 transactions processed over eight days

The alleged scheme reportedly operated between June 6 and June 14, 2025, during which MTN Rwanda records showed that 260 transactions involving the 70 accounts resulted in approximately KSh 57.5 million(RWF 654 Million) being paid out.

However, NCBA Bank’s internal records allegedly contained no corresponding legitimate debits or supporting entries to justify the transactions.

The discrepancy was reportedly identified during an end-of-week reconciliation, prompting the bank to launch an internal investigation.

NCBA subsequently revoked third-party access credentials and began examining system changes made during the maintenance period. Engineers conducted a forensic review of the application code and access logs, which investigators say helped trace the suspicious modifications to credentials assigned to Nandwa.

The DCI’s Banking Fraud Investigations Unit subsequently took over the criminal investigation.

Kenyan IT Graduate in Court Over Alleged KSh 57 Million Banking Fraud.facebook image 

Consultant appears before Nairobi court

Nandwa was arrested in Nairobi and presented before the Milimani Law Courts, where he appeared before Magistrate Benmark Ekhubi.

Investigators are seeking to establish how the 70 accounts were created and operated, where the money was transferred, and whether other individuals participated in the alleged scheme.

The case also raises questions about the security of third-party access to banking infrastructure and the controls used to monitor changes to financial institutions’ live transaction-processing systems.

The allegations against Nandwa remain subject to judicial determination. His arrest and court appearance do not establish guilt.

Separate case highlights risks of banking fraud

In a separate case, former banker George Juma, who reportedly enjoyed a successful banking career and had secured a scholarship to study in the United States, was convicted over a scheme involving the unauthorised removal of small amounts of money from customer accounts.

According to the account of the case, Juma worked with colleagues who allegedly exploited accounts belonging to customers who rarely conducted transactions, taking small sums that could go unnoticed.