Inside the Heist: How an Equity Bank Employee Stole Ksh387M in Plain Sight

In May and June 2024, Equity Bank faced a significant internal fraud incident. An employee illicitly transferred Ksh386.5 million to eight companies.

• Duration: May 17, 2024, to June 14, 2024

• Amount Stolen: Ksh386,500,320

• Recipient Companies:

  • Ubahashi Traders Limited
  • Calabash Adventures Limited
  • Jahnur Investment
  • Kariye Investment
  • Flowerish International
  • Kariye Salah Ali
  • Hotho Investments
  • Sasa Pay Trust

Discovery and Immediate Actions:

Upon detecting the unauthorized transfers, Equity Bank:

• Notified the Banking Fraud Investigation Unit of the Directorate of Criminal Investigations (DCI)

• Sought court orders to freeze the accounts of the implicated companies

Breakdown of Funds Transferred:

• Ubahashi Traders Limited: Ksh207,720,020

• Kariye Investment Limited: Ksh85,740,300

• Calabash Adventures Limited: Ksh32,000

• Flowerish International Limited: Ksh11,000,000

• Kariye Salah Ali: Ksh6,000,000

• Hotho Investments Limited: Ksh93,040,000

• Jahnur Investments Limited: Ksh18,500,000

• Sasa Pay Trust: Ksh88,000,000 (with a lien request of Ksh26,500,000)

Defense by the Accused Companies:

The companies contested the freezing of their accounts, stating:

• Their primary business involved imports, often requiring US dollars

• They were approached by an individual named Geoffrey Kiragu, who claimed to be a property agent needing to convert large sums into US dollars

• They received the funds, converted them, and earned a commission

• They were unaware the money was stolen and cooperated with authorities in apprehending Geoffrey

Court’s Decision:

High Court Judge Alfred Mabeya ruled in favor of Equity Bank, emphasizing:

• The doctrine of tracing, establishing that the stolen funds ended up in the defendants’ accounts

• The significant risk of fund dissipation if accounts were not frozen

Reflection and Questions:

• Internal Controls: How robust are your organization’s internal controls? Could they detect and prevent similar fraudulent activities?

• Third-Party Interactions: When engaging with new business partners, especially those offering large transactions, do you conduct thorough due diligence?

• Legal Preparedness: Is your organization prepared to take swift legal action in the event of internal fraud?

Preventive Measures for Organizations:

• Implement Strong Internal Controls: Regularly review and update internal processes to detect anomalies.

• Conduct Regular Audits: Schedule both internal and external audits to ensure financial integrity.

• Employee Training: Educate staff about ethical standards and the consequences of fraudulent activities.

• Due Diligence: Thoroughly vet third-party partners before engaging in financial transactions.

• Whistleblower Policies: Establish clear channels for employees to report suspicious activities without fear of retaliation.

 

HERE IS THE STORY

In recent years, Equity Bank has faced multiple fraud incidents across East Africa, highlighting vulnerabilities within its operations.

Kenya: The Case of Faith Wanjiku

In September 2019, 73-year-old Faith Wanjiku accused Equity Bank of unauthorized withdrawals totaling Ksh970,216 from her account via the Eazzy App. Despite not owning a smartphone or using the app, funds were transferred in four installments to various individuals. Wanjiku reported the incident, but the bank’s internal investigations suggested potential compromise of her PIN, possibly due to assistance from her sister during ATM withdrawals. Wanjiku denied this, emphasizing her sister’s role as a trusted caretaker. The Directorate of Criminal Investigations (DCI) took up the case, but the outcome remains unclear.

 

Kenya: Arrest of Peter Cheruiyot

In October 2019, police arrested 26-year-old Peter Cheruiyot in Mulot, Bomet County, for allegedly stealing over Ksh400,000 from various Equity Bank accounts. The Directorate of Criminal Investigations (DCI) recovered multiple phones and identification cards from his residence. The DCI signaled other police stations with similar fraud cases to liaise for further investigations.

 

Uganda: Loss of UGX 47 Million

In February 2023, Equity Bank Uganda investigated a case where customer Rose Ahebwa lost UGX 47 million from her account. Ahebwa claimed that after opening an account and depositing the money in December 2022, she received a call from someone posing as bank customer service. Subsequently, her account was emptied. Despite reporting the incident, Ahebwa felt the bank was unresponsive, leading her to seek legal assistance. Equity Bank acknowledged the incident and stated that investigations were ongoing, including collaboration with relevant authorities.

 

Rwanda: Conviction of Hackers

In July 2021, a Rwandan court sentenced eight Kenyans and one Ugandan to eight-year jail terms and fined them Rwf56 million for attempting to hack into Equity Bank’s systems. The group was arrested in 2019 by the Rwandan Investigation Bureau (RIB) while trying to access bank accounts and transfer funds to local accomplices. They faced charges including unauthorized access to computer systems, data theft, and forming a criminal association.

Analysis and Implications

These incidents underscore the challenges faced by financial institutions in safeguarding customer assets. The recurring nature of fraud across different countries suggests systemic vulnerabilities within Equity Bank’s operations. While the bank has acknowledged these incidents and initiated investigations, the frequency and similarity of these cases raise concerns about the effectiveness of its security measures.

Recommendations for Equity Bank

1. Enhance Security Measures: Invest in advanced cybersecurity infrastructure to detect and prevent unauthorized access.

2. Customer Education: Implement comprehensive programs to educate customers about potential fraud schemes and safe banking practices.

3. Regular Audits: Conduct frequent internal and external audits to identify and address security loopholes.

4. Collaboration with Authorities: Strengthen partnerships with law enforcement agencies to ensure swift action against fraudulent activities.

5. Transparent Communication: Maintain open channels with customers regarding security issues and remediation efforts to rebuild trust.

The series of fraud incidents across Kenya, Uganda, and Rwanda involving Equity Bank highlight the critical need for robust security protocols in financial institutions. Addressing these challenges requires a multifaceted approach, combining technological investments, customer awareness, and proactive collaboration with authorities.