Case Update: Diamond Trust Bank Kenya Ltd v Kariuki & Another

On February 6, 2022, Mercy Wairimu Kariuki received airtime and SIM swap notification alerts on her mobile line. She immediately contacted Safaricom’s customer care to report that she had not authorised the swap. Safaricom confirmed the unauthorised SIM swap had been done via an agent and promised to block the line. Her mobile line was subsequently reinstated at a dealer shop on February 7, 2022.

On the morning of February 8, 2022 (with initial debit alerts occurring around 5:23 AM), Ms Kariuki received multiple transaction alerts. A total of Kshs. 4,418,601.00 had been fraudulently transferred from her DTB account through the bank’s mobile banking platform and PesaLink to multiple unrelated bank accounts and mobile numbers.

Ms. Kariuki maintained that she never shared her Personal Identification Number (PIN) with anyone. She instituted legal proceedings in the Chief Magistrate's Court at Mavoko (Civil Suit No. 182 of 2020), alleging that both DTB and Safaricom breached their duties of care, committed data breaches, and acted negligently by failing to stop the fraud despite clear red flags.

The Chief Magistrate's Court (Hon. R.W. Gitau, SRM) delivered judgment on March 26, 2024, holding both DTB and Safaricom liable for breaching their respective duties of care.

The trial court apportioned liability as follows: (a) Safaricom PLC: 60% liable (ordered to pay Kshs. 2,630,000); and (b) Diamond Trust Bank Kenya Ltd: 40% liable (ordered to pay Kshs. 1,788,601). The court also awarded general damages for negligence and breach of confidentiality, along with costs and interest.

Dissatisfied with this outcome, DTB filed an appeal, and Safaricom filed a cross-appeal.

PIN Authentication: DTB argued that all disputed transactions were initiated via its mobile app upon input of the correct secret PIN. Under its General Terms and Conditions, the bank contended that entry of the correct PIN entitled it to treat the instructions as authorised without further verification.

Transaction Limits & Non-Business Days: DTB maintained that because the system operated over non-business days (Sunday to Monday), the transactions spanned separate system days and did not breach its hard daily limit of Kshs 2,000,000.00. The bank submitted that the court imposed an unrealistic standard by requiring manual monitoring outside business hours.

Causation (Novus Actus Interveniens): DTB argued that Safaricom’s unauthorised SIM swap was the sole proximate cause of the loss. It asserted that any failure by the bank to detect daily limit breaches was a secondary event that merely failed to mitigate a loss already set in motion by Safaricom.

Platform Separation: Safaricom contended that its mandate is strictly limited to providing telecommunications infrastructure and that it exercises no control or visibility over DTB's mobile banking system. No funds were lost from the customer's M-Pesa account.

Timeline of Control: Safaricom pointed out that the SIM card was swapped on February 6, but Ms. Kariuki regained full possession and control of her line on February 7. The fraudulent transactions were recorded on February 7 and 8, after line restoration.

Proximate Cause: Safaricom argued that the proximate cause of loss was either a security defect within DTB’s platform or the customer's failure to protect her PIN. It submitted that banks have an independent duty to flag and investigate unusual transactions.

The High Court (Ongeri, J.) evaluated the evidence and dismissed both the appeal and cross-appeal, affirming the trial court's decision in full:

• Independent Duty of Care & Inadequacy of PIN Entry: The Court reaffirmed that a bank owes a fiduciary duty to exercise reasonable skill and care in executing customer instructions (citing Fidelity Commercial Bank Ltd v Italian Market Kenya Ltd). Entering the correct PIN does not automatically absolve a bank where surrounding circumstances ought to arouse suspicion.
• Failure to Respond to Red Flags: The rapid, sequential transfer of large sums to multiple unrelated bank accounts and phone numbers constituted significant "red flags". DTB breached its duty by failing to flag or verify these suspicious transactions.
• 24/7 Automated Systems Operating Environment: The Court rejected DTB's argument regarding non-business days. Because mobile banking systems operate automatically on a 24/7 basis, banks cannot rely on non-business days or technical compliance with daily limit resets to evade their ongoing duty to monitor and detect fraudulent patterns.
• Concurrent Liability and Causation: The Court rejected DTB’s novus actus interveniens defence. The fraud was a continuous chain of events: Safaricom’s unauthorised SIM swap was the catalyst that compromised the line, but DTB’s subsequent failure to safeguard the account and respond to red flags was an equally operative cause of the financial loss. Both entities failed in their concurrent duties of care.

The court dismissed DTB’s Appeal and Safaricom’s cross-appeal and awarded costs to the 1st Respondent. The trial court’s finding of 60% liability against Safaricom and 40% liability against DTB (amounting to Kshs. 1,788,601.00 against DTB) was upheld in its entirety.