19 individuals arrested in connection with Equity Bank Kenya’s $2.1 million debit card fraud investigation

Equity Bank, headquartered in Kenya, recently fell victim to a debit card fraud incident in which hackers absconded with $2.1 million. The bank, which holds the title of Kenya’s largest, forwarded a detailed correspondence to the nation’s Directorate of Criminal Investigation, chronicling the illicit transfer of the pilfered funds across a vast network of more than 500 bank and mobile money accounts.

As of the latest update, Equity Bank had taken swift action by freezing all accounts implicated in receiving the misappropriated money and had successfully detained 19 individuals linked to the fraud.

The law enforcement authorities, currently deep in the throes of the investigation, are determined to track down and apprehend every individual involved in the criminal activity.

It was revealed that the fraudsters employed a “card-not-present” method, using illicitly obtained card information to make online purchases, thereby swindling victims. The endgame for such frauds typically involves laundering the ill-gotten gains through transfers into various other bank accounts.

Gerald Munyiri, General Manager of Security at Equity Bank, signed off on a letter summarizing the initial findings of the investigation. The letter indicated that between April 9th and 15th, 2024, a total of KSh 179.6 million ($1.3 million) was siphoned off in fraudulent transactions to 551 accounts within Equity Bank.

Additionally, the telecom giant Safaricom was hit with fraudulent transfers amounting to KSh 63 million ($478,360), while eleven other commercial banks saw KSh 39 million ($296,015) diverted to them through this scheme.

The correspondence from Equity Bank to the relevant authorities also highlighted that the institution is actively cooperating with Safaricom and the other affected banks to trace the routing of the stolen funds.

In Kenya, banking regulations mandate that customers must provide detailed information for any transactions exceeding $10,000. On the other hand, mobile wallets are restricted to a transaction limit of $1,900 daily, with an overall cap of $3,800. Consequently, to execute the sizeable fraudulent activity successfully, the perpetrators would have had to carry out multiple transactions in smaller batches to stay under the radar.

The rising tide of fraud has become an increasingly pressing issue within Kenya’s financial services sector. As reported by the Financial Reporting Centre (FRC), the country’s watchdog for financial transactions, a staggering sum exceeding $600 million has been flagged over the past three years up to July 2023. This significant amount of money has been associated with credit card fraud, corruption, and the financing of terrorism. The FRC’s mandate involves the scrutiny and analysis of financial activities across the nation’s banks to identify and combat such illicit transactions.

The timing of the fraud incident at Equity Bank is particularly noteworthy, as it occurred just days after the Kenyan National Assembly gave the nod to the Computer Misuse and Cybercrime (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024.

These newly approved regulations are poised to establish a comprehensive structure for the oversight, detection, and resolution of cybersecurity threats that loom over Kenya’s digital landscape. The provisions included in this legislative framework are designed to tackle a wide array of cybercrimes, including but not limited to scams, identity theft, hacking, and various forms of Internet fraud.

The anticipation is that this robust regulatory approach will serve as a bulwark against the ever-increasing challenge of cybercrime, safeguarding the integrity of Kenya’s financial infrastructure and its citizens’ data. With mechanisms for swift identification and action against cyber threats, the regulations represent a significant step forward in enforcing cybersecurity and providing a safer environment for digital transactions.