A Kenyan man named Evans Nandwa, who studied Information Technology (IT), has been arrested in Nairobi over allegations that he defrauded NCBA Rwanda, a bank operating in Rwanda, of KSh 57.5 million, equivalent to approximately Rwf 652,473,000.
According to the Kenyan news outlet TUKO, Nandwa is suspected of altering NCBA Rwanda’s system just three minutes after being granted legitimate login credentials to access the bank’s backend system, which is used to manage and monitor its operations.
The alleged fraud went undetected for several days until a reconciliation exercise revealed a significant financial discrepancy.
Investigators reportedly traced suspicious changes made to the bank’s core application code to credentials assigned to Nandwa.
Suspicious changes to the application code
Nandwa, an employee of Ronford Digital Limited, a technology consultancy firm, had reportedly been granted access to the bank’s live backend systems during a scheduled maintenance exercise on June 6, 2025.
According to Kenya’s Directorate of Criminal Investigations (DCI), Banking Fraud Investigations Unit, the access was intended to facilitate maintenance and upgrades, including improvements to the bank’s mobile-money connection with MTN Rwanda.
Investigators allege that approximately three minutes after Nandwa’s access was activated, his credentials were used to modify part of the bank’s core application code.
The alleged alteration affected the logic used to process withdrawals through the MTN Rwanda mobile-money network.
70 bank accounts suspected of being used in the alleged fraud
According to court documents, the modified code was configured to recognise 70 specific accounts. Investigators allege that when transactions originated from those accounts, the system returned a “successful” response while bypassing normal validation checks.
This meant the system did not properly establish whether the accounts had sufficient funds or were legitimate before processing the transactions.
The DCI alleges that the 70 accounts were fictitious profiles, some reportedly linked to cloned or fraudulently registered SIM cards created using stolen identification details.
Investigators believe that restricting the alleged loophole to a limited number of accounts may have allowed the activity to continue without immediately attracting attention.
For several days, the bank’s systems continued to operate normally as transactions involving the selected accounts were processed through the MTN Rwanda network.
The alleged activity continued from June 6 to June 14, before the discrepancy was discovered during an end-of-week reconciliation exercise.
MTN Rwanda records reportedly showed that 260 transactions involving the 70 accounts had resulted in approximately KSh 57.5 million being paid out.
However, NCBA Rwanda’s internal records allegedly did not show corresponding legitimate debits from the accounts or other records supporting the transactions.
The discrepancy prompted an internal investigation by the bank, which revoked third-party access credentials and began reviewing changes made to its systems during the maintenance period.
Engineers subsequently conducted a forensic examination of the application code and access records.
The DCI Banking Fraud Investigations Unit later took over the criminal investigation and traced the suspicious modification to activity carried out using credentials assigned to Nandwa.
Nandwa was subsequently arrested in Nairobi and presented before the Milimani Law Courts, where he appeared before Magistrate Benmark Ekhubi.
The allegations against Nandwa have not yet been determined by the court. His arrest and court appearance do not amount to a finding of guilt.
Investigators are seeking to establish the full extent of the alleged fraud, how the 70 accounts were created and operated, where the money went, and whether other people were involved.
NCBA Rwanda’s position
As of the publication of this report, BWIZA said it had not received information from NCBA Rwanda confirming that the bank had suffered the reported loss. The outlet indicated that it would share any response from the bank in a subsequent report.
The information in this article was attributed to TUKO.co.ke and had not been independently verified by BWIZA.