Court to Customer: You Lost Your Phone and ID. You Lost UGX68M. Stanbic Bank Not Liable in FlexiPay Fraud Case

Stanbic Bank head office/ Courtesy Photo

The High Court Commercial Division has dismissed a suit filed by Stanbic Bank customer Joweria Nakku, who sought to recover 68 million Shillings that was stolen from her savings account after thieves gained access to her account through the bank’s FlexiPay mobile application.

Justice Dr Ginamia Melody Ngwatu ruled that Nakku’s own negligence led to the loss after her personal authentication credentials were compromised when her mobile phone and national identification card were stolen. The court also ordered her to pay Stanbic Bank’s legal costs.

The dispute arose after Nakku lost her mobile phone and national ID in February 2023. According to court records, the thieves used the stolen identification documents to enrol for Stanbic Bank’s FlexiPay mobile banking service before transferring the entire 68 million Shillings from her savings account within 24 hours.

After failing to settle with the bank, which had offered to refund half of the lost money (34 million Shillings), Nakku sued Stanbic, arguing that it had breached its duty of care by failing to safeguard her account and prevent the fraudulent withdrawals.

Stanbic Bank denied liability, maintaining that the fraud was made possible because Nakku’s phone and identity documents, which contained her “Know Your Customer” details, had been compromised.

The bank argued that the stolen credentials were used to register for FlexiPay and that Nakku failed to notify the bank promptly after losing her phone, denying it the opportunity to secure the account.

The bank further stated that its account opening terms and conditions required customers to immediately report the loss of their phone or banking credentials so additional security measures could be activated.

Court records show Nakku reported the incident to police but did not alert Stanbic Bank until March 6, 2023, almost a month after the fraudulent withdrawals had already been completed. She only discovered the missing funds when she visited the bank.

In her judgment, Justice Ngwatu found inconsistencies in Nakku’s account of events. While Nakku testified that she reported the theft to police immediately, the judge noted that no documentary evidence was produced to support that claim.

Audio evidence presented before court instead indicated that the matter was reported the following day and that Nakku remained in communication with the person who had her phone until February 10, 2023.

The judge said this contradicted Nakku’s assertion that her SIM card had been blocked immediately after the theft, observing that continued communication with the person in possession of the phone would not have been possible if the SIM card had indeed been deactivated.

Based on the evidence, the court concluded that Nakku’s authentication credentials had been compromised following the loss of her mobile phone and identity documents. The court also dismissed Nakku’s argument that she had never applied for the FlexiPay service.

Justice Ngwatu held that customers can register for FlexiPay independently through the USSD code *291# or the FlexiPay application without physically visiting a bank branch. As a result, the court found that whether or not Nakku had signed an earlier customer information form was irrelevant to determining liability.

The judge further rejected claims that Stanbic should have treated the transactions as suspicious because they were preceded by multiple failed login attempts. She held that unsuccessful login attempts alone did not automatically impose a duty on the bank to block subsequent successful transactions.

Justice Ngwatu observed that a bank’s primary obligation is to honour its customer’s valid payment instructions while exercising reasonable skill and care in processing transactions.

However, she found no evidence that Stanbic had breached that duty or that the transactions contained suspicious characteristics requiring intervention. The court concluded that where a customer’s authentication credentials have been compromised and no negligence on the part of the bank has been established, liability cannot be imposed on the bank simply because unauthorised transactions occurred.

Online banking fraud has become increasingly common in recent years, with courts delivering varying decisions depending on the facts of each case. While some judgments have held banks liable for failing to adequately protect customers’ accounts, others, including this latest ruling, have found customers responsible where their own negligence contributed to the fraud.

-URN