Hello

Your subscription is almost coming to an end. Don’t miss out on the great content on Nation.Africa

Ready to continue your informative journey with us?

Hello

Your premium access has ended, but the best of Nation.Africa is still within reach. Renew now to unlock exclusive stories and in-depth features.

Reclaim your full access. Click below to renew.

Brian Kithinji Bundi and his mother Ruth Kinya in court
Caption for the landscape image:

Mother and son charged with hacking aid worker's bank account, stealing millions

Scroll down to read the article

Brian Kithinji Bundi and his mother Ruth Kinya at the Milimani Law Courts. They were accused of hacking an aid worker's bank account and stealing more than Sh4.5 million.

Photo credit: Richard Munguti | Nation Media Group

A mother and her son were brought before the Milimani Law Courts in Nairobi for allegedly hacking the bank account of a Kenyan working at a refugee camp in Ethiopia and stealing Sh4.5 million.

Ruth Kinya and her son Brian Kithinji Bundi were detained for five days to assist detectives from the Banking Fraud Investigations Unit of the Central Bank of Kenya (CBK) bring to book the masterminds of the cybercrime that saw millions of shillings wired from the account of Amos Kipruto Chemonges.

The court heard that Mr Chemonges had detected suspicious activity on his account as well as on his credit card earlier this year. He immediately informed his bank on January 12, 2026, saying his account had been compromised.

Upon further inquiry, it was discovered that a fraudulent SIM swap had been conducted on his Safaricom line, enabling unauthorised individuals to gain control of his mobile banking services and access to his account.

The magistrate heard that the SIM swap was carried out without his knowledge and consent.

The complainant further told the Banking Fraud Investigation Unit that he could not have participated in the SIM replacement process in Kenya since he was in Ethiopia at the time.

At the time of the breach, his account did not have much money. However, the alleged fraudsters managed to apply for a top-up loan to the tune of Sh886,000, as well as racking up a bill of Sh262,000 on his credit card. Additionally, they borrowed a digital loan of Sh150,000. In total, they allegedly obtained a total of Sh1,298,000 by manipulating his account, the court heard. 

The trial magistrate heard that Mr Chemonges is based in Ethiopia where he works for a foreign NGO that runs a refugee camp.

“Mr Chemonges learnt about the illegal access to his bank account through a message he received from Absa Bank through his phone,” CBK's Laban Kuhe Kalama testified in court Thursday.

He told the trial magistrate that upon realising he was hacked, he flew back to Nairobi where he filed a report at the Jomo Kenyatta International Airport Police Station upon arrival.

Alleged culprits identified

Brian Kithinji Bundi and his mother Ruth Kinya in court

Brian Kithinji Bundi and his mother Ruth Kinya at the Milimani Law Courts. They were accused of hacking an aid worker's bank account and stealing more than Sh4.5 million.

Photo credit: Richard Munguti | Nation Media Group

Mr Kalama stated that Mr Chemonges liaised with Safaricom about the illegal SIM swap. The telecommunications firm identified the mobile numbers which received the money that left his account, leading to the arrest of Mr Bundi and his mother.

The magistrate heard that Ms Kinya, who operates an M-Pesa outlet, sent the money to her son and two others.

Her son, the magistrate heard, went to withdraw the cash but could not since Safaricom had suspended his M-Pesa account.

“He was referred to Safaricom headquarters from Meru to have his complaint addressed,” Mr Kalama stated.

Applying for the mother and son to be detained for five days, Mr Kalama told the magistrate that he is investigating several offences.

“That I am undertaking investigations into alleged offences of stealing including stealing contrary to Section 268 (1) as read with Section 275 of the Penal Code, Acquisition of proceeds of crime contrary to section 4(a) as read with section 16 (1) of the proceeds of crime and anti-money laundering Act No 9 of 2009,” he told the court.

He added that he is also investigating offences of being in possession of proceeds of crime.

In his ruling, the magistrate said investigators had satisfied the court that they deserve to question the suspects since the probe is complex and involves forensic examination of gadgets used in executing the fraud.

“I am inclined to allow the application by the police so that justice can be done since this is a matter of great public interest,” ruled the magistrate.

He directed that the suspects be held at the Capitol Hill Police Station until April 1, 2026 when they will be returned to court for further directions.

Follow our WhatsApp channel for breaking news updates and more stories like this.