Court dismisses sh68m suit against Stanbic
Nakku claimed that 17 unauthorised transactions were made from her savings account, number 903000026244, through the bank's FlexiPay platform between February 7 and 8, 2023.
Court dismisses sh68m suit against Stanbic
__________________
The High Court Commercial Division has dismissed a sh68m lawsuit against Stanbic Bank Uganda Limited, ruling that the bank was not liable for money withdrawn from a customer's account by unauthorised persons.
Justice Dr Ginamia Melody Ngwatu dismissed the suit filed by Joweria Nakku, who had sued the bank seeking a refund of sh68m, general damages, interest and costs.
Nakku claimed that 17 unauthorised transactions were made from her savings account, number 903000026244, through the bank's FlexiPay platform between February 7 and 8, 2023.
She argued that the transactions, which involved multiple withdrawals within a short period and were made to different phone numbers, were unusual because she had maintained a largely dormant savings account since opening it in 2001.
According to Nakku, the bank should have detected the unusual transaction pattern and flagged or blocked the withdrawals as suspicious.
She also told the court that she had lost her phones on February 6, 2023, but immediately notified her mobile network service providers and had not personally enrolled for the FlexiPay service.
Nakku argued that the bank had a duty to safeguard her money and should have had robust fraud detection mechanisms to prevent the loss.
The bank, however, denied liability, arguing that Nakku's phone and national identity card had been compromised, allowing third parties to use her credentials to register her for FlexiPay and access her account.
Stanbic argued that Nakku did not promptly notify the bank about the loss of her phone and credentials, despite being required to do so under the terms governing her banking relationship.
It further argued that its systems had authentication safeguards, including national identification details, PINs, security questions, verification codes and SMS notifications, which were successfully used before the transactions were completed.
Justice Ngwatu agreed that the bank owed Nakku a duty to exercise reasonable skill and care in operating and safeguarding her account.
However, the judge said the key question was whether the bank had breached that duty and should therefore be held responsible for the unauthorised withdrawals.
The court found that Nakku's authentication credentials had been compromised following the loss of her phone.
The judge noted that although Nakku testified that she had immediately reported the loss to the police and mobile network operators, her evidence was contradicted by an audio recording in which she reportedly stated that she had reported the matter to the police the following day.
The court also noted that the police record presented in evidence was dated February 10, 2023, several days after the alleged loss of the phone.
Justice Ngwatu further observed that Nakku had remained in communication with the person who had her phone until February 10, which the court found inconsistent with her claim that the SIM card had been immediately blocked.
The judge said Nakku should have promptly notified the bank about the loss of her phone and other information that could have compromised the security of her account.
"With the loss of her phone, the plaintiff should have promptly notified not only her network providers but also the defendant," the judge held.
The judge noted that although there had been several unsuccessful attempts to enrol the account on FlexiPay, the evidence showed that the prescribed authentication process was eventually completed using the plaintiff's registered credentials.
According to the court, validation and authentication codes were sent to the phone number registered with the bank before the transactions were completed.
Justice Ngwatu cited previous court decisions which held that banks have a duty to maintain secure digital banking systems and put in place reasonable fraud detection mechanisms.
However, she said there was no evidence that Stanbic had failed to follow its prescribed authentication procedures or that the bank had breached its duty of care.
The judge further held that a bank's duty to flag a transaction as suspicious only arises where there are reasonable grounds, based on specific and clear indicators, to believe that a payment instruction may facilitate fraud.
"Although there were unsuccessful attempts preceding the successful transactions, they could not without more impose upon the defendant a duty to treat the transactions as suspicious," Justice Ngwatu ruled.
The court also found that the bank's primary duty was to follow its customer's payment mandate and that there was no sufficient basis to conclude that the transactions should have been flagged.
"Where there is a compromise in a customer's authentication credentials and no breach of the bank's duty has been established, liability cannot be imposed on the bank merely because unauthorised transactions occurred," the judge said.
The court consequently dismissed Nakku's suit and all the remedies she had sought, including the sh68m refund, interest and general damages.
She was also ordered to pay the bank's costs of the suit.