NCBA Bank is reeling from a massive fraud scandal that has exposed gaping holes in its internal controls, with losses mounting past Sh517 million in separate incidents involving rogue employees and compromised IT systems.
The banking giant now faces uncomfortable questions about how senior staff managed to siphon millions of shillings under the noses of management, while third-party contractors walked away with hundreds of millions more by tampering with critical security systems.
At the heart of the scandal is Philip Rotich Kiprono, an operations manager at NCBA’s Kisii branch, who allegedly orchestrated a sophisticated fraud scheme that robbed customers of at least Sh52 million between December 2022 and October 2024.
Court documents reveal Kiprono faces a staggering 134 criminal charges including theft by servant, forgery, and money laundering.
The modus operandi was brutally simple yet devastatingly effective.
Kiprono would receive instructions from wealthy clients to transfer funds internally, but instead diverted the money into bank accounts belonging to his associates.
Among the victims were a Catholic diocese that lost Sh9 million, a bishop who was fleeced of another Sh9 million, and businessman Neel Gudkas who saw Sh14.7 million vanish from his account.
What makes this scandal particularly damning is that Kiprono allegedly continued defrauding customers even after being suspended, exploiting the fact that clients still believed he was on duty.
The bank’s head of security, Noah Cheptumo, told investigators that Kiprono had taken advantage of the trust bestowed on him by big clients and colleagues to pull off the heist.
But the Kisii fraud is just one piece of a larger crisis engulfing NCBA.
The bank also lost a separate Sh57.5 million to a software developer contracted to maintain systems at its Rwandan subsidiary.
The consultant allegedly tampered with the mobile and retail banking platform, clearing cash withdrawals even from non-existent accounts or those with insufficient funds.
In just eight days in June 2025, 70 customers initiated 260 fraudulent transactions.
These incidents come against the backdrop of a wider banking sector crisis highlighted by the Financial Reporting Centre, which documented how another Kenyan bank lost Sh517 million after contractors downgraded card security systems.
The criminals altered authentication protocols, created unauthorized customer wallets, and laundered the stolen funds through cryptocurrency exchanges.
The pattern is clear and troubling.
Third-party service providers and trusted employees are exploiting weak oversight to commit massive fraud.
For NCBA, the damage goes beyond financial losses. The bank’s reputation has taken a severe beating, with customers openly questioning whether their deposits are safe or just one dishonest employee away from vanishing.
Senior Principal Magistrate Benard Obae Omwansa has ordered Kiprono to appear in court to answer to the charges.
If convicted, he faces severe penalties including lengthy jail terms.
But prosecution of individual criminals does little to address the systemic failures that enabled these frauds in the first place.
The Central Bank of Kenya has been urging banks to enhance audits of staff and third-party contractors, particularly those with access to critical IT systems and customer data.
But the NCBA cases suggest these warnings have gone unheeded.
How does a financial institution of NCBA’s size fail to detect suspicious fund movements until losses hit Sh52 million? Why weren’t there adequate controls to prevent contractors from downgrading security systems?
For ordinary Kenyans who entrust their life savings to banks, the NCBA scandal is a sharp reminder that even institutions meant to safeguard wealth can become vehicles for its theft.
The Kisii case is more than just one man on trial.
It is an indictment of negligent supervision that opens the door to massive fraud, and a warning that without strict accountability, no customer’s money is truly safe.
