The High Court in Machakos has ordered Safaricom and Diamond Trust Bank (DTB) to pay a combined Ksh. 4,418,601 to a victim of a coordinated SIM swap fraud.
The ruling, delivered by High Court Judge Asenath Ongeri, dismissed appeals from both institutions. It upholds a previous Mavoko Chief Magistrate’s Court decision holding both giants liable for a serious “breach of duty of care” toward their customer.
Under the finalized judgment, the liability split remains:
- Safaricom (60% liability): Ordered to pay Ksh. 2,630,000.
- Diamond Trust Bank (40% liability): Ordered to pay Ksh. 1,788,601.
The legal battle stems from a February 2022 incident involving Mercy Wairimu Kariuki, a DTB customer.
On February 6, 2022, Kariuki’s Safaricom SIM card was compromised through an unauthorized SIM swap. Recognizing the sudden loss of signal, she reported the security breach to Safaricom immediately and successfully had her line restored the following day.
However, the damage had already been initiated. On February 8, Kariuki received a flood of SMS alerts revealing that Ksh. 4,418,601 had been systematically drained from her bank account. Over a three-day period, fraudsters used DTB’s mobile banking system and PesaLink to siphon the funds into multiple third-party accounts, carefully staggering the transactions to stay below standard transaction limit thresholds.
Both Safaricom and DTB launched appeals to dodge the lower court’s March 2024 ruling.
Safaricom filed a cross-appeal arguing its 60% liability was unjust. The telecommunications giant claimed it operates purely as an infrastructure provider and has zero visibility or oversight over transactions running on a commercial bank’s proprietary platform.
Meanwhile, DTB argued it should not be held liable because the transactions were completed using the customer’s correct Personal Identification Number (PIN). The bank also argued that some of the transactions took place over a weekend—a non-business day—making manual detection or human intervention impossible at the time.
Judge Ongeri firmly rejected both arguments, laying down three massive precedents that will send shockwaves through Kenya’s financial and tech sectors:
1. The PIN Defense
In a major win for consumers, the court ruled that banks cannot escape liability simply because a fraudster used the correct PIN.
“A bank is expected to exercise reasonable care and cannot simply rely on the fact that a transaction was initiated using the correct PIN if there are other suspicious circumstances,” wrote Judge Ongeri.
The court noted that the rapid, consecutive transfers to multiple unknown accounts were so “glaringly out of the ordinary” that any reasonable banker should have stepped in to investigate.
2. Banking demands 24/7 security
The court shut down DTB’s excuse that weekend transactions escaped human oversight. Because digital and mobile banking networks are marketed and operated on an automated, 24/7 basis, the High Court ruled that banks are legally obligated to monitor and flag suspicious activities around the clock.
3. Telcos hold the master key
While Safaricom tried to distance itself from the banking side of the crime, the High Court ruled that the telecom operator’s laxity in verifying the identity of the person requesting the SIM swap was the “direct and proximate cause of the loss.” By allowing the fraudulent SIM swap to occur, Safaricom opened the door for the hackers, justifying their higher 60% liability.
Historically, Kenyan victims of mobile banking fraud have been caught in a frustrating loop of denial. Banks routinely blamed mobile networks, networks blamed banks, and both ultimately blamed the victim for exposing their PIN.