By Meshack Masibo & Sarah Mwende
In a landmark decision on SIM swap fraud liability in Kenya, the High Court has held that Diamond Trust Bank Kenya Limited (DTB) and Safaricom PLC were jointly liable for a customer’s loss of Kshs. 4,418,601 following an unauthorized SIM swap and subsequent fraudulent banking transactions.
The decision is significant because it confirms that banks and telecommunications providers owe separate but concurrent duties of care to their customers. Where failures by both institutions contribute to financial loss, both may be held legally responsible.
Background of the Case
Unauthorized SIM Swap
On 6 February 2022, the customer, Kariuki, received alerts indicating that an unauthorized SIM swap request had been initiated on her Safaricom mobile number. She immediately contacted Safaricom customer care, which confirmed that the request had originated through an M-Pesa agent and assured her that the line would be blocked.
Fraudulent Transactions
The customer’s line was restored at a Safaricom shop on 7 February 2022. However, on the morning of 8 February 2022, she discovered multiple debit alerts showing that Kshs. 4,418,601 had been transferred from her Diamond Trust Bank account through a series of mobile banking and PesaLink transactions to various third-party bank accounts and mobile numbers.
The Customer’s Claim
The customer sued both institutions, alleging that each had failed in its respective duty of care.
Claims Against Diamond Trust Bank
- Negligence in processing suspicious transactions.
- Breach of fiduciary duty.
- Failure to detect and prevent fraudulent transfers despite obvious warning signs.
Claims Against Safaricom PLC
- Negligence in processing the unauthorized SIM swap.
- Failure to adequately secure her mobile line and customer identity verification process.
Decision of the Magistrate’s Court
The trial court found that both parties contributed to the loss and apportioned liability as follows:
| Institution | Liability Share | Amount Ordered |
| Safaricom PLC | 60% | ~Kshs. 2.63 Million |
| Diamond Trust Bank | 40% | ~Kshs. 1.79 Million |
The court also awarded general damages, interest, and costs. Both parties appealed.
Appeals & Arguments
Diamond Trust Bank’s Arguments on Appeal
DTB argued that it should not be held liable because:
- Valid Authentication: The disputed transactions were successfully authenticated using the customer’s correct mobile banking PIN, which constituted valid authorization under the Bank’s Terms and Conditions.
- Automated Weekend Processing: The SIM swap occurred on a Sunday when transactions were processed automatically without human intervention.
- Transaction Limits: The transfers were processed across different system days and therefore did not exceed the Bank’s daily transaction limit of Kshs. 2 million.
- Root Cause: The true cause of the loss was Safaricom’s unauthorized SIM swap rather than any negligence by the Bank.
Safaricom’s Cross-Appeal
Safaricom argued that:
- Limited Scope: Its responsibility is limited to providing telecommunications infrastructure and it has no control over banking applications or transactions processed through DTB’s systems.
- Restored Line: The customer’s SIM card had already been restored before the disputed transactions were completed.
- No M-Pesa Loss: No money was lost through the M-Pesa platform.
- Bank System Failures: Any losses resulted from weaknesses in the Bank’s systems or the compromise of the customer’s banking credentials.
High Court’s Findings
The High Court dismissed both the appeal and the cross-appeal, affirming the trial court’s decision in its entirety. The Court held that although the unauthorized SIM swap enabled the fraud, it did not relieve Diamond Trust Bank of its independent duty to protect the customer’s account.
Rejection of DTB’s Defense
The Court rejected the Bank’s reliance on:
- Successful PIN authentication
- Compliance with daily transaction limits
- Transactions processed over a non-business day
According to the Court, these factors did not excuse the Bank’s failure to identify and respond to a series of rapid, high-value transactions that clearly warranted additional scrutiny.
Combined Institutional Failures
The Court further held that the customer’s loss resulted from the combined failures of both institutions:
- Safaricom’s negligence in allowing the unauthorized SIM swap created the opportunity for the fraud.
- DTB independently failed to detect and intervene in suspicious transactions despite clear warning signs.
Final Apportionment Upheld:
- Safaricom PLC: 60% liable
- Diamond Trust Bank Kenya Limited: 40% liable
Why This Decision Matters: Key Takeaways
This landmark judgment sets a critical legal precedent in Kenyan banking, telecommunications, and cybersecurity jurisprudence. The ruling establishes that technical compliance (e.g., correct PIN entry or system auto-processing) does not shield institutions from liability when clear indicators of fraud are ignored.
1. For Financial Institutions
- Move Beyond Static Authentication: Relying solely on valid PIN logins or automated limits is no longer a complete defense against negligence claims.
- Proactive Fraud Monitoring: Banks must deploy dynamic transaction monitoring that detects rapid, high-value, or atypical transfer patterns—even during non-business days or weekends.
- Duty to Intervene: When anomalous activity occurs, institutions have an affirmative legal duty to flag, pause, or investigate transactions before funds are fully settled.
2. For Telecommunications Providers
- SIM Swaps as High-Risk Vectors: Courts recognize SIM replacement as a gateway for financial crimes, elevating the required standard of care for identity verification.
- Strict Agent Governance: Telecommunications operators are accountable for vulnerabilities in third-party retail or agent channels where unauthorized swaps originate.
- Cross-Industry Impact: Even if no funds are stolen directly from mobile money platforms (like M-Pesa), telcos remain liable if an unauthorized swap enables downstream banking fraud.
3. Strategic Impact on the Digital Financial Ecosystem
- Dual/Joint Liability: Courts will look at the entire chain of failure. Multiple service providers can be held concurrently liable, with damages apportioned based on their respective degree of failure.
- Elevated Standard for Consumer Protection: The burden of security is firmly placed on institutional actors rather than end consumers, particularly when customers promptly report compromised credentials.
How We Can Help
Digital banking, fintech, mobile money, and telecommunications services continue to evolve rapidly, bringing increased legal, regulatory, cybersecurity, and fraud-related risks.
At MasiboLaw LLP, we advise banks, fintech companies, payment service providers, telecommunications operators, and other regulated businesses on:
- Financial services regulation and compliance
- Fraud risk management
- Cybersecurity and data protection
- Customer verification and onboarding frameworks
- Regulatory investigations and disputes
- Digital payments and fintech legal advisory
Our team helps businesses strengthen their compliance frameworks while managing the legal risks associated with today’s digital financial ecosystem.
📧 For legal advice, contact MasiboLaw LLP at: info@masibolaw.co.ke
Leave a Reply