BPR Bank Rwanda: $260K Electronic Payment Fraud Trial Begins in Nyarugenge Court

• Seven individuals are on trial in Rwanda for allegedly stealing $260,189 from BPR Bank Rwanda Plc through electronic payment system misuse.
• A former BPR Bank Rwanda Plc IT employee, Manirakiza Obed, is accused of downgrading customer security from 3D to 2D authentication and providing CyberSource access to co-defendants.
• The alleged fraud was discovered after customer complaints of unauthorized withdrawals, leading to a bank investigation and report to the Rwanda Investigation Bureau.
• Defendants face charges including fraud, misuse of computer systems, identity fraud, and money laundering, with some disputing their involvement or the nature of the transactions.
• The case highlights the critical need for financial institutions to strengthen electronic payment system security and internal controls against employee misuse.

This ongoing Nyarugenge Intermediate Court fraud case underscores the critical importance for financial institutions in Rwanda to continuously audit and strengthen their electronic payment system security protocols, particularly regarding employee access and authentication processes.

A significant trial is underway at the Nyarugenge Intermediate Court, involving seven individuals accused of orchestrating a substantial electronic payment fraud scheme against BPR Bank Rwanda Plc. The alleged theft amounts to $260,189, equivalent to approximately Rwf383.7 million, purportedly siphoned through the manipulation of the bank's digital transaction systems. This high-profile BPR Bank Rwanda Plc electronic payment fraud trial highlights vulnerabilities within financial technology infrastructure.

Among the defendants are Manirakiza Obed, a former IT employee of the bank, and Uwitonze Jean Paul, who founded the Nyungwe Sideview Hotel. Also implicated are Bikorimana Innocent, a mining company owner from Rulindo District, along with Bayingana Denis, an international commission agent. The list further includes Urimubenshi Dismas, a former employee of Uwitonze, and two others, Nzatunga Ruvuguta Emmanuel and Mutangana Parfait Sixbert.

The investigation into this alleged fraud commenced after numerous BPR customers reported unauthorized withdrawals from their accounts, noting that their bank card details had been used without their consent. Following an internal inquiry, BPR Bank Rwanda Plc escalated the matter to the Rwanda Investigation Bureau (RIB). The accused now face a range of serious charges, including general fraud, misuse of computer systems, identity fraud, and money laundering, underscoring the complex legal landscape surrounding cybercrime in the region.

Prosecutors contend that the alleged scheme hinged on the exploitation of BPR Bank Rwanda Plc's electronic payment authentication processes, particularly through the actions of Manirakiza Obed. It is alleged that Manirakiza, leveraging his position as an IT employee, deliberately downgraded the security protocols for certain customer accounts. He is accused of moving these accounts from the more robust 3D payment authentication system to the less secure 2D system, thereby enabling transactions to proceed with a significantly reduced level of verification for card details. This alleged Manirakiza Obed BPR Bank Rwanda Plc fraud points to a critical lapse in internal controls.

Further allegations suggest that Manirakiza provided several co-defendants with unauthorized access to CyberSource, a platform essential for processing electronic payments. Communications between the accused are reportedly being presented as evidence of their coordinated efforts in executing the alleged fraudulent activities. The prosecution asserts that these transactions began as early as August 7, 2025, leading to the bank's discovery of the issue and subsequent suspension of affected cards in October 2025, at which point the compromised system was shut down.

Manirakiza, however, has vehemently denied any wrongdoing, asserting that his actions were merely part of his regular duties in assisting bank customers. He maintained that the responsibility for selecting the appropriate payment system did not fall within his purview. The prosecution also claims that the illicit proceeds were distributed among some of the defendants, with a significant portion, specifically $127,000, allegedly channeled through Uwitonze’s hotel. This aspect of the case brings the Rwanda money laundering charges into sharp focus.

The defendants have presented diverse arguments in their defense before the Nyarugenge Intermediate Court. Bikorimana Innocent, for instance, has denied all charges, stating that his business dealings with BPR Bank Rwanda Plc were entirely legitimate. He also asserted that he had no prior acquaintance with the other individuals implicated in the case. Bikorimana highlighted that his company was established in 2018, predating the alleged offenses, as evidence supporting his innocence. His legal counsel further argued that the use of 2D and 3D payment systems is not inherently criminal, especially since the bank itself facilitated access through standard business arrangements. Bikorimana also mentioned a chargeback dispute, explaining that he proactively approached the bank upon realizing he had received funds that were not rightfully his, seeking to resolve the matter amicably.

Uwitonze Jean Paul, accused of involvement in transactions totaling $127,000, has challenged the prosecution's claims, specifically stating that they failed to demonstrate his continued use of the CyberSource platform after the bank officially shut it down in October 2025. He also contested the money laundering allegations, insisting that all his transactions were covered by existing agreements with BPR Bank Rwanda Plc. Urimubenshi Dismas, a former employee of Uwitonze, testified that he opened a company account in his own name at Uwitonze's request because Uwitonze was listed in the Credit Reference Bureau. Urimubenshi stated he provided his identification and phone number believing he was following his employer's instructions and denied any personal financial gain, though prosecutors argue his participation implies an expectation of benefit.

Bayingana Denis, an international commission agent, explained that he was engaged by Uwitonze to attract clients to the hotel, with an agreement entitled him to a 15% commission on payments from referred customers. However, prosecutors allege that Bayingana played a role in organizing meetings to discuss the fraudulent use of CyberSource. Mutangana Parfait Sixbert also denied any wrongdoing, stating that BPR Bank Rwanda Plc had provided him with access to CyberSource. His lawyer suggested that the entire dispute should be classified as a commercial matter rather than a criminal one, further complicating the CyberSource payment fraud Rwanda narrative.

This ongoing Nyarugenge Intermediate Court fraud case underscores the critical importance for financial institutions in Rwanda to continuously audit and strengthen their electronic payment system security protocols, particularly regarding employee access and authentication processes. The allegations of internal manipulation of security settings, such as the alleged downgrade from 3D to 2D authentication, highlight a significant vulnerability that could be exploited without robust BPR Bank Rwanda Plc internal controls.

The case serves as a stark reminder that even sophisticated electronic payment systems like CyberSource can be compromised if internal safeguards are insufficient or if privileged access is misused. Compliance officers within financial institutions should meticulously review existing protocols to prevent similar incidents of CyberSource payment fraud Rwanda. Furthermore, the multiple charges, including fraud, misuse of computer systems, identity fraud, and Rwanda money laundering charges, illustrate the multifaceted legal challenges that arise from such complex financial crimes. This trial will likely set precedents for how such intricate schemes, involving both technical exploitation and alleged coordinated efforts, are prosecuted and defended in the Rwandan legal system, emphasizing the need for enhanced Rwanda electronic payment system security.

This case underscores the critical importance for financial institutions in Rwanda to continuously audit and strengthen their electronic payment system security protocols, particularly regarding employee access and authentication processes. Compliance officers should review internal controls to prevent misuse of systems like CyberSource, while legal counsel should be prepared to advise on the complex interplay of fraud, cybercrime, and money laundering charges, especially when defending against allegations of intent in technically intricate schemes.

Source: Original reporting via the provided source material