Joweria Nakku thought the Shs68 million she had saved in her Stanbic Bank account was safe. She had opened the savings account in 2001 and mainly used it to keep money rather than make frequent withdrawals.
But the account had remained largely inactive for years except for a regular monthly insurance deduction.
Her problems began after she lost her mobile phone on February 6, 2023. A day later, unknown people used Stanbic Bank’s FlexiPay digital banking platform to register her account and make a series of transactions that emptied Shs68 million from it.
Nakku insisted she had never signed up for FlexiPay. She said she had never authorised anyone to access her savings through the digital platform and had always preferred to carry out transactions in person at the bank.
She reported the matter to the bank, which said it was not their problem. They accused her of being careless with her credentials, like passwords.
Nakku sued the bank, accusing it of failing to protect her money from fraudsters. She wanted the bank to refund the entire Shs68 million and compensate her with general damages and meet the costs of the suit.
In court, she argued that the transactions took place within about 24 hours without the bank detecting anything unusual.
Nakku maintained that she never approved the withdrawals and blamed the bank for failing to stop what she described as suspicious activity.
She also complained that Stanbic had earlier offered to settle the dispute by paying her only half of the lost money, Shs34 million, but she rejected the proposal because she believed the bank should refund the entire amount.
In reply, Stanbic Bank admitted that Nakku held the savings account but argued that the fraud happened after she lost the mobile phone linked to her banking details.
According to Stanbic, the stolen phone, together with her personal identification information, enabled fraudsters to register her on FlexiPay before withdrawing the money.
The bank said Nakku did not notify it immediately after losing her phone, even though the account terms required customers to promptly report the loss of banking credentials.
Stanbic argued that by the time Nakku finally reported the matter on March 6, 2023, all the money had already been withdrawn a month earlier, making it impossible for the bank to stop the transactions.
The bank also confirmed that it had proposed settling the dispute by paying Shs34 million but stressed that the proposal was made without admitting liability.
Nakku told court that immediately after losing her phone, she contacted Airtel Uganda and MTN Uganda to block the SIM cards.
She argued that despite those steps, the fraudulent transactions still went through later that day.
She further said her savings account had remained dormant for nearly five years and that such unusually large withdrawals should have immediately alerted Stanbic’s fraud detection systems.
Nakku also insisted that she had never lost her national identity card and had never enrolled for FlexiPay because she simply did not need the service for an account she mainly used for savings.
Her lawyers argued that Stanbic Bank had breached its contractual duty of care by failing to detect clear warning signs before the money disappeared.
They told the court that the account had an established pattern. The only regular transaction was a monthly insurance deduction of about Shs200,000.
Suddenly, within two days, dozens of withdrawals worth Shs68 million were processed through a digital banking platform that Nakku had never previously used.
According to her lawyers, those transactions should have immediately raised suspicion.
They argued that the bank had enough information about how Nakku normally operated her account because she had been its customer since 2001.
Stanbic’s lawyers rejected all those arguments, saying the bank had fulfilled all its obligations as a responsible banker and that the fraud resulted from Nakku’s failure to protect and promptly report the loss of her banking credentials.
The bank’s lawyers argued that customers are equally required to keep their account information, national identity card, phone, PINs and other banking credentials secure.
Stanbic told court that its banking platforms had adequate security measures, fraud prevention systems and transaction alerts.
According to the bank, every transaction was carried out through Nakku’s registered FlexiPay wallet after the correct authentication procedures had been completed.
Its lawyers argued that fraud detection systems cannot distinguish between a genuine customer and a fraudster who is using the customer’s own phone and identification details.
They also said there was no evidence that the bank had ignored any mandatory security procedures before processing the transactions.
Stanbic further argued that Nakku delayed reporting the matter to the bank for nearly a month. By the time she informed the bank on March 6, 2023, the money had already been withdrawn, leaving the bank with no opportunity to freeze the account or stop the transactions.
Ugandan who promoted D9 scheme ordered to refund Tanzanian investors Shs 500 million
After hearing both sides, Justice Dr Ginamia Melody Ngwatu agreed that there was no dispute that Stanbic owed Nakku a duty of care as its customer.
“The question left for determination therefore is whether [bank] breached that duty and is liable for the unauthorized withdrawals made from [Nakku’s] account.”
She then examined the evidence surrounding the loss of Nakku’s phone.
Although Nakku testified that she immediately informed the police and mobile telephone companies after losing the phone, Justice Ngwatu found inconsistencies in her evidence.
She said that Nakku admitted during cross-examination that she had no proof that she notified MTN or Airtel on the same day.
Justice Ngwatu also discovered contradictions regarding Nakku’s national identity card because while she told the court that she never lost it, the audio recording indicated that the card had been kept behind her stolen phone.
She observed that the police record produced in court was dated February 10, several days after the alleged theft, and that Nakku remained in communication with the person who had her phone until February 10, something the court said was inconsistent with her claim that the SIM card had immediately been blocked.
“In the circumstances, therefore, I find that [Nakku’s] personal authentication credentials were compromised following the loss of her mobile phone,” Justice Ngwatu ruled.
She accepted that Nakku may never have personally registered for FlexiPay but concluded that once her phone and personal credentials were compromised, whoever possessed them was able to register for the service through the USSD platform and later transfer money from the account.
Justice Ngwatu said that validation codes and authentication messages were sent to Nakku’s registered telephone number before the transactions were completed.
She said the unsuccessful attempts to register the account on FlexiPay before the successful transactions did not automatically make the transactions suspicious.
Justice Ngwatu concluded that Stanbic could not be held responsible simply because unauthorised withdrawals occurred after Nakku’s personal banking credentials had fallen into the hands of fraudsters.
“A bank owes its customers a duty to exercise reasonable skill and care in safeguarding their accounts and in processing transactions. However, where there is a compromise in a customer’s authentication credentials and no breach of the bank’s duty has been established, liability cannot be imposed on the bank merely because unauthorized transactions occurred,” she ruled.
Having reached that conclusion, she dismissed Nakku’s entire claim.
So in the end, Nakku did not recover the Shs68 million she had sought, nor was she awarded general damages or interest.
Remember, initially, before matters went to court, the bank had suggested refunding Nakku at least half (Shs 34 million) of the money that was stolen, but she rejected the deal.
Now she came out of the court process with nothing.
