Stolen ID, Phone Used in KSh1M Fraud as Court Holds Bank Liable Richard Kamau

A Nairobi court has ruled that banks can be held responsible for customer losses when weak account verification systems allow fraud to unfold. The decision, delivered by the Milimani Small Claims Court, concerns a case where fraudsters exploited a customer’s stolen identification documents and phone to access his account.

The court ordered the bank to refund the customer Ksh511,000 after unauthorized access led to transfers carried out without consent. According to the ruling, the fraud began after criminals used the customer’s stolen national ID, ATM cards, and phone to bypass security checks.

In its findings, the court concluded that the bank breached its duty of care. It noted that the bank permitted a new digital banking profile to be created on an account that had previously been used offline. The judges stated that the bank’s onboarding process for new digital channels did not provide adequate security safeguards.

“This Court finds that the Respondent’s “Know Your Customer” (KYC) and onboarding process for new digital channels was inherently insecure. A bank’s duty of care must extend to ensuring that a significant change to an account, such as the activation of digital banking, is verified with a high degree of certainty,” the judgement stated.

Robbery Triggered Unauthorized Digital Access

The dispute started in July 2025 after the customer, who had used the bank for more than 10 years, was robbed. The thieves stole his national ID, ATM cards, and phone, setting the stage for subsequent fraud.

Within hours, fraudsters created a digital banking profile on his account without his permission. They then carried out three unauthorized transactions that transferred Ksh1.001 million.

The bank later recovered Ksh490,000, but Ksh511,000 remained outstanding. The court said the bank’s verification process for activating new digital services failed to meet the required security standards.

Higher Verification Needed for Major Account Changes

The court further made clear that banks must strengthen identity checks when customers face major changes to their accounts. It stated that any significant change, such as enabling mobile or internet banking, must trigger a higher level of identity verification to prevent misuse.

The court also rejected the bank’s argument that the customer’s delay in reporting the theft should absolve it of liability. It found that stronger security measures could have prevented the loss from occurring in the first place.

Contractual Duty to Protect Customer Funds

Beyond the technical failures, the ruling also highlighted banks’ broader obligations. The court noted that banks hold a contractual duty to take reasonable steps to protect customers’ funds.

As a result, the court ordered the bank to pay the customer the Ksh511,000 balance. It also awarded interest at 12 per cent per year and granted Ksh50,000 in legal costs. The court, however, declined to award general damages.