The request appeared harmless. Two customers walked into Benter Awino’s clothes shop in Fore Farm, Majengo Kanamai, Kilifi County, at about 5pm on August 30 and bought clothes worth Sh1,000.
But when it was time to pay, one of the two men claimed that his M-Kopa phone had been locked because of an outstanding payment.
M-Kopa phones are affordable smartphones offered through a flexible pay-as-you-go financing model. Customers make a small initial payment and then repay the balance in daily, weekly or monthly instalments while using the phone. Failure to do so results in the phone being locked.
At the shop, the customer asked Ms Awino to help him complete the transaction using her phone, and she obliged. Hours later, Sh21,291 had disappeared from her mobile money accounts.
Her ordeal is now part of a growing trail of similar incidents in the Coast region, where traders are allegedly being lured into handing over their phones to customers claiming that their M-Kopa devices have been locked.
The suspects appear to be exploiting a simple and believable problem — a locked phone — to gain access to traders’ devices before money is siphoned from their M-Pesa, Pochi la Biashara and other mobile money accounts.
On that day, Ms Awino, like any other trader, welcomed the two men, hoping the evening customers would bring a good end to what had been an ordinary business day. She had no idea that the seemingly routine transaction would later leave her counting losses.
One of the men initially gave her an account number and a PayBill number, but the transaction failed. He then asked her to remove her SIM card from her phone and insert it into his device so that he could make the payment.
He promised to reimburse her Sh1,050, comprising Sh1,000 for the clothes and Sh50 for the transaction fees.
Ms Awino told police that the two men left the shop. About two hours later, the first alerts started arriving.
Sh15,622 had been taken from her Pochi la Biashara account, another Sh4,131 from M-Pesa and a further Sh1,200 through Fuliza, bringing her total loss to Sh21,291.
On August 31, at about 2pm, Brian Chege Ngugi was at his shop in Mtwapa when two men approached him with a similar story.
Their M-Kopa phone had allegedly been locked because of non-payment. They needed to make an urgent payment to unlock it and asked to use his phone.
“I gave them my phone and they used it. They then promised me they would come back after one day,” Mr Ngugi told police.
They never returned. When Mr Ngugi later checked his M-Pesa account, he discovered that Sh22,000 had been withdrawn. He then reported the matter to police.
The same pattern emerged in the case of Ruth Waithera, who runs a grocery business in Mtwapa.
At about 7pm on August 30, an unfamiliar customer approached her and asked to use her phone to transfer money because his own device had allegedly been locked.
A simple request to use a phone left several Coast traders counting losses.
Photo credit: Pool
“The customer told me his mobile phone was locked since it was not paid for and requested me to help him with my phone so that he could transfer the cash,” she reported.
After the customer left, Ms Waithera discovered hours later that Sh12,699 had been taken from her M-Shwari and M-Pesa accounts. The money was sent to an account registered in the name of Sofia Aoko Patrick.
Then there is the case of Nasambu Elizabeth, whose clothes shop near Kalu Works in Mtwapa was visited by four customers — two men and two women — at about midday on August 30.
The group bought clothes before one of them raised the now-familiar M-Kopa explanation. The phone had an outstanding debt and could not function until the payment was made.
It was not until about 8pm, while she was at home, that she received a notification showing that Sh12,602 had been paid to a till number registered in the name of Sofia Aoko Patrick.
“I gave her my phone, which they accessed to make the payments,” Ms Nasambu told police.
The four cases have now become part of a police investigation into whether the incidents are connected and how the suspects allegedly gained access to the victims’ mobile money accounts.
Three suspects, Bryan Kipruto, Peter Kibet and Rose Chelangat, are being held as detectives pursue the investigation. On Monday, the three were arraigned before the Shanzu court, where detectives sought 14 days’ custodial orders to complete their investigations.
The court granted the application and authorised detectives to examine the suspects’ mobile phones, obtain their M-Pesa and Airtel statements, and establish details relating to the till numbers allegedly used to receive money from the victims.
Investigators were also authorised to identify and record statements from crucial witnesses as they piece together how the alleged fraud was executed and trace the movement of the missing money.
Documents filed by Police Constable Amos Kerina detail the cases involving Elizabeth, Awino, Ngugi and Waithera, all of whom allegedly lost money after handing over their phones to customers who claimed they needed the devices to complete payments.
In an affidavit filed in court, Mr Kerina said detectives had yet to complete several critical aspects of the investigation.
These include recording statements from complainants and witnesses in Kilifi, Mombasa and Kwale counties, conducting identification parades and submitting the suspects’ phones to DCI headquarters for cybercrime analysis.
Detectives are also seeking certified M-Pesa and Airtel statements from Safaricom and Airtel to establish the transactions and trace the movement of the money allegedly stolen from the complainants.
Another piece of the puzzle is establishing the ownership of the various till numbers allegedly used to receive the money. Mr Kerina told the court that investigators were yet to establish the ownership and other details of the tills.
The police also opposed the suspects’ release, describing them as flight risks because their places of residence were allegedly unknown and they had been arrested while preparing to travel to Kericho.
The officer further raised concerns about their safety, saying their arrest had caused tension in Mtwapa Township. He asked the court to allow the suspects to remain at Mtwapa Police Station for 14 days to give detectives time to complete the outstanding inquiries.
“We need two weeks to record statements from crucial witnesses residing in Kilifi, Mombasa and Kwale, conduct identification parades and analyse the suspects’ phones at the DCI Cyber Crime Headquarters,” Mr Kerina said.
He added that the period would enable investigators to complete the probe before deciding on the next course of action. The officer acknowledged that continued detention would interfere with the suspects’ right to liberty but said such detention could only be authorised by the court.
The suspects, who were not represented by lawyers, did not oppose the application but asked the court to shorten the 14 days, arguing that it was too long.
They urged the court to expedite the investigations and conclude them as soon as possible, asking to remain in custody only for the period necessary for detectives to complete their inquiries. The court, however, granted the police application.
