University student who bought two planes and lived life in the fast lane

Shortly after his cousins were jailed, Ndungi jumped into the fray. And the returns were so good that, in 2012, just two years after graduating, Ndungi had bought himself two Cessna planes with registration numbers 5Y-CCN and 5Y-CCO.

Ndungi was only 23 and pursuing an engineering degree at the University of Nairobi when he started leading a flamboyant lifestyle. A quiet and geeky person, according to those who know him, Ndungi’s personality in university was an exact opposite of who he was in primary and secondary school.

After sitting his Kenya Certificate of Primary Education exams at Unoa Primary School in Wote in 1999, Ndungi joined Alliance High School after posting excellent grades. His schoolmates say he was very religious and an official of the Christian Union. He couldn’t hurt a fly, they say, although that quietness did mask his other side.

A friend who bumped into him in 2005, just two years after high school, when Ndungi was a first year student at the University of Nairobi, was surprised to see him driving a brand new Subaru. As other students were cramming themselves in hostels after lectures, Ndungi drove himself to his own house in Nairobi’s South B, a middle-class neighbourhood.

He was wealthy when we were in campus

“He was wealthy when we were in campus and had several fuel guzzlers — a BMW, a Mercedes Benz and several Subarus,” a former classmate told the Nation.

With no known sources of income, Ndungi’s flamboyant lifestyle was definitely questionable, but his classmates had no clue where he was getting his money. It was assumed that his mother, who was based in Kansas, USA, was financing his lifestyle.

But Ndungi had possibly been introduced to the vice by his uncle Paul Kilungya Nyumu, the man who introduced his entire family to cybercrime before vanishing. Nyumu had also played a big role in laundering funds stolen by his two nieces, Wavinya and Nzongi.

It’s not known if some of this money was used to finance Ndungi’s flashy lifestyle while still in campus. What’s known, however, is that Ndungi had over a period of three years watched from the front row how the proceeds of cybercrime could finance someone’s lifestyle and he wanted in.

He was not alone. Also watching on the sidelines was Ndungi’s uncle, Robert Mutua Muli, who was by then based in Virginia, US.

Muli is a cousin of Nyumu, the fugitive and original mastermind of the tax filing syndicate.

Another entrant was Nyumu’s daughter, Monica, who had relocated to the US after abandoning her teaching career in Kenya. Monica is Ndungi’s mother.

From the beginning, the family relied on Monica’s salary. But as the money started flowing – and everyone could notice – her husband, a former councillor in Wote, was forced to relocate to Mlolongo following frequent attacks by armed robbers who wanted a share of their new-found riches.

Ndungi was by this time engaged in cyber fraud in Kenya, Nigeria, North Africa and the United States. He started by hacking into Multichoice systems, which enabled him to mint cash from illegal distribution of DSTV signals.

Stealing identities

Then, he joined the tried-and-tested family business: stealing the identities of American citizens and using them to claim fake tax refunds. But since he had seen his two cousins get jailed for similar crimes, Ndungi opted to use Nairobi as his base. That way, he thought, he was safe.

Meanwhile, his uncle Muli decided to try his hand at an entirely new type of cyber fraud known as Business Email Compromise.

Muli’s gang, which comprised criminals based in Kenya, would hack into official emails of companies, identify their business partners and convince them to divert payments to their accounts.

But both schemes would fall apart spectacularly.

Criminal files and court proceedings from the US and Kenya reviewed by the Nation Investigations Desk indicate that while Ndungi was the head of a DSTV hacking cartel in Kenya, he was just an employee in the American tax fraud syndicate.

His uncle Muli, too, despite being integral in the BEC scheme, since he was based in the US, was taking instructions from people in Kenya. This is according to a transcription of Muli’s WhatsApp messages that were retrieved from his phone by the FBI and which we have obtained.

In Nairobi

The key architect of the scam, who is saved in the messages as a Frank MA, was based in Nairobi, and had the right connections in the banking system to enable the thousands of dollars they were stealing from the US to make it to Kenya.

It is Frank who was issuing instructions to Muli on almost everything, from registering his own company, Rogram Home Improvement, which was to be the recipient of the stolen funds, to who to send the money to once it hit the accounts.

In one of the messages, Frank informs Muli that the bank manager, whose name we have withheld, had written to him about the willingness of the bank, in Nairobi’s Westlands, to take the money.

This money was supposed to be wired to a law firm that had an account with the bank.

This is how the scam worked. Frank’s associates first hacked into Dell’s system and created clones of emails belonging to the computer firm’s finance department. Then they took note of the companies that had running contracts with Dell for the supply of computers.

Divert payments

Once identified, Frank would use the cloned emails to write letters to the victims and ask them to divert payments owed to Dell to different bank accounts. Some of the entities that were conned include Fairfax County, which lost $1.3 million (Sh130 million) in the scam and the University of California, which lost $749,158 (Sh75 million).

“A review of the emails from Co-conspirator 1 to Victim 1 shows the emails were sent from a single Internet Protocol (IP) address from Kenya — IP address 41.72.192.154. When Co-conspirator 1 sent these emails, travel records indicate that Muli was in the US,” says the investigation file on Muli’s gang.

The Nation has established that the said IP address that was used in the fraud is in Malindi.

This means that Frank, who has not been arrested, could have been in Malindi during the entire period of the fraud. His whereabouts or true identity still remains unknown.

Apart from Frank, other people who may have been part of the scam – since they received the thousands of dollars that were stolen – include a Francis Asanyo Mobisa, Beth Nyambura Gitau, Anthony Mureithi and Rachel Mathenge.

Beth, who is Muli’s wife and based in Naivasha, received over a million shillings on diverse dates between December 2018 and March 2019. Mobisa received Sh400,000 on February 26,2019, while Frank pocketed most of the money.

He never went anywhere without his large bible

Meanwhile, as Muli sent most of his proceeds from the fraud to Kenya, he continued to lead a simple life in the US. He maintained his job as a driver and posed as a very religious family man to his neighbours.

“He never went anywhere without his large bible, well-worn and with many bookmarks. He told me he had a prayer ministry for Kenyans, which he gave hours. His only day of refreshment and ease was Sunday,” his neighbour Linda Senter would later tell law enforcement agencies. To the FBI though, this was a façade.

While Muli managed to hide his criminal deeds by remaining humble, his nephew in Nairobi wasn’t. As if buying two planes wasn’t enough, Ndungi acquired two luxury cars: a Range Rover and an American Cadillac Escalade.

Multichoice, however, soon realised he was using his legally opened accounts to sell viewership packages to several individuals in Kenya and Nigeria. Consequently, Ndungi was arrested on March 31, 2015 after police raided his residence at Executive Suite Estate house number 15 in South B.

He was released on bail, but as the case progressed, he continued focussing all his energies on stealing the identities of American citizens and using them to claim fake tax refunds. To avoid detection, he filed the fake returns using a computer located at a cyber café at Vision Plaza along Mombasa Road.

Six years

After what was a successful six-year run in the American syndicate, Ndungi’s cookie started crumbling in 2014. He used the identity of a Cynthia H. Short, to file tax returns for the year. The returns indicated that Ms Short worked for Aureus Radiology LLC, a company based in Omaha, Nebraska and that she received wages of $116,740 (Sh11.6 million).

Short’s tax history indicated that she was liable for a refund of $76,592.86 (Sh7.6 million). In applying for the refund, “Ms Short” listed P.O. Box 925, Uhuru Gardens, Nairobi as her current mailing address.

When the US Internal Revenue Service called Aureus Radiology to confirm Short’s employment status, they discovered that the company had never even heard of her. The IRS then sent an undercover agent to pose as a client looking to buy treasury cheques.

Fake cheques

The agent contacted Ndungi in January 2016, saying he was looking for fake treasury cheques. He fell for the trap, boarded a plane and headed to the US hoping for a Sh7.6 million payday.

In his first meeting with the undercover agent, which took place on August 1, 2016, he received $48,000 (Sh4.8 million) in cash after arguing that there were several other players in the deal all looking to get paid. The meeting took place at Korean House, 2598 Royal Lane in Dallas, Texas.

In a taped conversation Ndungi offered to bring more fake cheques.

Convinced they had finally landed their man after a six-year search, the FBI arrested Ndungi two days later as an Emirates plane he had boarded to Dubai in order to connect to Nairobi was sitting on the tarmac at Los Angeles International Airport. He is serving a seven-year jail term.

And Muli was arrested while at an airport trying to catch a flight to escape to Kenya after stealing more than Sh200 million by tricking American government institutions to wire payments meant for computing company Dell. He was handed a five-year sentence at the end of last year.