Is your money safe while at Co-operative Bank of Kenya?
This is the uncomfortable question emerging from the case of a customer who is fighting to recover Sh500,000 that was transferred from her bank account in a transaction she insists she neither initiated nor authorised.
The case involving 34-year-old Gladys Akinyi has raised questions about the security of customers’ funds and how a substantial amount of money could leave an account when the owner maintains that she never approved the transaction.
Akinyi, who reportedly opened her Co-op Bank account in 2023 and primarily used it for savings, says nothing appeared unusual on Sunday, June 21. She was at home and had her mobile phone with her throughout the afternoon.
Unknown to her, however, Sh500,000 was transferred at about 12.57pm to an account belonging to Ghala Kuu Digital Distributors Limited.
Akinyi says she received no SMS notification informing her that half a million shillings had left her account, despite receiving alerts for previous transactions.
She only discovered the missing money two days later, on June 23, when she attempted to transfer Sh5,000 to her M-Pesa account and noticed that her balance had drastically reduced.
The case raises questions for Co-op Bank over how a customer could allegedly lose such a substantial amount without noticing the transaction until days later.
More troublingly, Akinyi says she discovered during her efforts to resolve the matter that the email address associated with her banking profile had reverted to an older address. Her lawyers later raised concerns that the email linked to the account had been changed without her consent.
That development adds another layer to questions surrounding the security of the account and whether someone else could have gained access to her banking profile.
Akinyi reported the matter to Co-op Bank and subsequently to detectives at the Directorate of Criminal Investigations and the Banking Fraud Investigation Unit.
However, Co-op Bank’s findings presented another twist.
According to information provided to investigators, the bank’s internal investigation concluded that the disputed transaction originated from Akinyi’s own device and was authenticated using her registered biometric credentials.
Akinyi strongly disputes that finding.
She maintains that she never initiated the transaction and questions how she could have knowingly transferred Sh500,000 before reporting the same money missing.
The discrepancy has placed the effectiveness of the bank’s security controls at the centre of the dispute. If Akinyi did not authorise the transfer as she maintains, investigators must establish how another person could potentially have accessed the banking application and completed a transaction that the bank’s systems recognised as biometrically authenticated.
Detectives are instead examining several possibilities, including whether another individual could have gained access to Akinyi’s mobile-banking application while she was occupied on a WhatsApp call using another device.
No conclusion has been reached on that possibility, and investigators have not established who initiated the disputed transaction.
The trail of the Sh500,000 has nevertheless provided investigators with further leads.
After the money landed in the Ghala Kuu Digital Distributors Limited account, it was reportedly immediately transferred to four separate mobile-money accounts.
Business Registration Service records identified Wycliffe Omondi as the company’s sole director. The BFIU reportedly identified his mobile number and was seeking to question him as part of the investigation. A court order was also obtained requiring Safaricom to provide information that could assist detectives in locating him.
There is no finding that Omondi was responsible for accessing Akinyi’s account, and the investigation remains open.
Akinyi’s lawyers eventually issued a demand to Co-op Bank seeking a formal explanation and asking the lender to rectify the disputed transaction by restoring the Sh500,000 to her account.
Co-op Bank, however, has maintained that its investigation showed the transaction originated from the customer’s device and was authenticated using her biometrics.
That position leaves Akinyi caught between a banking system that apparently regards the transaction as properly authenticated and her insistence that she never made it.
The unresolved case consequently leaves Co-op Bank facing uncomfortable questions: How did Sh500,000 leave a customer’s savings account without her alleged knowledge? Why, according to her, was there no SMS alert? How did her banking profile’s email address allegedly change without her consent? And if she did not initiate the transaction, how was it successfully authenticated using credentials associated with her device?
Until investigators answer those questions and establish exactly who moved the money, Akinyi’s missing Sh500,000 remains not only a fraud investigation but also a test of the safeguards customers rely on when entrusting their savings to digital banking systems.
