sln.Mac

In February 2021, a Kenyan man, Alex Ngata, noticed his late father’s phone lost network signal. He immediately suspected foul play and went to a Safaricom shop to renew the line. The moment the new SIM card was activated in his phone, a flood of backlogged text messages poured in. The messages revealed a terrifying reality. Notifications showed continuous, heavy transactions draining his late father's bank accounts. Alerts confirmed that mobile banking apps had just been newly installed and configured on an unknown device. Right after replacing the SIM card at Safaricom, Alex visited NCBA Bank, Equity Bank, and Co-operative Bank, where he officially confirmed that Sh2.8 million had been siphoned from his late father's bank accounts via mobile banking applications (the NCBA App, Eazzy Banking, and MCo-op Cash). The banks confirmed that the stolen cash had been transferred directly to a specific mobile number: 0716 546633. Armed with the bank statements, the transaction logs, and the destination phone number, he reported the heist to the DCI. Once the report was filed, the DCI's Crime Research and Intelligence Bureau (CRIB) alongside the Operations Branch took over the case. The very first move detectives made was pulling the logs for 0716 546633, the Safaricom line that received the stolen Sh2.8 million. Detectives ran a registration check on the recipient phone number, and discovered a chilling anomaly: the number belonged to a dead person. Specifically, the line was registered to Rev. Peter Kania, the former Secretary-General of the Presbyterian Church of East Africa (PCEA), who had passed away several months earlier. To the detectives, this was a bizarre and unprecedented situation. The mechanics of how a deceased father's line could drop signal and how a dead clergyman could actively transact baffled investigators. CRIB detectives immediately ran a forensic analysis on the SIM card’s historical tower data, tracking where the phone line was physically "pinging" cell towers when it accessed the banking apps. This mapping data proved the SIM card was active long after Rev. Kania had been buried. To understand how the fraudsters knew the exact account balances of Alex's late father, detectives turned their eyes toward the financial institutions. Cyber-auditors reviewed the digital footprints left behind on the banks' internal servers. Every time an employee views a customer’s private profile, the system logs their unique credentials. The audit flagged that Equity Bank teller Eutycus Mutembei had zero operational reason to access these specific accounts. His credentials were caught red-handed browsing through the financial portfolios of recently deceased, wealthy individuals. As the tech teams unraveled the digital trail, a massive "can of worms" was exposed, revealing a highly organized SIM-swap syndicate that operated with chilling precision inside Kenya. Detectives discovered that the syndicate did not guess targets at random. They systematically monitored newspaper death announcements and obituaries to identify wealthy individuals who had recently passed away, knowing their bank accounts remained liquid while grieving families were preoccupied. Shockingly, the fraudsters had even attended Alex's father's burial arrangements. Posing as well-wishers and friends, members of the syndicate actively helped the family raise funds and sold portraits of the deceased to mourners. This proximity allowed them to comfortably phish for family dynamics, look at death certificates, and figure out who would be handling the estate. Once a target was selected, the operation relied on an active, illegal data breach within financial institutions. Armed with account details provided by their insider, Eutycus Mutembei, the syndicate would execute the fraudulent SIM swap to intercept the bank OTP codes and drain the funds.