A sophisticated cybercrime syndicate that had been wreaking havoc since January 2024 has been dismantled by the Directorate of Criminal Investigations (DCI).
The gang, linked to the infamous Mulot mobile phone fraudsters , is believed to have siphoned more than Sh11.8 million from victims across Nakuru, Nyahururu and surrounding towns.
DCI investigations reveal that the syndicate mainly targeted retirees, particularly women, shortly after their pension funds hit their accounts.
Businesspeople were also among the prime targets, with the fraudsters using spoofing technology to impersonate bank and telecom customer service agents, tricking victims into sharing sensitive information.
The gang, linked to the infamous Mulot mobile phone fraudsters, is believed to have siphoned more than Sh11.8 million from victims.
Photo credit: File
Once the criminals struck, they would promptly dispose of their Safaricom lines and switch off phones to evade detection. However, a costly mistake by one of the suspects led to their arrest. The suspect used a stolen phone and forgot to switch it off, and detectives were able to triangulate the location and track down the gang to a hideout in Nyali, Mombasa.
A six-man team was arrested in a raid at APA Apartments House No B2 (short-term rental) along 1st Avenue in the posh Nyali estate. The apartment had been converted into a cybercrime operations hub equipped with 19 mobile phones, multiple SIM cards from various carriers, including Safaricom, Airtel, Telkom and MTN Uganda, and a logbook with names of potential victims.
The arrested suspects are Fortune Muthina Kinyanzui, alias Albanas Kyalo (believed to be the mastermind), Ruel Kipkoech Yator alias Papa Ruel, Laban Kipkirui Koech, Weldon Kipyegon Rono, Towet Kipkorir and Kelvin Kipyegon Koech.
The DCI used mobile phone signal triangulation technology to carry out the successful operation. One stolen phone, which had remained off, was eventually switched on—providing the detectives the breakthrough they had been waiting for.
According to DCI boss Mohamed Amin, the gang employed a spoofing application that enabled them to mask phone numbers and make calls that appeared to originate from legitimate customer care centres. This helped them convincingly pose as bank or telecom agents.
“Victims, panicked by urgent-sounding calls, would unknowingly reveal their banking credentials,” the DCI said.
Directorate of Criminal Investigations (DCI) Director Mohamed Amin during a press briefing in Nairobi on October 30, 2024.
Photo credit: File | Nation
Investigations further revealed that the spoofing application was being provided by Fortune Muthina at a fee. He charged his accomplices Sh16,000 daily for airtime to keep the spoofing software operational and pocketed between Sh30,000 and Sh120,000 daily depending on the loot. The application itself reportedly costs over Sh500,000 to acquire and configure, including setting up the necessary IP addresses for it to function.
“This syndicate was well-coordinated and ran like a business,” said a senior detective involved in the investigation. “Some of them were moving over a million shillings a day in fraudulent transactions.”
The suspects have been detained at Capitol Hill Police Station as investigations continue and authorities are pursuing more suspects believed to be connected to the syndicate, which is thought to have branches across several towns.
A number of victims have already come forward. On January 17, 2025, a businessman in Nyahururu reported losing Sh3.4 million. Two months later, on March 14, a businesswoman in the same town woke up to an empty bank account, having lost Sh1.8 million.
In Nakuru, a businessman lost Sh1.3 million on April 7 after receiving a fraudulent call he believed was from his bank. On the same day, an elderly woman lost Sh1.2 million in a similar scam. Earlier this year, a retired Ministry of Lands employee lost her entire pension of Sh2.3 million. In another case, two employees of the Nakuru County Government were defrauded of a combined Sh3.1 million in January.
The stolen funds were usually transferred to bank or mobile accounts opened using stolen national identity cards, making tracing and recovery difficult.
"Investigations are ongoing to determine how the money was withdrawn and distributed," said a detective, who declined to be named due to protocol.
The DCI has warned the public to remain vigilant, especially when receiving unsolicited phone calls from people claiming to be bank or telecom agents. The DCI has urged Kenyans not to share personal information over the phone and to verify such calls by contacting their banks directly.
