A software consultant found himself at the centre of a complex banking fraud investigation after authorities alleged that weaknesses in NCBA Rwanda’s digital banking system were exploited to facilitate transactions worth millions of shillings.
Evans Harry Nandwa, who was working as a consultant with Nairobi-based Ronford Digital Limited, was arrested in June 2025 as investigators pursued the suspected loss of approximately KSh57.5 million from NCBA’s Rwanda operations.
Investigators from the Banking Fraud Investigation Unit (BFIU) subsequently alleged that the access granted to the consultant was exploited to make unauthorised changes to the system.
The alleged changes had significant consequences.
Authorities told the Milimani court that the system was manipulated in a way that allowed transactions to be processed even when some customers allegedly had insufficient funds or accounts that did not exist.
The transactions were reportedly linked to NCBA Rwanda’s mobile banking platform, which operates through the MTN network.
Investigators said the suspected fraud involved 70 customers who initiated 260 transactions, with the total loss estimated at about US$445,000, equivalent to approximately KSh57.5 million at the time.
The revelations raised questions about the security of banking platforms and the risks associated with granting third-party software consultants access to sensitive financial systems.
Why Nandwa was detained
Following his arrest, investigators sought permission from the Milimani court to detain Nandwa for 10 days as they continued examining the alleged fraud.
BFIU investigator Amos Ndonyi told the court that investigators were concerned about Nandwa's access to sensitive digital material.
According to the investigator, Nandwa had access to system logs, remote servers and passwords that could potentially be relevant to the investigation.
Police also argued that holding him was necessary to prevent possible interference with witnesses or digital evidence.
Investigators further alleged that Nandwa was not acting alone and that other individuals suspected of involvement had not yet been arrested.
However, the court did not grant the full 10-day detention period requested by investigators.
Milimani magistrate Benmark Ekhubi instead allowed police to hold Nandwa for five days, with the matter scheduled for mention on June 24, 2025.
The court proceedings placed Nandwa at the centre of an investigation that stretched across Kenya and Rwanda, with authorities attempting to establish how the alleged transactions were initiated, who benefited from them and whether privileged access to the banking platform had been abused.
A case involving digital banking vulnerabilities
The allegations against Nandwa illustrate the increasingly complicated nature of financial crime in an era when banking transactions are largely conducted electronically.
Unlike traditional bank fraud involving forged documents or physical withdrawals, the allegations in this case revolved around access to software and the manipulation of digital systems.
The alleged ability to alter system settings to permit transactions without sufficient funds could potentially expose a financial institution to substantial losses within a short period.
However, the allegations against Nandwa remain allegations unless and until established by a court of law.
While contemporaneous reports confirmed his arrest and the investigations surrounding the alleged KSh57.5 million loss, there was no reliable publicly indexed evidence establishing a final conviction, acquittal or other definitive conclusion to the case.
For that reason, Nandwa's role should be described carefully as that of a suspect or person investigated in connection with the alleged fraud, rather than as a convicted fraudster.
The case nonetheless remains a striking example of how access to sophisticated financial technology can become central to investigations involving millions of shillings—and how a software professional hired to maintain a banking system can suddenly find himself at the heart of a major financial crime investigation.