A Kenyan IT graduate has been placed at the centre of a KSh 57.5 million fraud investigation at NCBA Bank’s Rwanda subsidiary.
This is after investigators allegedly traced suspicious changes to the bank’s core application code to credentials assigned to him.
Suspicious code changes
Evans Nandwa, an employee of technology consultancy firm Ronford Digital Limited, had reportedly been granted access to the bank’s live backend systems during a scheduled maintenance exercise on June 6, 2025.
According to the Directorate of Criminal Investigations (DCI) Banking Fraud Investigations Unit, the access was meant to facilitate maintenance and upgrades involving the bank’s mobile-money connection to MTN Rwanda.
Investigators allege that about three minutes after Nandwa’s access was activated, his credentials were used to modify part of the bank’s core application code.
The alleged alteration affected the logic used to process withdrawals through the MTN Rwanda mobile-money network.
70 accounts allegedly used
According to the court documents, the modified code was configured to recognise 70 specific accounts.
When transactions originated from those accounts, investigators allege, the system would return a “successful” response while bypassing normal validation checks.
This meant the system did not properly establish whether the accounts had sufficient funds or were legitimate before processing the transactions.
The DCI alleges that the 70 accounts were ghost profiles, with some reportedly linked to cloned or fraudulently registered SIM cards created using stolen identification details.
KSh 57.5m allegedly paid out
Investigators believe restricting the alleged loophole to a limited number of accounts may have allowed the activity to continue without immediately drawing attention.
For several days, the bank’s systems continued to operate normally as transactions involving the selected accounts were processed through the MTN Rwanda network.
The alleged activity continued between June 6 and June 14 before the discrepancy was discovered during an end-of-week reconciliation.
MTN Rwanda records showed that 260 transactions involving the 70 accounts had resulted in approximately KSh 57.5 million being paid out.
Activity Traced to Nandwa’s Credentials
NCBA’s internal records, however, allegedly did not show corresponding legitimate debits from the accounts or other records supporting the transactions.
The mismatch prompted an internal investigation by the bank, which revoked third-party access credentials and began reviewing changes made to its systems during the maintenance period.
Engineers subsequently conducted a forensic examination of the application’s code and access records.
The DCI Banking Fraud Investigations Unit later took over the criminal investigation and traced the suspicious modification to activity carried out using credentials assigned to Nandwa.
Nandwa Arraigned in Court
He was subsequently arrested in Nairobi and presented before the Milimani Law Courts, where he appeared before Magistrate Benmark Ekhubi.
The allegations against Nandwa have not been tested or determined by the court, and his arrest or appearance in court does not amount to a finding of guilt.
Investigators are seeking to establish the full extent of the alleged fraud, how the 70 accounts were created and operated, where the money went and whether other people were involved.
