A Nairobi small claims court has ordered Stanbic Bank Kenya Limited to pay Sh511,000 to a customer who lost funds through digital theft.
James Njoroge, a customer of the bank for over 10 years, was robbed on the morning of July 13, 2025.
His physical wallet containing his National ID, ATM cards and mobile phone linked to his bank account was stolen.
At 14:48 hours that same day, a new digital banking profile was self-registered on his account. Within 16 minutes, three unauthorised transactions totalling Sh1,001,000 were processed.
The bank recovered Sh490,000 from a receiving account, leaving an outstanding balance of Sh511,000.
“The claimant’s [Njoroge] case, as presented in his Statement of Claim and evidence, is that he was a diligent and careful customer who had deliberately avoided digital banking. The claimant asserts that he had never used nor registered for mobile or online banking, preferring to conduct all his banking transactions physically at the branch,” the court heard.
“The claimant further argues that the bank's fraud detection systems were inadequate. An account that had zero digital footprint for over a decade was suddenly registered for OMNI [digital banking platform that allows customers to self-register via mobile phone and conduct online transactions] and within 16 minutes, a sum of Sh1,001,000 was siphoned on the same day. He contends that this anomalous transaction velocity should have triggered an immediate flag and block by the bank's automated systems.”
The bank's witness, Joseph Kabiru, testified that the OMNI self-registration process was secure, requiring a National ID number, registered phone number, date of birth, account number and three separate OTPs sent to the registered mobile number.
Since all details were correctly provided, the bank had no reason to suspect fraud.
The bank argued that the customer owed a reciprocal duty to safeguard banking credentials and notify the bank promptly upon their loss.
The robbery occurred at 6:30 am, but the bank was not notified until 5:19 pm, nearly 11 hours later.
The bank maintained it could not be held liable for losses incurred before it was put on notice.
Resident Magistrate Shirley Kerubo ruled that the bank breached its duty of care by maintaining a self-registration process for its OMNI digital platform that allowed fraudsters to easily bypass security measures.
The court found the bank's reliance on knowledge-based information and OTPs sent to a stolen phone commercially unreasonable.
The judge cited the case of Family Bank Limited v Lucy Wamaitha Kiarie.
"A bank is the keeper of the gate through which its customer's money passes; where it is warned that the gate stands open and does not close it, it cannot afterwards be heard to say that the thief carried the right key."
The court determined that the bank's "Know Your Customer" and onboarding process for new digital channels was inherently insecure, noting that the information provided a decade ago to open a physical account was the same information the fraudster now possessed.
The magistrate found it incredulous that the bank's fraud detection algorithms did not flag the anomaly of a digital profile being activated on a long-standing offline account, with large transfers occurring within minutes.
The court rejected the bank's argument that Njoroge's delay in reporting contributed to the loss, considering evidence that he was a victim of violent robbery and had been drugged, with his wife reporting as soon as practicable.
Magistrate Kerubo observed that the theft occurred because the bank's security protocols were inadequate, not because of any delay.
General damages were not awarded, with the court guided by the principle that general damages are not recoverable in cases of breach of contract where the loss is a specific, quantifiable sum.
The court entered judgment for Sh511,000 with interest at 12 per cent per annum from the date of filing until payment in full, plus costs assessed at Sh50,000.
