A court in Nairobi has ruled that banks can be held liable for losses suffered by customers when weak account verification systems enable fraud.

🇰🇪 Breaking It Down

The Milimani Small Claims Court ordered a bank to refund a customer Ksh511,000 after fraudsters used his stolen identification documents and phone to access his account.

According to the court, the bank had failed in its duty of care by allowing a new digital banking profile to be created on an account that had previously been operated offline.

“This Court finds that the Respondent’s “Know Your Customer” (KYC) and onboarding process for new digital channels was inherently insecure. A bank’s duty of care must extend to ensuring that a significant change to an account, such as the activation of digital banking, is verified with a high degree of certainty,” the judgement stated.

📌 What You Need to Know

The case arose after a customer, who had banked with the institution for more than 10 years, was robbed in July 2025, losing his national ID, ATM cards and phone.

Hours after the robbery, a digital banking profile was created on his account without his consent, followed by three unauthorised transactions that transferred Ksh1.001 million.

The bank managed to recover Ksh490,000, leaving Ksh511,000 outstanding from the amount taken.

In its judgment, the court found that the bank’s verification process for activating new digital services was not sufficiently secure.

The court said a significant change such as enabling mobile or internet banking on an account required a higher level of identity verification.

Further, it rejected the argument that the customer’s delay in reporting the theft should absolve the bank, finding that stronger security measures could have prevented the loss.

📰 Source: Kenyans.co.ke