Three suspects linked to a sprawling electronic fraud syndicate will remain in police custody for ten days as detectives intensify investigations aimed at apprehending 18 additional individuals implicated in a high-value digital heist.
The suspects—Peter Kariuki Mathii, Issak Mugo Kanini, and David Nganga Macharia—were arraigned in court following their arrest by the Directorate of Criminal Investigations (DCI).
They are accused of accessing and draining over KSh 3 million from a complainant’s bank accounts through unauthorized transactions.
Their arrest followed a public appeal by the DCI, which released images of the suspects alongside 21 individuals declared wanted in connection with the scheme.
The appeal generated crucial leads, culminating in the trio’s apprehension and court appearance. According to documents presented in court, the suspects form part of a broader syndicate targeting mobile and online banking platforms.
One victim, identified as Hassan, a Nairobi resident, became a central figure in the case after falling prey to a targeted robbery. While driving along Racecourse Road toward Pangani, Hassan’s car was deliberately rammed on both sides by unknown assailants.
Mistaking the incident for a traffic accident, he was ambushed and robbed of his iPhone 16 Pro Max, worth KSh 178,000. Investigators say the attackers used the phone to access Hassan’s digital accounts by linking it to a Safaricom SIM card registered in his name, setting off a cascade of fraudulent financial activity.
Investigations revealed a complex network of transactions that moved large sums of money across multiple banks. From Hassan’s Equity Bank account alone, funds were transferred to various recipients, including National Bank accounts held under the name Frederick M. Wairimu (receiving KSh 50,000 and KSh 299,500), Consolidated Bank accounts (also under Wairimu, receiving KSh 150,000 and KSh 190,000), Co-operative Bank (under Brian Machani, KSh 299,500), and another Co-operative Bank account (under Brian Obaye Kiveu, KSh 499,500). In total, KSh 1.48 million was siphoned from Hassan’s accounts through these transactions.
Further analysis revealed that an additional KSh 404,125 was moved from Hassan’s Equity Bank account to his own mobile number, which had already been compromised. The funds were then rerouted to an encrypted Safaricom M-Pesa account, now under investigation by service providers.
The syndicate’s operation extended to Absa Bank, from which KSh 810,000 was funneled into several accounts, including: &M Bank (Bonface Kirimby Maina – KSh 299,500), Co-operative Bank (John Eric – KSh 299,500), Stanbic Bank (Jumbo Pay Trust – KSh 180,000), and Consolidated Bank (KSh 26,000). An additional KSh 501,615 was transferred to seven different Safaricom M-Pesa contacts linked to the fraud.
Detectives later uncovered another staggering KSh 3.2 million, believed to have been fraudulently transferred through encrypted Safaricom lines without the victim’s knowledge. These transactions form a significant part of what authorities describe as a well-organized and technologically sophisticated cybercrime operation.
Upon the suspects’ arrest, one led investigators to Ruiru Town, where another suspect was located inside a silver Toyota Voxy.
A subsequent search yielded multiple Safaricom SIM cards, SIM registration gadgets, counterfeit U.S. dollars, and a variety of ATM cards—including two linked to Bonface Kirimby Maina and Frederick Wairimu Maina, both previously flagged in the investigation.
While investigators had sought 21 days to finalize forensic reviews and expand the scope of the probe, the court granted a 10-day custodial period to allow detectives to complete their analysis and pursue additional suspects. Authorities have vowed to dismantle the cyber syndicate in its entirety as investigations continue.
