A young man walks into a bank, opens an account, obtains a Automated Teller Machine (ATM) card for only Sh500. Minutes later, he sells all those banking credentials for a few thousands to a fraudster. In another bank, a hacker has identified people in the IT department of a financial institution, used them to install gadgets that relay key information to external servers for months. One Saturday afternoon, when the bank staff are way, the hackers strike the bank making away with hundreds of millions of shillings in a matter of hours.
The money is then sent to many M-Pesa super agents across the country who walk to the bank and withdraw it. The hackers then go round in cars collecting their loot and paying off the agents. In one such case hackers, installed a computer in a well-known bank and transferred Sh150 million between Saturday, 5pm, and Sunday noon. No one has been arrested, months later.
Last month, one of the country’s five biggest banks, lost Sh200 million to hackers on a weekend. According to industry sources out of 47 banks, fewer than 10 have their core banking system relatively safe. “The sad part is that some of the people running these banks have no clue of IT issues, are not interested and take too long to respond to the attacks,” said a senior industry player.
