Banks could face greater legal liability for delayed responses to suspected fraud after the High Court upheld a ruling that Family Bank breached its duty of care by failing to secure a customer’s account promptly, following notification of unauthorised mobile banking transactions.
The court upheld a Small Claims Court decision requiring the lender to compensate a customer over fraudulent mobile banking withdrawals totalling Sh720,000, signalling that a bank’s failure to act after receiving a fraud report can itself attract liability.
“A bank is the keeper of the gate through which its customer’s money passes; where it is warned that the gate stands open and does not close it, it cannot afterwards be heard to say that the thief carried the right key,” said Justice Benard Murunga.
The court also held that the use of a customer’s correct PIN to execute a fraudulent transaction did not absolve the bank of liability once it had been notified of a suspected scam.
The judgment, dated July 2, 2026, dismissed Family Bank’s appeal and affirmed an award of Sh350,000 to the customer, Lucy Wamaitha Kiarie, who reported that unauthorised withdrawals had emptied her account between February 7 and 10, 2022.
Police later recovered Sh40,000 for her, while the bank refunded Sh150,000 after she had already sued, leaving the balance for determination by the Small Claims Court.
The decision provides fresh guidance on banks’ obligations once customers report suspected fraud, distinguishing liability for the original compromise of banking credentials from responsibility for preventing further losses after being placed on notice.
Family Bank argued that every disputed transaction had been authenticated using the customer’s correct Personal Identification Number (PIN), making it impossible for the bank to distinguish fraudulent instructions from genuine ones.
The bank told the court that the customer was obligated to keep her PIN confidential and that compensating customers where the correct PIN had been used would expose financial institutions to fraudulent claims.
It also argued that the Small Claims Court had wrongly shifted the burden of proof and failed to evaluate documentary evidence properly, showing how the transactions were processed.
Ms Kiarie opposed the appeal, maintaining that the disputed transactions were processed through an Android banking application she had never used because she had always accessed her account through the bank’s USSD platform.
She told the court the money was transferred to third parties unknown to her and that she reported the suspicious transactions immediately to both the bank and the Banking Fraud Investigation Unit.
The court dismissed the appeal, finding that the Small Claims Court had correctly applied the law governing the burden of proof and was entitled to conclude that the customer had established her claim on a balance of probabilities.
Crucially, the court held that the bank’s liability arose not from the initial compromise of the customer’s PIN but from its failure to protect the account after the fraud had been reported.
“The trial court did not fix the appellant with liability for the initial compromise of the PIN. It fixed liability only from the moment the appellant was put on notice, reasoning that from that day the duty to safeguard the account was fully engaged, and that the withdrawals which followed ought to have been prevented,” the court said.
The court also relied on Family Bank’s own submissions before the trial court, where it admitted that its practice required an account to be frozen immediately after a fraud complaint.
“At paragraph 18 of its submissions… the appellant admitted that its practice required an account to be frozen once a fraud complaint is made, that in this case ‘this was not done’,” the court said, adding that the bank had refunded part of the lost money for that reason.
Rejecting the bank’s reliance on the use of the correct PIN, the court said, “The refrain that the correct PIN was used is no answer to a breach that consists not in failing to divine the fraud, but in failing to act once the fraud was known.”
