Co-op Bank faces fresh insider fraud probe after customer loses Sh500,000

Co-operative Bank of Kenya, led by Group Managing Director and Chief Executive Officer Gideon Muriuki, is once again under scrutiny over alleged insider banking fraud after a customer accused the lender of failing to prevent unauthorised access to her account, resulting in the loss of approximately Sh500,000.

The latest complaint has prompted investigations by the Banking Fraud Investigation Unit (BFIU) and the Directorate of Criminal Investigations (DCI), with detectives already obtaining court orders to freeze accounts believed to have received the disputed funds.

Gladys Akinyi Ochandah has formally petitioned the Director of the Banking Fraud Investigation Unit to investigate what she describes as unauthorized withdrawals from her bank account after her account records, including the registered email address, were allegedly altered without her knowledge.

According to a complaint lodged through her lawyers, K.N. Nyamweya & Advocates, Akinyi discovered the suspected fraud on June 23, 2026, when she attempted to transfer money from her Co-operative Bank account to her M-Pesa account.

Instead of completing the transaction, she reviewed her account and was shocked to find that nearly Sh500,000 had already been withdrawn through transactions she says she neither initiated nor authorized.

In a complaint letter dated July 8, 2026, addressed to the bank, her lawyers demanded a formal explanation over what they described as a serious breach of the customer’s banking records.

“We act for our client named above whose instructions we write hereunder. That on June 23, 2026, our client who is an account holder with your bank discovered that Sh500,000 had been transferred from her account without her knowledge,” the advocates wrote.

Akinyi says she immediately contacted the bank’s customer care service as well as her former branch manager, who assured her that the matter would be treated urgently and advised her to visit the Co-operative Bank Kimathi Branch.

While reviewing her account following the suspicious withdrawals, she says she discovered another disturbing development.

According to her complaint, the email address registered on her account had been changed to an old email address without her authorisation, heightening fears that someone may have gained unauthorised access to her banking profile before executing the transactions.

The following day, June 24, she visited the Kimathi Branch, where she completed a formal complaint form and met the branch manager, who allegedly assured her that the matter would be escalated to the relevant department for investigation and that feedback would be provided.

However, more than two weeks later, she says she has not received any substantive update regarding the fate of her money or the progress of investigations.

Frustrated by the delay, Akinyi reported the matter to the Directorate of Criminal Investigations Railways Unit before escalating the complaint to the Banking Fraud Investigation Unit.

In her complaint to investigators, she has requested that authorities trace the unauthorized transactions, identify and prosecute those responsible, recover the stolen funds and ensure the money is refunded to her account.

She is also demanding a full forensic investigation into how critical account information, including her registered email address, was altered without her authorization and wants both investigators and the bank to outline safeguards that will prevent similar incidents in future.

Co-operative Bank confirmed that it is pursuing the matter.

Meanwhile, officials from the Banking Fraud Investigation Unit disclosed that investigators have already moved to court and obtained orders freezing bank accounts believed to have been used in the disputed transactions.

Investigators further confirmed that statements have been recorded from several individuals believed to have been involved in processing or receiving the transactions as investigations continue.

The case adds to growing concerns over cyber-enabled financial crime and insider-assisted banking fraud, particularly where fraudsters are suspected of manipulating customer records before siphoning funds from accounts.

Pattern of insider fraud allegations

The latest complaint comes only months after the Employment and Labour Relations Court upheld the dismissal of former Co-operative Bank Relationship Manager Amos Bett Koech in a case that exposed an elaborate scheme involving the suspicious reactivation of dormant customer accounts, including one belonging to a deceased customer.

The judgment shed light on how dormant accounts can become attractive targets for fraudsters when insiders allegedly exploit privileged access to circumvent internal banking controls.

Court documents revealed that Koech allegedly committed the offences while still serving at the bank before his dismissal in November 2020 by bypassing internal security systems without detection.

According to evidence presented before the court, fraudsters collaborated with Koech to revive dormant customer accounts using forged documents supplied by individuals posing as genuine account holders.

Among the most startling revelations was the use of a fake prison discharge certificate intended to explain why one customer had allegedly remained inactive for several years.

Investigators later established that the purported account holder was, in fact, deceased.

The bank told the court that Koech played a central role in facilitating communication with branch officials and helping advance the reactivation process despite obvious irregularities and warning signs.

One of the fraudulent schemes reportedly involved the lender’s Kimathi Street Branch, where a dormant account was allegedly revived after interactions with individuals later identified as impostors.

Another dormant account at the Kariobangi Branch was similarly reactivated before becoming the subject of unauthorized transactions.

Investigators were particularly concerned by what they described as abuse of internal system privileges.

Audit logs generated from the bank’s information systems reportedly showed Koech accessing customer accounts that fell outside his official responsibilities.

The audit trails later became key evidence during internal disciplinary proceedings and subsequent court hearings.

Bank investigators argued that the pattern of account access could not be justified by Koech’s duties and instead pointed to deliberate efforts to obtain confidential customer information.

During cross-examination, Koech admitted accessing accounts that were unrelated to his work, conduct the bank argued breached its confidentiality policies and code of conduct.

The case highlighted a growing challenge confronting financial institutions.

While banks continue investing billions of shillings in cybersecurity infrastructure to guard against external hackers, investigators and fraud experts increasingly warn that employees with legitimate system credentials may pose an equally significant risk because they understand institutional processes and know where security weaknesses exist.

Unlike external cybercriminals, insiders often possess detailed knowledge of account management systems, dormant account procedures and approval workflows, making sophisticated fraud schemes easier to execute.

Investigators also noted that dormant accounts are particularly vulnerable because many belong to customers who rarely monitor their balances or, in some instances, deceased individuals whose estates remain unresolved for years.

Such prolonged inactivity allows fraudulent transactions to go unnoticed for extended periods.

Following internal investigations, Co-operative Bank initiated disciplinary proceedings against Koech by issuing him with a show-cause letter before convening a disciplinary hearing.

His employment was subsequently terminated in November 2020.

Koech later challenged the dismissal in court, seeking compensation for unfair termination, gratuity payments and reinstatement of his banking privileges while denying involvement in any fraudulent activity.

However, the Employment and Labour Relations Court dismissed his claim and upheld the bank’s decision.

In its judgment, the court ruled that the bank had established lawful grounds for terminating his employment.

“The court is satisfied that suspicion of fraud in a banking environment, supported by audit logs and internal investigation findings, constitutes a valid and fair reason for dismissal,” the judge ruled.

The court further held that Co-operative Bank had complied with due process by giving Koech an opportunity to respond to the allegations and pursue an internal appeal before his dismissal.