The High Court has upheld a judgment holding Diamond Trust Bank (DTB) and Safaricom jointly liable for losses suffered by a customer who lost more than KSh4.4 million through fraudulent transactions after her mobile phone line was subjected to an unauthorized SIM swap.
In a judgment delivered on June 18, 2026, Justice Asenath Ongeri dismissed both DTB’s appeal and Safaricom’s cross-appeal, affirming an earlier decision by the Mavoko Chief Magistrate’s Court that found the two companies negligent in protecting their customer’s money and personal data.
The dispute arose after Mercy Wairimu Kariuki received a SIM swap alert on February 6, 2022. She immediately contacted Safaricom customer care and was advised to visit a Safaricom shop, where her line was restored the following day. However, on the morning of February 8, she woke up to several transaction alerts showing that KSh4,418,601 had been transferred from her DTB account through the bank’s mobile banking platform and Pesalink without her authorization.
Kariuki sued both DTB and Safaricom, accusing the bank of failing to detect and stop suspicious transactions while faulting Safaricom for allowing the unauthorized SIM swap despite her reporting it immediately. The trial court found Safaricom 60 per cent liable and DTB 40 per cent liable. DTB was ordered to pay KSh1,788,601 while Safaricom was directed to settle KSh2.63 million, with both companies challenging that finding before the High Court.
On appeal, DTB argued that all the disputed transactions were authenticated using the customer’s secret PIN and complied with the bank’s daily transaction limits. It maintained that the fraudulent SIM swap carried out on the Safaricom network was the sole cause of the loss and that the bank merely processed validly authenticated transactions. Safaricom, on the other hand, argued that it only provides telecommunications infrastructure and has no control over banking transactions conducted through DTB’s mobile banking platform. It maintained that the customer’s SIM card had already been restored before the fraudulent withdrawals occurred and therefore it should not bear responsibility for losses incurred within the bank’s system.
Justice Ongeri rejected both arguments, holding that the bank and the telecommunications provider each owed the customer an independent duty of care.
“The law is clear that a bank owes a fiduciary duty to its customer to exercise reasonable skill and care in handling the customer’s account,” the judge stated.
The judge held that although the SIM swap enabled fraudsters to gain access to the customer’s banking services, the financial loss occurred because DTB’s systems processed a series of unusual and high-value transfers without intervention.
“The bank cannot hide behind a customer’s PIN when it is presented with a series of transactions that are so glaringly out of the ordinary that a reasonable banker would have been put on inquiry,” Justice Ongeri ruled.
The court further observed that the withdrawals involved multiple unrelated accounts and mobile numbers in rapid succession, circumstances that should have triggered additional verification by the bank. It also rejected DTB’s argument that the transactions occurred during a non-business day, noting that modern banking systems operate around the clock and must be capable of detecting suspicious activity regardless of the day.
Regarding Safaricom, the court found that the unauthorized SIM swap constituted a breach of its duty to protect the customer’s personal data and telecommunications line, particularly because the customer had promptly reported the suspicious activity before the fraud was completed.
Justice Ongeri concluded that both companies’ failures combined to cause the loss.
“The SIM swap was the catalyst, but the bank’s failure to protect the account was equally an operative cause of the loss,” the judge said.
The High Court dismissed both the bank’s appeal and Safaricom’s cross-appeal with costs, affirming the magistrate’s judgment in its entirety.
