A man linked to the Sh1.49 billion heist at Equity Bank has been seized by detectives after jetting back from China where he had reportedly gone into hiding after receiving part of the loot in hard cash.
John Karima Wainaina was arrested on November 9 at the Jomo Kenyatta International Airport (JKIA) upon his arrival from China.
Surveillance of his phone and social media chats with some of the suspects allowed the Directorate of Criminal Investigations (DCI)’s Banking Fraud Investigation Unit and a crack unit at the elite unit of the National Intelligence Service (NIS) to monitor his movement and issue an alert about his Nairobi return.
The police believe that Mr Wainaina was a member of an organised group engaged in bank fraud, money laundering and stealing via penetration of banking IT systems.
He escaped to China in July after the Equity Bank robbery was reported to have occurred, sparking a frenzied investigation by the DCI and the NIS.
The probe led to the arrest of David Machiri Kimani – Equity Bank’s manager at the Group Processing Centre, Salary Processing Unit –whose credentials were used to process over 40 transactions totalling Sh1,499,465, 831.29 before the transfer of the heist to rival banks.
Detectives believe that Mr Machiri, who has never been seen since the Sunday, was recruited into the scheme by Mr Wainaina.
The magistrate court yesterday allowed the banking fraud unit to detain Mr Wainaina for 10 days to allow forensic detectives to retrieve e-mails, texts and WhatsApp messages from gadgets linked to the suspect.
The police sought to have Mr Wainaina detained to allow them review CCTV reportedly capturing the suspect in different locations with other people planning and receiving part of the stolen money in hard cash.
“Police need to place the suspect at the scene of crime,” Sonia Njoki, the prosecutor, told the court.
“The suspect was alleged in the offence and his release before obtaining documentary evidence, electronic evidence, CCTV footage and recording of witness statements may greatly jeopardise the intended recoveries and investigations.”
On July 10, the Equity Bank Internal Control Department detected a flurry of suspect transactions at the salaries account.
There were 47 withdrawals from the payroll account.
The money was quickly transferred to multiple accounts in other banks.
Whenever money is sent from one bank account to another, systems on each side communicate details of the transaction, including names of the individuals or entities exchanging the funds and the amount, indicating everything is above board.
That communication in banking lingo is known as corresponding credits.
In the case of the 47 transactions, fictitious narratives or corresponding credits from the Equity Bank side showing the source of funds were done, making it appear like the huge sums were genuine transactions.
Court documents indicate the theft happened for more than a month from June 1, running for weeks undetected.
“Preliminary investigations have established that among the primary beneficiary accounts were opened in the name of the respondent (Mr Wainaina) and or in the name of proxy companies associated with him which were credited with the stolen funds,” Ms Njoki said.
The prosecutor said Mr Wainaina was the king-pin of the organised group that recruited insider banking staff, penetrated the bank’s system and identified proxy persons whose accounts would be used to receive the heist and launder the proceeds.
The magistrate directed the suspect to be held at Kileleshwa Police Station in Nairobi for 10 days.
In July, Mr Machiri was arrested and produced in court, as police sought for more time to interrogate him over the theft.
He later disappeared, with his lawyers, Ndegwa Njiru and Dr Paul Gitau, claiming that he was abducted from his home in Thogoto, Kiambu County.
Investigators claimed that the money lost included Equity members’ savings and deposits, and salaries.
Director of Public Prosecutions Renson Ingonga urged the court to issue a warrant of arrest against the manager.
The prosecution said the suspect was released on a Sh500,000 bond by the DCI, but failed to appear in court.
According to the DPP, the man was supposed to report to the DCI Kiambu Road headquarters on Tuesdays and Thursdays but was allegedly missing.
Mr Ndegwa told the court that hooded men with guns raided Mr Machiri’s house on the night of August 12, 2024, and took him away.
The lawyer added that the same happened to Mr Machiri’s father, David Machiri, as he was allegedly abducted from his rural home in Murang’a only to be freed after a day in captivity.
The case was mentioned on November 12, 2024 and fixed for a further mention on January 21, 2025.
The Business Daily has reliably learnt that Mr Machiri is in police custody and is in bad health.
Mr Machiri, according to detectives, took sick leave in early June when there was communication between the Salary Processing Unit, the Finance Department and Reconciliation Unit requiring them to align to the bank’s policy and guidelines in regularising accounts.
Investigators added that most of the accounts that were debited with the money were new.
When the money was credited, it was again transferred to other accounts and later withdrawn to avoid detection.
Investigations also found that most, if not all, of the accounts into which the money was paid into were operated by businesses that were newly registered.
The DCI detectives believe the businesses were opened solely for the purpose of receiving the money obtained fraudulently.
