The Rwanda Investigation Bureau (RIB) has arrested three men accused of orchestrating a sophisticated fraud scheme that targeted several fuel stations across the country, stealing over Rwf 17 million through digital payment manipulation.
The suspects — Straton Nsabimana, identified as the ringleader, and his accomplices Vincent Ntagwabira and Paul Mwesigye — were apprehended following a series of coordinated investigations after fuel stations filed multiple complaints reporting similar theft patterns.
The trick behind the scheme
According to RIB investigations, the trio would drive to fuel stations, fill up their vehicle, and proceed to pay through MTN MoMo Pay. However, instead of completing legitimate transactions, they exploited a digital loophole by deceiving pump attendants.
After pretending to make a partial payment, the attendant would notify them that the money received was less than the amount due. The suspects would then request to use the attendant’s phone “to verify the transaction,” claiming they wanted to confirm if the issue was from their end — a move that allowed them to access the payment device.
With one of them operating a laptop they carried in the car, they would log into the MTN MoMo Business Partner Portal, which is typically used by businesses to manage MoMo Pay transactions. Using the station’s payment code, they clicked on the “Forgot Password” option, prompting the system to send a One Time Password (OTP) to the fuel attendant’s phone — the very device they were holding.
They used that OTP to reset the password, granting themselves full access to the fuel station’s MoMo account. Once inside, they swiftly transferred large sums of money to their own numbers using the business portal — without needing the station’s physical SIM card.
In total, the suspects allegedly stole Rwf17,980,641 from nine different fuel stations located in Kigali, Nyagatare, Muhanga, Nyabihu, and Huye Districts.
They now face multiple charges, including forming or joining a criminal gang, obtaining money by deception, and unauthorized access to computer data or networks.
If found guilty, the suspects could face imprisonment ranging from seven to ten years for forming or joining a criminal gang, two to three years and a fine between Rwf 3 million and Rwf 5 million for obtaining money by deception, and six months to two years with a fine ranging from Rwf 1 million to Rwf 2 million for unauthorized access to computer data or systems.
