The Upendo women's savings group met in a church hall because seventeen members had discovered that the balance on their screens could not all be withdrawn at the same time.
Chairlady Beatrice opened with one question.
“Do we take everything out today?”
Half the room said yes.
The other half warned that a panic withdrawal could destroy the group even if SawaLink had made the error.
Aisha sat at the back.
“I will not tell you not to be afraid, and I will not tell you to leave money because the company needs stability. We can first verify what we can actually see.”
They projected the group statement. Each member could bring her own receipt. The treasurer supplied the group ledger. No one surrendered PINs or full personal-wallet histories.
They began with a clean KSh 3,000 deposit.
Then a KSh 5,500 transfer that had legitimately reversed.
“Keep the clean examples in the review,” Aisha said.
“Why? We came for the problem.”
“Because a report containing only suspicious lines may be our own selection bias.”
Then Joyce produced a KSh 12,000 receipt. The group statement showed the deposit. Overnight, the same amount moved through a reserve journal. An internal reference pointed to a borrower ID no member recognized.
“So my money paid a stranger's loan?” Joyce asked.
“The reporting layer says the reserve was classified that way. We still need to separate the liability from the reporting treatment.”
Beatrice frowned. “Office language.”
Aisha drew three boxes on a board: wallet balance, reserve pool, repayment report.
“The group may still be owed its full balance while the report tells a misleading story about where reserve activity came from. That is different from saying your exact cash was wired to a stranger.”
The women began asking better questions: Was reserve consented to? Could a group wallet enter a borrower repayment pool? Why did the report use an unknown borrower? Was the metric shown to investors?
They organized their own verification team. Beatrice held the group statement. Joyce collected member receipts. Salome listed unanswered questions. Missing documents stayed pending; no one filled gaps with memory.
Aisha showed them how to preserve a copy reference without turning them into auditors. Beatrice laughed.
“We already do this with two signatures on paper.”
“Then the digital tool is only another version of your own rule.”
The group debated a full withdrawal. If everyone emptied the fund, members with emergency loans would be harmed. If no one could withdraw, urgent needs would be pushed onto the victims of the dispute.
They voted on a compromise: emergency withdrawals under the group's own rule, core funds held pending reconciliation, a three-day review date and a collective claim for documented mismatches.
Aisha did not vote. It was their money.
The resolution also required that SawaLink not contact members individually about the group claim without the treasurer knowing, unless a member requested private support. The company would not use fragmentation to dissolve a collective record.
Before closing, the treasurer found Joyce's deposit again in the repayment extract.
It had been journaled against a borrower who had never belonged to Upendo.
The group's balance had not merely become unavailable.
The verification team scheduled its own three-day checkpoint before anyone left the hall. Claims with no supporting record would remain pending rather than being converted into loss estimates. Beatrice also requested a short training session on reading correction history, but she refused an offer for SawaLink staff to maintain the group's evidence table. Upendo would keep ownership of its records. The company could explain the system and answer references; it would not become the author of the community's claim. Aisha approved an independent claims mailbox so members did not have to route their complaint through the same sales relationship that managed the account.
The system had given part of it someone else's financial story.