The High Court of Kenya recently delivered a bombshell judgment that permanently shifts how mobile banking fraud is handled in the country. Justice Asenath Ongeri dismissed appeals from telecommunications giant Safaricom PLC and Diamond Trust Bank (DTB), upholding a lower court ruling that ordered both institutions to jointly compensate a customer KES 4,418,601 lost to a sophisticated SIM swap scam.
For years, banks and telcos have successfully blamed victims for allegedly compromising their PINs. This landmark ruling shatters that defense.
If you use mobile banking apps, M-Pesa, or digital payment platforms in Kenya, here is a breakdown of what happened, why the court blamed the corporations, and the steps you must take right now to protect your hard-earned money.
The Anatomy of the KES 4.4 Million Fraud Case
The case stems from an incident involving a customer named Mercy Wairimu Kariuki. On February 6, 2022, fraudsters successfully initiated an unauthorized SIM swap on her Safaricom line through an independent agent.
The timeline of the fraud highlights critical vulnerabilities in standard security protocols:
- February 6: Kariuki noticed her line lost network coverage, contacted Safaricom customer care, and was told an unauthorized SIM swap was underway.
- February 7: She visited a physical Safaricom shop where her official line was fully restored.
- February 8: Despite regaining control of her phone, she woke up at 5:23 AM to a barrage of debit alerts. Fraudsters had used the window to drain KES 4,418,601 from her DTB account via their mobile banking app and Pesalink.
The money was systematically split into smaller, rapid transactions sent to multiple unfamiliar bank accounts and mobile numbers to bypass standard security thresholds.
“While the courts are handling mobile security, the education sector is also facing major updates; discover the truth behind the new TSC Phase 2 CBA salary structure rolling out this month.”
Why a Correct PIN Is No Longer a Defense for Banks
In past mobile fraud disputes, financial institutions routinely avoided liability by proving that the correct secret PIN was used to authorize withdrawals. DTB attempted this exact defense, arguing that the customer must have leaked her credentials.
However, Justice Ongeri rejected the argument entirely, establishing a new legal standard for a bank’s duty of care:
“A bank cannot hide behind a customer’s PIN when it is presented with a series of transactions that are so glaringly out of the ordinary that a reasonable banker would have been put on inquiry.”
The court ultimately split the liability between both corporations:
- Safaricom (60% Liable): Ordered to pay KES 2,630,000. The court found that the telco negligently approved the initial fraudulent SIM swap and failed to secure the user’s line despite an immediate report.
- Diamond Trust Bank (40% Liable): Ordered to pay KES 1,788,601. The court ruled that the automated, 24/7 banking system should have automatically flagged and frozen the rapid, suspicious overnight transfers.
How to Protect Your Mobile Line and Bank Account Right Now
While this ruling provides a legal safety net for consumers, a court battle takes years to resolve. It is far better to prevent the fraud from happening in the first place. Use these three essential defense strategies:
1. Whitelist Your Line Against Remote SIM Swaps
Safaricom allows users to lock their SIM cards against remote replacements. By activating this feature, a SIM replacement can only be performed when you physically present yourself at a Safaricom shop with your original National ID Card.
- Dial *100*100# on your Safaricom line.
- Follow the prompts to activate the SIM swap lock feature.
2. Request Your Bank to Activate the SIM Swap Check API
In 2023, Safaricom launched a dedicated SIM Swap Check API. This tool allows a banking app to automatically check the exact timestamp of your last SIM replacement before approving a high-value mobile transfer. If your bank has not integrated this feature, they are exposed. Reach out to your bank’s customer service and verify if their mobile application actively utilizes this API.
3. Set Up Rigid App Transaction Limits
Do not leave your daily mobile banking limits at the maximum default rate. Log into your banking app and manually lower your daily transaction threshold to a budget-friendly amount. If fraudsters ever bypass your line, their access will be choked by your preset system limits.
The Big Takeaway for Kenyan Consumers
The Safaricom SIM swap fraud court ruling marks a turning point for digital consumer rights in Kenya. It sends a clear message to financial and telecommunication providers: automated systems must protect the end-user, and standard PIN validation is no longer an excuse for corporate negligence.
Have you ever experienced an unauthorized SIM swap attempt on your line? Let us know how you handled it in the comments below!
