This story is based on court proceedings as reported by bbegmedia.com.
Kampala, Uganda: The High Court in Kampala has dismissed a lawsuit filed by a Stanbic Bank customer seeking to recover Shs68 million stolen from her savings account through the bank’s FlexiPay digital platform, ruling that the bank was not liable after her personal authentication credentials were compromised.
The ruling, delivered by Justice Dr. Ginamia Melody Ngwatu, brings to an end a legal battle between Joweria Nakku and Stanbic Bank over fraudulent transactions that emptied her savings account in February 2023.
According to court records, Nakku opened her Stanbic savings account in 2001 and primarily used it to save money rather than conduct regular transactions. Apart from a monthly insurance deduction, the account had remained largely dormant for years.
Her troubles began on February 6, 2023, when she lost her mobile phone. The following day, unknown individuals allegedly registered her account on Stanbic Bank’s FlexiPay digital banking platform before carrying out a series of transactions that drained Shs68 million from the account.
Nakku maintained throughout the case that she had never enrolled for FlexiPay and had always preferred conducting transactions physically at the bank. She argued that she never authorised anyone to access her savings through the digital platform.
Bank rejects liability
After discovering the fraudulent withdrawals, Nakku reported the matter to Stanbic Bank and demanded a refund.
According to court proceedings, the bank declined responsibility, arguing that the fraud resulted from the compromise of her banking credentials after the loss of her mobile phone.
Nakku subsequently sued the bank, seeking a refund of the entire Shs68 million, general damages, interest and the costs of the suit. She argued that Stanbic had failed in its duty of care by allowing dozens of unusual transactions to be processed within approximately 24 hours without triggering fraud detection mechanisms.
She further told court that she had never lost her National Identity Card, had never registered for FlexiPay and had immediately contacted both Airtel Uganda and MTN Uganda to block her SIM cards after her phone went missing.
Her lawyers argued that the account had an established transaction pattern, with the only regular activity being a monthly insurance deduction of about Shs200,000. They contended that processing numerous high-value digital transactions through a platform Nakku had never previously used should have immediately raised red flags within the bank’s fraud monitoring systems.
Stanbic in defence
Stanbic Bank, in its defence, admitted that Nakku held the account but maintained that the fraud occurred after her personal banking credentials had been compromised. The bank argued that fraudsters used her stolen phone together with personal identification information to successfully register for FlexiPay before withdrawing the funds.
According to Stanbic, Nakku failed to notify the bank promptly after losing her phone, contrary to the terms governing her account.
The bank told court that although the phone was reportedly lost on February 6, 2023, Nakku only formally notified Stanbic on March 6, 2023, by which time all the money had already been withdrawn.
The lender’s lawyers argued that customers also bear responsibility for safeguarding their phones, PINs, National Identity Cards and other banking credentials.
Stanbic further maintained that its digital banking systems had appropriate authentication procedures, fraud detection measures and transaction alerts in place.
The bank also confirmed that before the matter reached court, it had proposed settling the dispute by refunding Shs34 million, representing half of the disputed funds.
However, Stanbic stressed that the offer was made without admitting liability, while Nakku rejected the proposal, insisting on full compensation.
Court finds credentials were compromised
In her judgment, Justice Ngwatu acknowledged that Stanbic owed Nakku a legal duty of care as its customer. “The question left for determination therefore is whether the bank breached that duty and is liable for the unauthorized withdrawals made from the plaintiff’s account.”
After reviewing the evidence, the judge found inconsistencies in Nakku’s testimony regarding the circumstances surrounding the loss of her phone.
Although Nakku claimed she had immediately notified police and mobile telephone companies, the court found there was no evidence proving that Airtel or MTN had blocked the SIM cards on the same day.
The court also noted contradictions regarding her National Identity Card after evidence suggested it had been kept together with the stolen phone despite Nakku’s earlier insistence that it had never been lost.
Justice Ngwatu further observed that the police report produced in court was dated February 10, 2023, several days after the alleged theft, and that Nakku remained in communication with the individual who had her phone until that date.
The judge ruled that those facts demonstrated that Nakku’s personal authentication credentials had been compromised following the theft of her phone.
“In the circumstances, therefore, I find that the plaintiff’s personal authentication credentials were compromised following the loss of her mobile phone,” Justice Ngwatu ruled.
The court accepted that Nakku may never have personally registered for FlexiPay but concluded that whoever obtained possession of her phone and personal credentials was able to register the account through the USSD platform before initiating the disputed transfers.
Justice Ngwatu noted that authentication codes and validation messages were sent to Nakku’s registered telephone number before the transactions were completed.
She also held that unsuccessful attempts to register the account before successful transactions did not, by themselves, make the subsequent withdrawals suspicious.
Suit dismissed
Justice Ngwatu concluded that Stanbic Bank could not be held liable merely because unauthorised transactions occurred after Nakku’s banking credentials had fallen into the hands of fraudsters.
“A bank owes its customers a duty to exercise reasonable skill and care in safeguarding their accounts and in processing transactions. However, where there is a compromise in a customer’s authentication credentials and no breach of the bank’s duty has been established, liability cannot be imposed on the bank merely because unauthorized transactions occurred,” she ruled.
The court consequently dismissed Nakku’s entire suit, denying her claims for the Shs68 million, general damages, interest and legal costs.
The ruling means Nakku ultimately recovered none of the money she sought through the courts after rejecting Stanbic Bank’s earlier offer to settle the dispute by paying her Shs34 million.
If you would like your article/opinion to be published on Uganda’s most authoritative news platform, send your submission on: [email protected]. You can also follow DailyExpress on WhatsApp and on Twitter (X) for realtime updates.
