How Two JKUAT Tech Students Hacked NCBA Bank and Targeted Sh215 Million

In October 2020, two students from Jomo Kenyatta University of Agriculture and Technology walked into one of Kenya’s most intriguing cybercrime cases—a courtroom battle involving an alleged breach of a major bank, more than Sh24 million reportedly taken and an alleged attempt to obtain a further Sh190.7 million.

The prosecution’s version presented Antony Mwangi Ngige, then aged 23, and Ann Wambui Nyoike, 21, as information technology students who had used their technical knowledge for an unlawful purpose.

Their defence offered a sharply different account: Ngige had discovered a weakness in NCBA Bank’s mobile platform, alerted the lender and was subsequently treated as a suspect instead of a whistle-blower.

That conflict—between an alleged cyberattack and a claimed attempt to report a security flaw—placed the two JKUAT students at the centre of a case that raised difficult questions about banking security, ethical hacking and how institutions respond to people who discover vulnerabilities.

Ngige and Nyoike appeared before Senior Resident Magistrate Carolyne Muthoni Njagi at the Milimani Law Courts on October 26, 2020. Prosecutors accused them of working with other individuals who were not before the court to steal approximately Sh24.4 million from NCBA Bank.

They were also charged with conspiring to defraud the lender of Sh190,767,195. The alleged offences were said to have occurred between October 20 and October 22, 2020, and to have involved the bank’s mobile-money platform. Both students denied the charges.

Publicly available court reporting did not disclose the precise technical method allegedly used to access the platform. There was no detailed explanation of whether the incident involved compromised credentials, an application vulnerability, manipulated transactions or another weakness.

What emerged in court was that the alleged activity took place through an information technology platform and involved a mobile phone. Any more detailed description of how the students supposedly penetrated the system would therefore be speculation rather than established fact.

The prosecution maintained that the students had participated in a plan to defraud NCBA alongside accomplices who had not been apprehended. The defence, however, argued that Ngige had discovered an exploitable weakness and attempted to bring it to the bank’s attention.

According to his lawyer, Ngige first contacted NCBA through Twitter to report a hitch in the system. When the bank did not respond with the urgency he expected, he allegedly followed up through a text message.

The bank later summoned him for an inquiry. The defence said the students voluntarily presented themselves and were not immediately arrested. They were subsequently asked to return, after which they were taken into custody and charged.

“It is the first accused who initiated his prosecution process,” the defence argued, portraying Ngige as a person who had warned the bank about its vulnerability before becoming a suspect in the breach.

The prosecution did not oppose their release on bail but urged the court to consider the substantial sums involved. Their lawyer requested affordable terms, arguing that the accused were students preparing to sit examinations and did not have the financial capacity to raise a large amount.

The court released each student on Sh500,000 cash bail, with an alternative bond of Sh2 million and a surety of the same amount. The matter was scheduled for pre-trial directions in November 2020.

The case attracted national attention partly because the accused were university students rather than established members of an organised cybercrime syndicate. It demonstrated how technical knowledge acquired through formal education can place young developers on either side of the cybersecurity divide.

The same skills used to build mobile applications, test software and identify weaknesses can protect institutions when exercised within an authorised framework. Used without permission—or even tested beyond the limits accepted by the system owner—the same knowledge can expose a student to serious criminal accusations.

The incident also highlighted the uncertain position occupied by independent security researchers in Kenya. An individual may genuinely identify a vulnerability, but accessing or testing a protected system without clear authorisation can carry legal risks. Reporting a weakness after interacting with live financial infrastructure does not automatically transform the activity into ethical hacking.

Responsible vulnerability disclosure normally requires the researcher to avoid accessing customer information, transferring funds, disrupting services or exploiting the weakness beyond what is necessary to demonstrate its existence. Findings should be reported through an institution’s authorised security channel, with detailed records preserved.

For banks, the case offered an equally important warning. Mobile-financial platforms must be designed on the assumption that determined users will continually test their boundaries. Strong authentication, transaction monitoring, access controls and rapid incident-response procedures are essential because a small weakness can potentially expose millions of shillings.

The accusations against Ngige and Nyoike should not be presented as evidence that JKUAT trains cybercriminals. Universities teach computing and information technology to produce developers, security specialists and problem-solvers. Individual allegations must remain separate from the reputation of an institution and its wider student community.

They should also not be celebrated as an extraordinary display of student brilliance. If the prosecution’s allegations were ultimately proven, the incident would represent an abuse of technical ability rather than an achievement. If the defence account were established, it would instead raise serious questions about how organisations protect and communicate with people reporting vulnerabilities.

Available reports confirm that the students denied the charges and were released on bail. They do not establish a final conviction or acquittal. Until a verified court outcome is produced, the fairest description remains that two JKUAT students were accused of participating in the NCBA breach—not that they were conclusively proven to have executed it.

The episode nevertheless remains a powerful lesson for Kenya’s emerging technology community: knowing how to find a weakness is only one part of cybersecurity. Knowing the legal and ethical boundaries governing what happens next may be just as important.