A Nairobi court has dismissed a suit against Equity Bank Kenya Limited over fraudulent withdrawals from a customer's account.
Senior resident magistrate Edwin Mulochie ruled that the bank was not liable for withdrawals from Patrick Kihara Wambugu's account totalling Sh872,026.
The withdrawals occurred between December 2016 and April 2017.
The magistrate found that the transactions were conducted using Wambugu's login credentials, email address and Kenyan phone number and that he had failed to prove the bank was complicit in the fraud.
Wambugu had sued Equity Bank seeking a refund of the amount, compensation of Sh338,486 in lost interest income and punitive damages for alleged breach of fiduciary duty.
He claimed his email and bank details were hacked while he was in Dubai, leading to a Sh3 million transfer from his CIC Money Market Account to his Equity account on December 5, 2016.
“After the transfer of theSh3,000,000, various other withdrawals amounting to Sh1,067,802 were subsequently made out of his account,” the court heard.
Among the Sh1,067,802 withdrawal was a huge payment/withdrawal of Sh930,000, which was purportedly in respect of a land conveyance transaction.
The bank recovered Sh195,776 from an account belonging to Anthony Muturi Njogu, into which Sh930,000 had been credited.
However, a net balance of Sh872,026 remained unrecovered.
The recovered funds were subsequently released back to Wambugu on January 15, 2018 when his account access was restored.
Wambugu stated that he believed the transactions were the work of insiders within the defendant who must be well known to the bank.
On March 27, 2017, while he was still in Dubai, a bank official telephoned him and asked him to travel back to Kenya to lodge a formal complaint with the Central Bank of Kenya's Banking Fraud Investigations Unit.
He did so on April 3, 2017, shortly after his return, but the bank never followed up meaningfully and had not even supplied the fraud unit with copies of the suspicious emails that would have aided the probe.
Throughout this period, he was locked out of his account, despite the fact that it regularly held running balances above Sh2 million.
While a week passed before he contacted the bank to flag the withdrawals, Wambugu stated the bank's subsequent inaction fell short of the standards expected of a financial institution.
He argued that the bank should have detected suspicious activity, particularly as he was abroad.
But Equity Bank maintained that all transactions were processed using Wambugu's confidential password and one-time PINs sent via SMS.
The bank submitted that the alleged transactions were conducted using the plaintiff's log‑in credentials and password and therefore the transfers were made either by Wambugu or with his collusion.
In his judgment, Mulochie observed that Wambugu admitted his email was hacked but failed to report to his service provider and did not alert the bank when he received unexplained OTPs.
The magistrate noted that although Wambugu told the court the defendant was aware he was out of the country, it was not clear whether he always notified the bank whenever he returned.
He concluded that since the instructions to pay came from Wambugu's email address and phone number, it would be misplaced to fault the defendant for transactions to which the customer was alerted.
On the claim that the bank breached its duty of care by freezing the account and failing to honour standing orders, the court found the bank's actions were reasonable security measures following Wambugu's own fraud report.
The court also noted that the largest transaction, Sh930,000, was below the Sh1 million threshold that would have triggered automatic scrutiny and that Wambugu's Kenyan number remained active throughout his time abroad.
