DCI detectives have arrested Oscar Livondo for allegedly using a SIM-swap scheme to steal Ksh 450,500 from a Kenyan woman's M-Pesa account while she was in the United States. Here is the full story of how the fraud happened and how investigators cracked the case..
DCI Arrests SIM-Swap Fraud Suspect After Months-Long Investigation Into M-Pesa Theft
Kenya's Directorate of Criminal Investigations has arrested a man suspected of orchestrating one of the most brazen and technically sophisticated mobile money fraud cases to come to public attention in recent months, bringing to a close a painstaking months-long investigation into the theft of Ksh 450,500 from the M-Pesa account of a Kenyan woman who was living and working in the United States at the time the crime was committed. The arrest of Oscar Livondo by officers from the DCI's Operation Support Unit marks a significant victory for Kenya's cybercrime enforcement apparatus and sends a clear warning to the growing network of mobile money fraudsters operating across the country.
Livondo was tracked down to his residence in Ngumba Estate, where detectives moved in to make the arrest after investigators had gathered sufficient evidence linking him directly to the fraudulent transactions that drained the victim's account. The operation was conducted by the Operation Support Unit based at DCI headquarters — a specialist investigative team with the technical capability to trace and build cases against cybercrime perpetrators whose methods are specifically designed to conceal their identity and distance them from the money they steal.
The DCI confirmed the arrest and used the occasion to highlight what officials described as the growing sophistication of mobile money fraud networks operating within Kenya — a pointed warning that the methods being used by fraudsters are evolving faster than many consumers appreciate, and that vigilance and awareness are among the most important defences available to M-Pesa users both at home and abroad.
The Victim's Story: A Kenyan in America, a Safaricom Daima Line, and a Devastating Discovery
The story at the heart of this case is one that will resonate deeply with the hundreds of thousands of Kenyans living and working in the diaspora who rely on mobile money services to manage their finances back home. The victim — a Kenyan woman who travelled to the United States in January 2019 in search of employment opportunities — made the prudent decision to keep her Safaricom mobile line active while abroad by activating the network's Daima service, a product specifically designed to allow Kenyans in the diaspora to maintain their mobile lines and continue accessing services including M-Pesa without being physically present in the country.
For several years, the arrangement worked exactly as intended. The victim's line functioned normally, her M-Pesa account remained accessible, and she was able to manage her mobile money affairs from across the Atlantic with the confidence that her account and its contents were secure. That confidence was shattered on May 24, 2024, when both the cellular service and M-Pesa functionality on her line suddenly and inexplicably stopped working — a development that, at the time, she had no way of understanding as the opening move in a carefully premeditated fraud.
Being thousands of miles away in the United States and unable to visit a Safaricom service centre or engage directly with Kenyan authorities, the victim's options for investigating or resolving the sudden service disruption were severely limited. It was only when she returned to Kenya in December 2024 — more than six months after her line went dark — that she was finally able to discover what had happened to her account. The discovery was devastating: where she had expected to find a balance of approximately Ksh 450,500, she instead found just Ksh 18 remaining. Every shilling she had carefully saved and held in her M-Pesa account had been stolen.
How the SIM-Swap Fraud Was Executed: A Step-by-Step Account of the Crime
The mechanism through which Oscar Livondo allegedly carried out the theft is known as SIM-swap fraud — a cyber-enabled crime that exploits the mobile network's legitimate SIM replacement process to transfer control of a victim's phone number from their SIM card to one controlled by the fraudster. Understanding how this type of fraud works is critical not only for appreciating the sophistication of what allegedly happened to this particular victim, but also for equipping Kenyan mobile money users with the knowledge they need to protect themselves from becoming victims of the same crime.
In a legitimate SIM-swap scenario, a mobile subscriber who has lost or damaged their SIM card visits a service provider outlet, verifies their identity, and is issued a new SIM card containing their original phone number — allowing them to resume normal service on a new physical card. The fraudulent version of this process works by exploiting weaknesses in the identity verification steps that network providers use to authorise SIM replacements, allowing a fraudster armed with sufficient personal information about the target to impersonate the legitimate account holder and convince the network to transfer the victim's number onto a SIM card in the fraudster's possession.
Once the SIM-swap is successfully executed, the fraudster gains complete control of the victim's phone number. Any calls or SMS messages sent to that number — including the one-time passwords and M-Pesa transaction authorisation codes that mobile money platforms send to verify transfers — are received by the fraudster rather than the legitimate account holder. The victim's phone simultaneously loses all network connectivity, which is why the woman in this case experienced the sudden cessation of both cellular and M-Pesa services on May 24, 2024 — her number had been stolen, and her SIM card had been effectively deactivated by the swap.
With full control of the victim's phone number and therefore access to all M-Pesa verification codes and transaction authorisation messages, Livondo allegedly proceeded to execute the theft with clinical efficiency. According to the police investigation, Ksh 450,500 was withdrawn from the victim's M-Pesa account on October 15, 2024 — nearly five months after the SIM-swap was executed — in two separate transactions, both of which were linked to a mobile number registered under the suspect's name.
How DCI Detectives Cracked the Case: Tracing Digital Footprints to Ngumba Estate
The investigation that led to Livondo's arrest is a testament to the growing technical capability of Kenya's DCI, particularly the specialist teams within the Operation Support Unit who have been trained and equipped to follow the digital evidence trails left by cybercrime perpetrators. Mobile money fraud cases present unique investigative challenges because the crime is committed remotely, the proceeds are moved quickly through a chain of transactions designed to obscure their origin, and the perpetrators typically believe that the technical complexity of the scheme provides them with effective cover from law enforcement.
In this case, investigators worked methodically backward from the two fraudulent transactions executed on October 15, 2024, tracing the mobile numbers associated with the withdrawals, analysing the registration details and transaction histories linked to those numbers, and building a chain of digital evidence that ultimately pointed to a specific individual in a specific location in Nairobi. The trail led detectives to Ngumba Estate, where Livondo was found and arrested.
A search of his residence at the time of arrest yielded two mobile phones and six SIM card holders — items that investigators are currently subjecting to forensic examination as part of the ongoing investigation. The recovery of multiple SIM card holders is particularly significant in the context of a SIM-swap fraud case, as it is consistent with the operating methods of individuals who manage multiple phone numbers and SIM cards as tools of their fraudulent trade. The forensic analysis of the recovered devices is expected to provide further evidence of the suspect's activities and may reveal additional victims or co-conspirators not yet identified in the current investigation.
How to Protect Your M-Pesa Account from SIM-Swap Fraud
The DCI's confirmation of this arrest is an opportunity for every Kenyan M-Pesa user — and particularly those in the diaspora who rely on services like Safaricom's Daima to maintain their accounts from abroad — to review and strengthen the security arrangements around their mobile money accounts.
The most important protective measure available to M-Pesa users is to register a nominated next-of-kin or trusted contact person in Kenya who can act on their behalf in the event of a suspected account compromise. For diaspora users specifically, having a trusted family member or friend who can immediately visit a Safaricom outlet and report a suspected SIM-swap if the account holder loses network access from abroad can be the difference between catching a fraud in progress and discovering it months later when the money is gone.
Regularly monitoring M-Pesa transaction histories — through the Safaricom app or M-Pesa statements — is a further essential habit, particularly for users with significant balances in their accounts. Any unexplained or unrecognised transaction should be reported to Safaricom immediately, and any sudden loss of network connectivity should be treated as a potential security incident rather than a routine technical issue until confirmed otherwise.
Keeping personal information — including national ID numbers, date of birth, and other details that fraudsters use to impersonate account holders at network service centres — as private as possible reduces the risk of a successful SIM-swap attempt. And for users who maintain large M-Pesa balances, the consideration of distributing savings across multiple platforms or bank accounts reduces the total exposure from any single account compromise.
Suspect Awaiting Arraignment as Investigations Continue
Oscar Livondo is currently being held in DCI custody pending his arraignment before a court of law, where he will face charges related to the alleged Ksh 450,500 M-Pesa theft. Detectives continue to piece together the full evidentiary picture in the case, with the forensic examination of the two mobile phones and six SIM card holders recovered from his Ngumba Estate residence expected to yield additional evidence that may broaden the scope of the investigation.
For the victim — a Kenyan woman who left her country in search of a better life, carefully saved the proceeds of her labour, and returned home to find her life savings reduced to Ksh 18 — the arrest of the alleged perpetrator is a step toward justice, even if the road to full accountability and any prospect of financial recovery remains long and uncertain. Her case is a reminder that behind every cybercrime statistic is a real person whose trust, savings, and sense of security have been violated by individuals who treat digital fraud as a profession.