By The Weekly Vision Investigations Desk
At 9.47 am on 11 July 2024, Kevin Mwangi, Equity Bank’s head of security, telephoned the Banking Fraud Investigation Unit (BFIU) in Nairobi to report that something had gone badly wrong at the lender’s Britam Towers headquarters in Upper Hill. Inspector Bonface Maina Kamau and Sergeant Josiah Gichobi, who attended the scene, were shown 47 transactions with a combined value that would come to define the Kenyan banking scandal for a generation: an initial tally of Sh1,545,553,374.59, more than 1.5 billion shillings, drained from the account meant to pay Equity Bank’s own staff.
Prosecutors would later charge that Sh1,499,465,831.29 of this had been fraudulently siphoned between 1 May and 31 July 2024; the two figures differ slightly, reflecting the discrepancy between the bank’s initial forensic tally and the sum eventually specified in the charge sheet. It was not the work of hackers breaching a firewall from some distant server farm. It was, investigators would allege, something far more unsettling: a theft carried out from the inside, using entirely legitimate credentials, over 90 quiet days in which nobody at the bank noticed a thing.
At the centre of the storm sat David Machiri Kimani, a 39-year-old manager at Equity Bank’s Group Processing Centre, Salary Processing Unit, the very department responsible for the account that had just been emptied. Court papers filed by the DCI’s Banking Fraud Investigation Unit alleged that it was Mr Kimani’s digital credentials that had been used to authorise the forty-seven transfers.
There was just one problem, which made him instantly the prime suspect: he was on leave when it happened. Detectives noted that he had taken sick leave in early June, just as the bank’s Salary Processing Unit, Finance Department and Reconciliation Unit were being instructed to align and regularise their accounts, timing that struck investigators as anything but coincidental. Mr Kimani was arrested on 12 July 2024 and arraigned at the Milimani Law Courts, where the prosecution sought to detain him for 21 days to allow further investigation into what the charge sheet described as economic sabotage against a bank serving more than fourteen million customers. Magistrate Geoffrey Onsarigo declined the application and instead released him on a cash bail of Sh500,000, with orders to report to the BFIU every Tuesday and Thursday until the probe concluded.
He would not make it to his next scheduled court date unscathed
Forensic accountants traced the stolen funds to a web of newly registered companies, corporate shells, investigators alleged, created specifically to receive and disperse the loot before it could be flagged. According to correspondence cited in later reporting, the beneficiaries included Ruth Muthoni Kamau, a businesswoman whom investigators have named as a central suspect and, according to some officers involved in the probe, its likely organiser, an allegation she has not been charged with and firmly denies.
Sh105 million of the proceeds is said to have passed through two of her companies, Goodmans Fresh Ltd and Blue Kenfresh Ltd, with further sums allegedly reaching her personal accounts directly. In total, she is alleged to have received upward of Sh800 million. Also drawn into the net was Owen Karanja, alleged to have received some Sh215 million through a cluster of firms, KT Owens Group, Mac and Gray Ltd, and Axteron Technologies Ltd. According to detectives, Mr Karanja told the BFIU that he had converted the funds into bitcoin, feeding it into a cryptocurrency wallet said to be linked to Ms Muthoni, a claim, if proven, that would tie the digital laundering trail directly back to her.
Then there was Geoffrey Kahungi Kiragu, a name that made hardened fraud investigators sit up. Already notorious as the man behind Lesedi Developers, a real estate scheme accused of defrauding more than 800 people of roughly a billion shillings, Kiragu had allegedly gone on to set up further shell property firms, Bomalink Concepts Ltd and Brickways Properties Ltd, both of which are alleged to have received Equity Bank heist proceeds. When detectives finally caught up with him at a club on Kiambu Road on 18 July 2024, he gave his name as Gideon Kamau Wangeci and led officers on a bewildering chase across Thika, Gatundu and Muthaiga before fingerprint analysis exposed his true identity.
And weaving through the entire affair, according to the DCI’s investigations, was Nairobi lawyer Esther Bitutu Kadiki, alleged by detectives to have drafted the agreements and corporate paperwork that gave the scheme its veneer of legitimacy. She was summoned for questioning in October 2024 but did not appear, and was not arrested until 5 May 2025, when she was arraigned and released two days later on a personal bond of Sh30 million, without surety, Chief Magistrate Lucas Onyina ruling that the prosecution had shown no evidence she had interfered with witnesses or the investigation.
If the paper trail was disorientating, what followed was outright chilling
On the night of Sunday, 11 August 2024, a convoy of unmarked vehicles, three Subaru Outbacks, a Land Rover Defender and a Toyota Land Cruiser, none carrying number plates, descended on a quiet street in Thogoto, Kiambu County. Neighbours later told reporters that armed, hooded men stormed Mr Kimani’s rented home at around 11.40pm and led him away, identifying themselves only as police officers. He has not been seen since.
12 hours later, a second team of masked, armed men struck again, this time at the Mathioya home of Mr Kimani’s father, Joseph Kimani Machiri, a former Murang’a County Assembly member. CCTV footage later showed the gunmen disabling the property’s electricity, battering down the gate, and forcing the elderly man into a waiting vehicle. He was freed two days later, reportedly after mounting public pressure, and gave harrowing accounts of his ordeal, including, according to one report, being held in a forest among lions and hyenas.
The local police commander in Kikuyu maintained, notably, that no official report of either abduction had been filed. The family’s lawyer, Ndegwa Njiru, petitioned the courts to compel authorities to produce his clients, insisting the men had been taken by state operatives. Prosecutors denied it. To date, David Machiri Kimani’s whereabouts remain unknown.
What has unfolded since reads less like a conventional fraud trial and more like a slow-motion battle over who, if anyone, will ultimately be held to account. The lead investigator, Inspector Kamau, was transferred from the BFIU to a post in remote Baragoi, Samburu County, in October 2024. In a series of letters to senior police leadership, he has claimed the move was engineered to shield Ms Muthoni from further scrutiny, an allegation made by a single officer with a personal stake in the transfer decision, which The Weekly Vision has not been able to independently verify and which police leadership has not publicly addressed.
Ms Muthoni, for her part, has denied any wrongdoing, telling reporters she was “abducted, not arrested,” and has since obtained a court order restraining police from pursuing further investigation or arrest against her, a legal manoeuvre that has, for now, stalled one of the case’s central threads. Meanwhile, more than two hundred bank employees are reported to have been dismissed in an internal purge triggered by the scandal, and the case has been escalated to DCI headquarters for closer supervision. Court proceedings against Mr Kimani, Mr Kiragu and Ms Kadiki continue to grind through Milimani’s courts, even as the man whose stolen credentials started it all remains missing, dead or alive; nobody officially will say.
Whatever the courts ultimately decide about individual guilt, the Equity Bank heist has already left its mark. It exposed how a single set of employee credentials, left unattended during a period of leave, could be used to bleed a top-tier lender of one and a half billion shillings across ninety undetected days, and how, once uncovered, the pursuit of justice became clouded by unresolved, unverified claims of interference from within the investigation itself.
As one banking security expert observed to reporters, extracting that scale of money from a salary suspense account over three months “suggests serious internal control failures or collusion at multiple levels.” Equity Bank has largely maintained public silence on the matter, though sources indicate enhanced security protocols have since been introduced.
For now, the money, much of it converted into property, cash and cryptocurrency, remains only partially recovered. And the question that continues to hang over the case is not simply who took it, but who, if anyone, ever intended for the whole truth to come out.
