Man held for SIM swap swindle using ex-OCS Talaam's cell phone

A troubling case of cybercrime and institutional negligence is unfolding at the Milimani Law Courts, where the Directorate of Criminal Investigations (DCI) is probing a man accused of hacking the phone number of former Central Police Station OCS Samson Talaam, while the device is still in the custody of investigators, and using it to con unsuspecting Kenyans. 

Kiprotich Ronoh Brian, who appeared before Magistrate Caroline Mugo yesterday, is said to be the prime suspect at the centre of a SIM swap scheme using a phone belonging to Talaam, currently under investigation by the Independent Policing Oversight Authority (Ipoa).

According to an application filed by DCI in court seeking to continue holding the suspect for more days, the phone, a TECNO CLA5 with a SIM card, had been seized by Ipoa detectives from the OCS on June 15, 2025, as an exhibit in a separate ongoing probe over the murder of blogger Albert Ojwang’ in police cells.

But just a day after its seizure, it was allegedly used by unknown persons to solicit money from Talaam’s lawyers, including Cliff Ombeta and his close family members, through distress messages claiming the officer was in need of help.

What’s shocking is that the phone was supposedly in Ipoa’s secure custody the entire time.

Following the fraudulent messages, Talaam’s lawyer Danstan Omari told the court that the impersonation went far enough to trick even senior advocates into believing Talaam was in danger.

“Your honour, the number belonging to Chief Inspector Talaam was used to contact several people, including my colleague Cliff Ombeta, asking for Sh80,000. The caller claimed that Talaam was in trouble and needed money urgently,” Omari testified.

He added: “This is no ordinary fraud. The phone was supposed to be under IPOA lock and key. If it was used to swindle innocent Kenyans, then IPOA must answer for that breach.”

The court was told Talaam’s family members also received similar distressing messages, warning of a wider scheme to defraud unsuspecting Kenyans.

According to a filed affidavit by Inspector Nickson Kiunga, an investigator with the DCI’s General Investigations Unit, Kiprotich was arrested on July 20, 2025, in the Pipeline area of Nairobi following extensive digital surveillance.

“This is a case of unauthorised interception, computer fraud, identity theft, and engaging in organised criminal activity,” Kiunga stated in his affidavit, citing sections of the Computer Misuse and Cybercrimes Act No. 5 of 2018 and the Prevention of Organised Crimes Act.

The court heard DCI detectives launched investigations into the fraudulent scheme after Omari, appearing on behalf of Talaam, told the court that the phone number had been used inappropriately while under Ipoa custody. 

The DCI said that Kiprotich’s arrest followed a formal complaint by IPOA, and a subsequent report lodged by Talaam at Lang’ata Police Station under OB No. 31/18/06/2025. 

Recovered during the arrest were multiple mobile phones, used and unused SIM cards, and electronic storage devices, all of which investigators say are vital to the ongoing digital forensic analysis. 

“There is a high likelihood that the suspect has associates. If released, he could interfere with evidence, witnesses, or evade justice,” the DCI submitted. 

Kiunga noted that the investigation team is awaiting call data records and subscriber information tied to the swapped SIM card to establish the extent of the scam. 

The court was told that due to the bulkiness and sensitivity of digital evidence, more time is needed for experts from the DCI Cyber Forensics Unit to fully analyse the data and prepare appropriate charges.

“The mobile number was actively being used even after its seizure. We have credible intelligence that the respondent used the number to send distress messages and request funds,” Kiunga said in a sworn affidavit. 

He further noted that Ronoh’s release would jeopardise ongoing operations to arrest co-conspirators whom police are still pursuing.

“We are dealing with an organised fraud syndicate. The suspect has not acted alone,” added Kiunga.

Magistrate Mugo ruled that Ronoh be detained for seven days at Muthaiga Police Station to assist with ongoing investigations before formal charges can be preferred against him.

The court directed the DCI to conduct forensic analysis of all electronic devices recovered from the suspect and file an investigative report by August 4, 2025.

ngitonga@standardmedia.co.ke

The spotlight also turned on IPOA, which had the phone.

“This is a serious security lapse. Only IPOA commissioners and their IT team had access to this phone. We’re asking the court to summon IPOA officials for an explanation,” Omari argued.

After hearing submissions from both sides, Magistrate Mugo ruled that Ronoh be detained for seven days at Muthaiga Police Station to assist with ongoing investigations before formal charges can be preferred against him.

The court directed DCI to conduct forensic analysis of all electronic devices recovered from the suspect and file an investigative report by August 4, 2025.