COFEK Demands DTB Freeze Account Linked to Sh275,500 Mobile Money Fraud, Waive Confidentiality to Aid Victim

Nairobi, September 11, 2026 — The Consumers Federation of Kenya (COFEK) has issued an urgent demand to Diamond Trust Bank (Kenya) Limited (DTB), directing the lender to freeze an account allegedly used as a conduit for Sh275,500 defrauded from a Kenyan consumer through M-PESA, and to waive account confidentiality so the victim can pursue recovery.

In a letter dated September 11, 2026 and addressed to DTB Managing Director and CEO Mr. Murali Natarajan, COFEK set out the case on behalf of the Federation's client and member, invoking COFEK's statutory public-interest mandate under Article 46 of the Constitution and the Consumer Protection Act, 2012. What Happened According to the letter, the victim was defrauded of a total of Sh275,500 between September 9 and 10, 2026, after being induced by false pretences to transfer funds from her M-PESA account to a DTB paybill (Paybill Number 516600, Account Number 5689225002). Three transactions are cited:

✅September 9, 2026, 9:11 a.m. — Sh145,500 transferred ✅September 9, 2026 — Sh90,000 transferred ✅September 10, 2026, 9:43 a.m. — Sh40,000 transferred COFEK states that M-pesa confirmation messages evidencing each transaction are in the victim's possession and will be availed to the bank.

The matter was reported to police and is recorded at Githurai Mwiki Police Station under OB No. 64/10/09/2026, with the offence logged as "Obtaining by False Pretences." COFEK's Position COFEK contends that the receiving account and paybill constitute a direct proceeds-of-crime conduit, and that DTB, as the licensed institution operating the account, owes both the victim and the wider banking public a duty of care, vigilance, and prompt remedial action once notified of fraud.

The Federation grounds its demand in a cluster of legal and regulatory obligations, including: ✅The Consumer Protection Act, 2012, requiring suppliers of financial services to act fairly, transparently, and in good faith; ✅CBK Prudential Guidelines, including the Guideline on Consumer Protection (CBK/PG/22) and the Guideline on Fraud Risk Management, which require licensed institutions to maintain mechanisms for prompt reporting, investigation, and remediation of fraud; ✅The Proceeds of Crime and Anti-Money Laundering Act, 2009, obligating reporting institutions to act immediately, including freezing accounts reasonably suspected of holding proceeds of crime; ✅The Data Protection Act, 2019, under which the duty of confidentiality owed to an account holder is not absolute and yields where disclosure is necessary to establish, exercise, or defend a legal claim, or where required by lawful authority investigating a crime; and

✅The bank's common law and contractual duty of care to third parties defrauded through misuse of accounts it maintains. The Demands COFEK has given DTB seven days from the date of the letter to:

🔴 Freeze the account — immediately place a Post No Debit (PND) instruction on Account No. 5689225002 and Paybill No. 516600, pending investigation and recovery, and confirm this in writing; 🔴Refund the victim — pay back the Sh275,500, or alternatively confirm the available balance and facilitate its immediate release to the victim to the extent of that sum; 🔴Waive confidentiality — disclose full particulars of the account holder(s), including names, identification, registration details, phone number(s), address, and a full transaction statement showing receipt and any onward movement of the funds, to enable further action against the beneficiary; and 🔴Name a fraud contact — provide the name and direct contact details of the bank's designated fraud/investigations officer, to coordinate with the investigating police officer at Githurai Mwiki Police Station. Consequences of Non-Compliance COFEK has placed DTB on notice that failure to comply within the stipulated timeline will leave the Federation and its client no option but to pursue any or all of the following:

🟣 Civil proceedings against the bank for negligence and/or breach of statutory duty; 🟣 A formal complaint to the Central Bank of Kenya; 🟣 A complaint to the Office of the Data Protection Commissioner; and 🟣 Other lawful public-interest action, including public disclosure of the bank's conduct in the matter. The letter has been copied to Dr. Kamau Thugge, Governor of the Central Bank of Kenya, and to Ms. Wasike.