News
Kenyan court holds banks, telcos liable over $34,000 SIM swap fraud
The Kenyan Court's Ruling: A Wake-Up Call for Banks and Telcos Mercy Wairimu Kariuki's nightmare began on February 8, 2022, when she woke up to find that KES 4.
Mercy Wairimu Kariuki's nightmare began on February 8, 2022, when she woke up to find that KES 4.4 million ($34,000) had been stolen from her Diamond Trust Bank (DTB) account. The theft was the result of a SIM swap she had reported to Safaricom two days earlier, on February 6. Kariuki's ordeal raises a crucial question: who is responsible when a SIM swap goes wrong? The Kenyan High Court's recent ruling has shed light on this issue, holding both DTB and Safaricom liable for the theft.
The court's ruling is a significant development in the fight against SIM swap fraud in Kenya. According to the ruling, both DTB and Safaricom bore responsibility for the theft, with each company owing customers an independent duty to prevent foreseeable losses. This ruling sets a new standard of care for banks and telcos handling SIM swap fraud, emphasizing that each company must take proactive steps to prevent such losses, even when the fraud originates outside its own systems.
The sequence of events in Kariuki's case is all too familiar in Kenya's mobile money ecosystem. Fraudsters swapped Kariuki's SIM on February 6, and she reported the incident to Safaricom customer care the same day after receiving suspicious alerts. Despite her prompt reporting, the swap went through, and her line was restored the following day at a Safaricom shop. However, by the morning of February 8, her DTB account had already been emptied through a combination of mobile banking transfers and Pesalink withdrawals.
DTB argued that its systems had worked exactly as designed, since every disputed transaction followed successful entry of Kariuki's PIN. However, the court rejected this defense, emphasizing that a bank cannot hide behind a customer's PIN when it is presented with a series of suspicious transactions. This ruling is a significant blow to the banking industry, which has long relied on customers' PINs as a security measure.
The court ultimately split liability between DTB and Safaricom, with DTB ordered to pay Kariuki KES 1,788,601 ($13,800) and Safaricom ordered to pay KES 2,630,000 ($20,300). This 40:60 split reflected the court's finding that while Safaricom's SIM swap failure enabled the fraud, DTB independently breached its duty of care by failing to detect and halt a series of suspicious transactions.
Kariuki's case highlights the vulnerability of Kenyan consumers to SIM swap fraud. The court's ruling sends a strong message to banks and telcos: they must take proactive steps to prevent such losses, even when the fraud originates outside their own systems. This ruling is a significant step towards protecting Kenyan consumers and ensuring that banks and telcos are held accountable for their actions.
In the aftermath of this ruling, I predict a rise in SIM swap investigations in Kenya. Banks and telcos will be under increased scrutiny to ensure that they are taking adequate measures to prevent such losses. This ruling is a wake-up call for the industry, and it will be interesting to see how banks and telcos respond to this new standard of care.
The Kenyan court's ruling is a significant development in the fight against SIM swap fraud. It sets a new standard of care for banks and telcos handling SIM swap fraud, emphasizing that each company must take proactive steps to prevent such losses. This ruling is a wake-up call for the banking and telecom industries, and it will be interesting to see how they respond to this new standard of care.
