From Kigali to Nairobi, Equity Bank hit by a string of heists

Over the past 18 months, Equity Group Holdings, East Africa’s largest bank by customer base, has been battling an invisible enemy from within. From a sophisticated cyber heist in Kigali that exploited digital currency floats to a billion-shilling conspiracy masterminded by a city lawyer and a missing bank manager in Kenya, the lender has lost more than Sh1.9 billion to alleged internal theft.

Court records, police affidavits, and regulatory disclosures obtained by The Saturday Standard paint a picture of a relentless cat-and-mouse game, where bank employees, IT wizards, and external fraudsters who have systematically probed the lender’s defences.

While Group CEO James Mwangi has vowed to be “ruthless” in his pursuit of the perpetrators, the mounting toll reveals the vulnerability of East Africa’s rapidly digitising financial sector.

The most recent incident, and perhaps the most technically audacious, unfolded in Rwanda early this week.

Equity Bank Rwanda, a subsidiary of the Nairobi-based giant, detected unusual activity in its systems over the weekend of March 14, triggering an immediate lockdown.

By the time the digital dust settled, the bank had lost approximately $4.3 million, equivalent to more than Sh559 million.

According to the Rwanda Investigation Bureau, which has since arrested 35 suspects, the fraud was not a simple smash-and-grab but a sophisticated exploitation of the bank’s mobile money float system.

Investigators told reporters in Kigali that the syndicate used suspicious SIM cards, some registered outside Rwanda, to purchase unusually large mobile money floats, effectively bypassing daily transaction limits designed to prevent such large-scale bleeding.

“What we saw were SIM cards buying float of up to $72,000 (approximately Sh9.3 million). Some of those SIM cards had never previously received even $1,” a bank official familiar with the investigation told Taarifa Rwanda. 

Among the 35 suspects in custody are two IT employees working in the bank’s data centre operations. Their arrest points to an inside job, suggesting that the fraudsters had help navigating the bank’s digital infrastructure.

Authorities in Uganda are also involved in the probe, as six of the suspects were arrested across the border, highlighting the cross-border nature of the conspiracy.

In a statement released on March 15, Equity Bank Rwanda moved to reassure customers, emphasising that no client deposits were lost. The bank stated that its internal monitoring systems triggered immediate containment protocols, allowing for the majority of the fraudulent transactions to be reversed within 24 hours. 

Of the Sh416 million stolen, only about Sh106 million has so far been recovered. Approximately Sh310 million remains in limbo as forensic teams comb through servers and seized devices. 

While Rwandan authorities were rounding up suspects in Kigali, Kenyan detectives were still piecing together the remnants of a far larger heist that occurred last year, a case involving a missing bank manager, a high-profile city lawyer, and a convoluted money trail stretching to the United Arab Emirates.

The trouble began in July 2024. On July 10, the internal control department at Equity Bank’s headquarters in Nairobi detected a flurry of suspect transactions emanating from the bank’s internal Salaries Remittance General Ledger Account. A total of 47 withdrawals had been processed, funnelling funds to accounts in other banks with fictitious transaction details.

Upon closer scrutiny, the bank discovered a staggering Sh1.5 billion had been stolen over a 90-day period between May and July 2024. The credentials used to authorise the transfers belonged to David Machiri Kimani, a 39-year-old manager at the bank’s Group Processing Centre, Salary Processing Unit. 

Kimani was arrested and arraigned on July 12, 2024. But he would never face trial. On August 11, 2024, while his family was in church, gunmen believed to be security agents seized him from his Thogoto home in Kiambu. He has not been seen since.

With the prime suspect missing, detectives from the Banking Fraud Investigations Unit turned their attention to the money trail.

By October 2024, they had identified a new central figure: Esther Bitutu Kadiki, an advocate of the High Court of Kenya. 

According to court documents filed at the Milimani Law Courts, Bitutu is alleged to have been the mastermind behind the laundering of the funds.

Police investigations revealed that Sh1.5 billion was not just sitting in beneficiary accounts; it was being actively layered through a complex web of transactions.

The DCI told the court that the money was moved through bulk withdrawals, transfers to multiple bank accounts, and, crucially, the purchase of cryptocurrencies to mask the illicit source.

The police affidavit stated that Bitutu was an “integral player” who acted as a recruiter of proxy companies and individuals whose accounts were used to launder the money. 

“She played a part in drafting business transaction agreements between companies on non-existing business activities, which agreements were used to explain the source and or for the justification of the large cash withdrawals from the benefiting accounts,” Inspector Chrispinus Sore Shibanda told the court.

An analysis of bank accounts linked to Bitutu showed that Sh38 million was deposited into accounts belonging to Inforide Point Ltd (a company she co-owns with her husband) and Kadiki & Advocates.

Police allege that in all instances, fictitious narrations regarding the source of the funds were entered into bank systems to conceal their origin.

Bitutu, who had failed to honour police summons since October 2024, finally presented herself  for arrest in May 2025. Despite the prosecution opposing her bail, citing her as a flight risk, she was released on bond

The case has since seen multiple mentions, with the Director of Public Prosecutions vowing to conduct a thorough money trail. 

Beyond the billion-dollar conspiracies, 2025 saw a steady drumbeat of smaller, yet equally damaging, thefts at the branch level across Kenya. 

In July 2025, Francis Njuguna Kamau, a former employee at Equity Bank’s Makongeni branch in Thika, was granted bail of Sh400,000 after being charged with stealing Sh2.19 million from customer accounts. Court documents revealed he stole Sh1.75 million between July and August 2024, and a further Sh443,691 in a separate incident. 

Just two months later, in September 2025, Debra Nyanduko Ombwonge, a teller at the Tom Mboya branch in Nairobi, was arraigned for allegedly stealing Sh2.4 million from the bank between April 6 and April 24, 2023.

The trend continued into November 2025. Elijah Ndungu Gachanja, a Relationship Officer, and Kevin Omato Manwa, a Relationship Supervisor, appeared before Principal Magistrate Rose Ndubi. They were accused of conspiring to steal and actually stealing Sh4 million from the bank’s Westlands branch on November 3, 2025, despite being based at the Githurai branch.

In response to the cascading crisis, Group CEO James Mwangi has taken a hardline stance.

In 2025, following investigations that uncovered widespread collusion, the bank dismissed more than 1,200 employees in Kenya.

To plug the gap, Mwangi has turned to technology. The bank has aggressively deployed artificial intelligence (AI) to monitor transactions in real-time.

“When every fraud occurs, we feed it to the AI to discover its uniqueness, and we then pull that transaction for screening,” Dr Mwangi explained in an earlier interview.

“We are making every effort because one fraud is too many, as that could be the only money a customer has in the account.’’