(Being an Appeal against the judgment and decree of Hon. Wamae E. M. Muindi Adjudicator delivered on 18th July 2024 in Nairobi Small Claims Court Case No. E2411 of 2024)
JUDGMENT
1. The appellant, Joram Emenwa Mutumbi is a customer of the respondent, KCB Bank Limited. The appellant operates a Bank Account No. 1209....21(other particulars withheld) held at the respondent’s Moi’s Bridge branch (the appellant though indicated erroneously that it is Moi Avenue branch). On 21st February 2024 an aggregate sum of KShs 242,464/= was withdrawn from the appellant’s said account. The details of the withdrawals are contained in the appellant’s statement of account and also in a forensic report prepared by the respondent and referred to herein afterwards. The amounts were withdrawn in three batches of KShs 100,046.50, KShs 42,557/= and 99,850/= in quick succession within 3 minutes between 16.04 Hrs and 16.07 Hrs.
2. It was the appellant’s case before the Small Claims Court (SCC) presented through his statement of claim dated 5th March 2024 and supported by his witness statement of the same date and bank statement dated 22nd February 2024, that, the money was withdrawn from his said account without his authority or consent. He claimed that the respondent was negligent and/or in breach of contract in the discharge of its duty of care towards him to have allowed the money to be withdrawn from his said account in such a manner. He therefore claimed from the respondent the said sum of money together with interest at court rates.
3. In his statement he stated that on 21st February 2024, he received a call from his mobile phone number 0722...153 from someone who told him that he was calling from Kenya Commercial Bank and who requested to know if he was a customer with the bank to which he answered in the affirmative. Nothing further happened. He had withdrawn KShs 15,000/= using his ATM that day. He became suspicious of the call he had received and on checking his bank account balance the following day he found that it had a credit of KShs 23,209.60 instead of KShs 265,733.35. The three withdrawals indicated above had been made.
4. According to the appellant, the statement seemed to indicate that the first withdrawals had been made through ATM but he had not made any ATM withdrawals that day and in any case, his debit card withdrawal limit was KShs 40,000/=. He therefore could not understand how each of the three transactions exceeding the KShs 40,000/= was made.
5. It was therefore the appellant’s case that the respondent was negligent and in breach of its duty of care to him as its customer as well as breach of contractual relationship with him.
6. The respondent through its response dated 25th March 2024, denied the claim in toto, even that the appellant held an account with it as alleged in the statement of claim. In the alternative, however, it contended that the transactions on the appellant’s account were done with the knowledge and/or authority of the appellant being the custodian of the ATM card. Further, that the transactions were not within the respondent’s knowledge and the same were caused by the appellant’s own negligence and want of care in so far as the security of his ATM card was concerned. It outlined the alleged particulars of the appellant’s negligence.
7. However, in its only material supporting its defence before the SCC, which was a forensic report dated 25th April 2024 and titled “Report on Disputed Card Load Wallet Transactions Aggregating KES 242,464 from AC 1209...21 Held at KCB Moi’s Bridge Branch by Joram Emenwa Mutumbi – Report No. 201 of 2024” in respect of the appellant’s said account, it indicated that the questioned transactions were processed to the debit of the said account on the 21st of February 2024 and were narrated as ATM withdrawals and Vooma transactions in his account statement. The report states further that in the entire period of his relationship with the bank, the customer has undertaken the bulk of his transactions from KCB Mtaani Agents. Further that the three transactions were three card load wallet transactions done on the 21st of February 2024 between 16:04 Hrs and 16:07 Hrs. The report goes on to state that two of the transactions for KShs 100,056.50 and KShs 42,557.50 were transfers to NCBA Loop Wallet while the transactions for KShs 99,850/= was a transfer to Vooma wallet Account No. 254100500135 i.n.o. Felix Opiyo Odede. Further that in all the instances in which the transactions occurred, One Time Passwords (OTP) to complete the transactions were sent to the customer’s Safaricom line number +254722...058. The report further indicates that shortly after the three transactions, the appellant’s card was restricted at the KCB Card Transaction Monitoring Unit at 16.08 Hrs after the system flagged the suspicious transactions. The report indicates that there were three further fraudulent attempts to access the appellant’s account between 16.07 and 16.09 Hours of the same day.
8. The report indicates further that the investigating team engaged with the appellant whereat he confirmed that prior to the transactions on 21st February 2024, at around 3.30 p.m., he received a call from phone number 0760000027 from someone who claimed to be working at KCB Moi Avenue branch and who informed him that the bank was in the process of changing the debit cards and that he should arrange to collect his new card from the branch. The appellant confirmed to the investigators that he shared certain codes or One Time Passowrds (OTPs) sent to his phone from the bank with the caller which calls were used by the caller to complete the fraudulent transactions.
9. The case proceeded by way of the pleadings and witness statements filed by the parties under section 30 of the Small Claims Court Act (Cap. 10A) Laws of Kenya. Section 30 of the SCCA provides that:
S. 30. Subject to agreement of all parties to the proceedings, the Court may determine any claim and give such orders as it considers fit and just on the basis of documents and written submissions, statements or other submissions presented to the Court.
10. Upon considering the material placed before it the court, the learned Adjudicator found that the appellant had failed to prove his case on a balance of probability because he had not offered any credible evidence to prove the claim and therefore dismissed it.
11. Arising out of that decision, the appellant filed the present appeal through a memorandum dated 29th July 2024 which contains based on three grounds as follows:
a. The learned Adjudicator/Magistrate was wrong and erred in holding that appellant contributed to the loss of funds from his account and further erred in failing to find that it was the inactions and omissions on the respondent’s part in not securing its system which enebled fraudsters to defraud the appellant.
b. The learned Adjudicator/Magistrate was wrong in failing to find that the respondent’s employees and agents with access to the respondent’s security infrastructure and records who had been placed in those positions by the respondent who committed theft of funds from the appellant’s account with the respondent and for which the respondent was vicariously liable.
c. The learned Adjudicator/Magistrate erred in holding that the appellant had shared passwords with persons who transferred money from the appellant’s account when there was no evidence to support such a finding.
12. The appellant therefore prays to this court that the appeal be allowed and the judgment of the SCC be set aside and in lieu thereof be substituted with an order allowing the claim with costs to the appellant.
13. An appeal to this court from the SCC is on points of law only as provided for under section 38 of the SCC Act. Therefore, this court is not permitted to interfere with the findings of fact by the trial court unless the decision is bad in law and cannot be supported by the evidence tendered. On that issue the Court of Appeal in M’Riungu v. Republic [1983] KLR 455, held thus:
“where a right of appeal is confined to question of law, an appellate court has loyalty to accept the findings of fact of the lower court(s) and resist the temptation to treat findings of fact as holdings of fact and law and it should not interfere with the decision of the trial court or the first appellate court unless it is apparent that on evidence, no reasonable tribunal could have reached that conclusion, which would be the same as holding that the decision is bad in law”.
14. The appellate court may however interfere with the findings of the trial court where it is demonstrated that there was no evidence at all upon which such findings were based or that the evidence relied upon was of such a nature that no reasonable tribunal, properly addressing its mind on it, could have made such findings (see for instance Bashir Haji Abdullahi v Adan Mohammed Nooru & 3 others [2014] eKLR).
15. The appeal was canvassed by way of written submissions filed by learned counsels for both parties.
16. I have considered the grounds of appeal raised in the memorandum of appeal, the record of appeal and the submissions by learned counsels for the parties.
17. An important feature to bear in mind while considering the appeal is that the SCC Act exempts the court’s proceedings from the rigid application of the standards of evidence applicable in other court proceedings and permits the court to include as evidence any material that it deems credible or trustworthy (emphasis by underlining supplied). It follows from this provision that it is largely upon the Adjudicator to determine the material to rely upon. Section 32 of the Act provides that the strict evidentiary rules applicable in other courts are not wholly applied in the Small Claims Court. It further, provides that the Court may admit as evidence any oral or written testimony, record, or other material even though the same is not admissible as evidence in any other Court under the law of evidence (emphasis supplied). This means the Adjudicator has the discretion to admit any evidence which may be helpful in establishing whether or not the claim is proved.
18. Moreover, the procedure applicable before the SCC is unlike the procedure before the magistrates’ courts. Section 3 of the SCC Act on the guiding principles of the court provides inter alia that the court shall be guided by the principles of judicial authority prescribed under Article 159(2) of the Constitution and without prejudice to the same, the Court shall adopt such procedures as the Court deems appropriate to ensure fairness of process and simplicity of procedure (emphasis supplied). The fairness of process is further reinforced under Part IV which is the substantive part that deals with procedure. Section 17 of the Act which falls under Part IV, it provides that:
S. 17. Subject to this Act and Rules, the Court shall have control of its own procedure in the determination of claims before it and, in the exercise of that control, the Court shall have regard to the principles of natural justice.
19. Therefore, the principles of natural justice rather than the technical procedural rules under the CPR take centre stage in a SCC hearing. In Justice Amraphael Mbogholi Msagha v. Chief Justice of the Republic of Kenya & 7 Others Nairobi HCMCA No. 1062 of 2004; [2006] 2 KLR 553; [2006] eKLR, the Court, in discussing the rules of natural justice, cited De Smith and Brazier, Constitutional and Administrative Law 6th Edition (Penguin United Kingdom: 1989) (pages 557-558) which states:
“The content of natural justice is therefore flexible and variable. All that is fundamentally demanded of the decision maker is that his decision in its own context be made with due regard for the affected parties’ interests and accordingly be reached without bias and after giving the party or parties a chance to put his or their case....”
20. In the contractual relationship of a banker and customer there exists a duty of care between them. Each owes a duty of care to the other.
21. The issue for determination then is the scope of the respondent’s duty towards the appellant and whether the same was discharged and therefore whether the learned Adjudicator erred in law in holding that the respondent had not breached its duty of care towards the appellant.
22. According to the appellant, the threshold was not met and so the respondent was in breach of that duty of care towards the appellant.
23. The respondent submits on that issue that the learned Adjudicator did not err by holding that the PIN usage did not automatically imply authorization by the account holder, the respondent herein, as contended by the appellant.
24. In the banker and customer relationship the banker has a large portion of control as regards the transactions in the customer’s. For instance, the bank has to sanction the release of money from the account to the customer’s or any athorised third party. For the customer, he has the safeguard of his mobile phone which is presumed to be in his possession whenever a transaction is being initiated and carried out. In addition, the respondent has stated in its report submitted in evidence that it sends receives a One Time Password (OTP) to the customer to authorize the transaction to proceed. Therefore, only the customer authorizes any transaction by insertion of the OTP sent to his phone by the bank.
25. The appellant’s case herein is that he did not initiate any transaction on his ATM card for the withdrawal of the amounts the subject of the claim. Indeed, there is no indication in the forensic report relied upon by the respondent that the appellant through his phone number or at the ATM initiated the transactions that caused the withdrawal of the funds from his account. The question is, from which point were the transactions initiated and secondly, from where were the OTPs that were sent to the appellant sourced? The respondent did not answer these questions through its said report. Under section 112 of the Evidence Act, only the respondent had the special knowledge of where the transactions were initiated and the OTPs sourced. It therefore had the obligation to adduce evidence on those issues which it failed to. Therefore, the answers can only be that they were initiated by somebody who had access to the respondent’s banking system and to the appellant’s account. The respondent’s only case against the appellant is that he shared his OTPs with the caller.
26. The question that emerges is, who had access to the appellant’s account details with the bank to know that he had money in his account that could be withdrawn? It was held in the case of Barclays Bank of Kenya Limited v Diana Sambo Mwasela [2020] KEHC 7569 (KLR) that:
“The Appellant seems to suggest that the Respondent is liable for the lost suit amount since the withdrawals were enabled by the Personal Identification Number that was only privy to the Plaintiff. I have a difficulty with the Appellant. This is because the Appellant only alleged that the Respondent caused the money to be withdrawn since her pin was used in the process of withdrawing such monies. There are other persons other than the Respondent which may have access to the Appellant’s details and this includes the bank employees, directors among others. Secondly, the bank ought to have other mechanisms to trace the exact person who withdrew the said monies without the Appellant’s authorization such as CCTV. If such mechanisms are not in existence, then many customers are at risk of losing their money through unauthorised transactions.”
27. I am persuaded to follow this decision that there are persons within the respondent’s establishment who may have access to the respondent’s database of its customers such as employees, directors among others and therefore have details of the customers and these can be fraudulently applied to cause transactions on unsuspecting customers’ accounts such as the case herein. In that case the banker is in breach of its duty of care and must be held to account for any loss arising.
28. The respondent did not disclaim that phone number 0760000027 from which the appellant received the calls alleging to be from the respondent’s Moi Avenue branch actually came from the bank. In that case, the appellant could not be faulted for responding to the call. That is what an ordinary prudent person, placed in the appellant’s position would have done. In its contention that the appellant was negligent in receiving the call from the alleged stranger and then sharing the OTPs, the respondent did not demonstrate that what the appellant did was conduct that fell below what an ordinary prudent person, that is, a reasonable person, would be expected to do under those circumstances.
29. From the forensic report, it emerged that the bank sends the OTP to the customer in order to complete a transaction. The forensic report shows that those OTPs were used to complete the transactions, that is, to access the appellant’s account for the withdrawals of the funds. It is common knowledge that the OTP is a security code generated by the bank and tied to the specific account operated by a customer and then tied to the customer’s mobile phone line. This ensures that the specific customer account cannot be accessed without authorization from his phone line.
30. The bank has not denied that the OTPs actually came from its system or a source linked to its system. The operations of these interconnected systems could only be in the special knowledge of the appellant and therefore the none other than a person who had access to the bank’s system sent generated and sent the OTPs to the appellant.
31. Finally, the forensic report showed that the appellant’s phone line was not illegally swapped. The forensic report further showed that having received the OTP on his phone line, the appellant did not enter it on his phone line but had to share it with the third party in order to complete the transaction. The question that was not answered by the bank as the operator of the banking system is how did the third party manage to feed the respondent’s system and therefore to access the appellant’s account with the OTP when the same had not come from the appellant’s phone number yet, as found above, the account, the phone line and the OTP are tied together?
32. The only logical conclusion from the foregoing evaluation of the material placed before the SCC is that the transactions were done with someone who had access to the appellant’s account with the respondent and therefore to the respondent’s system and he could generate the OTPs and send to the appellant’s phone line and then upon receiving them back from the appellant, to feed them into the system.
33. Even if the appellant simply entered the OTP on his phone without sharing it (which the forensic report has not stated to be the case) the respondent would still be liable for causing the OTPs to be generated fraudulently and sent to the appellant’s phone.
34. Further, the respondent states that after the first three transactions, it detected the unusual activity on the appellant’s account and then caused it to be restricted so that further transactions were thwarted and not carried out. However, this was rather late in the day as a substantial sum of money had been siphoned out of the appellant’s account. The respondent said in its forensic report that it was aware that the bulk of the appellant’s transactions were undertaken from KCB Mtaani Agents. In the present case, two of the transactions were to NCBA Loop Wallets while the third was a transfer to Vooma wallet account of a third party by the name of Felix Opiyo Odede A/C No. 254100500135. I find that armed with the information that the appellant ordinarily conducted his transactions through KCB Mtaani Agents and not through the wallets as indicated in the report, the respondent was negligent in not flagging out the first transaction before issuing the OTP since it was an unusual transaction on the appellant’s account. The respondent had the capability, as it did afterwards to restrict the account immediately it detected the suspicious transaction and then call the appellant to confirm whether he was indeed carrying out those unusual transactions. The failure to do so was negligent on the respondent’s part.
35. I am guided to this conclusion from the decision in the case of Simba Commodities Limited v Citibank N. A. [2013] KEHC 5859 (KLR) where the High Court made reference to the writings of the learned authors in Ross Cranston’s Principles of Banking Law 2nd Edition at P. 187 where it is state that:
“There is long-established authority, in the context of bills of exchange, that a bank can be in breach of its duty of reasonable care and skill in failing to make inquiries. Certain transactions are so out of the ordinary course that they ought to arouse doubts and put the bank on inquiry. If the bank fails to inquire, it cannot be said to have acted without negligence in converting a bill. The Quincecare case applies the principle in another context – the care and skill the bank should exercise in paying money away from a customer’s account: it will be liable if it does so knowing that the instruction is dishonestly given by, for example, fraudulent directors of the borrowing company, shutting its eyes to the obvious fact of dishonesty, or acting recklessly in failing to make such inquiries as an honest and reasonable bank would make. Factors such as the standing of the customer, the bank’s knowledge of the signatory, the amount involved, the need for prompt transfer, the presence of unusual features, and the scope and means for making reasonable inquiries may be relevant”.
36. To that extent, I find no other conclusion other than that the respondent was negligent to expose its user system to persons within its employment who used their inside knowledge to access details of the appellant’s account and deal with it as happened in this case leading to the withdrawal of funds. The respondent would still be negligent if its system was susceptible to fraudsters who managed to carry out the transactions for the withdrawal of funds.
37. In arriving at this conclusion, I am persuaded to follow the decision in the case of Karak Brothers Company Ltd –vs- Burden [1972] AII ER 1210, as cited in the case of Ombonya v Housing Finance Ltd & 3 others [2024] KEHC 869 (KLR) where it was held that:
“… a bank has a duty under its contract with its customer to exercise ‘reasonable care and skill’ in carrying out its part with regard to operations within its contract with its customer. The standard of that reasonable care and skill is an objective standard applicable to bankers. Whether or not it has been attained in any particular case has to be decided in the light of all the relevant facts, which can vary almost infinitely.”
38. On the part of the appellant, the forensic report says that the transactions could not have been successful without the authorizing OTPs sent from the bank via texts to the customer and which he shared with the fraudsters. I have found above that the report indicates that the authorizing OTPs were sent from the bank via SMS to the appellant. The appellant had to share then with the fraudster in order for the transaction to be completed. The forensic report on the fraud on his account, which he did not dispute the contents, indicated that he kept forwarding the OTPs to the fraudulent caller thereby enabling the caller to withdraw the money. Indeed, he conceded that after sometime, he realized that it must be a fraud. Although he stated in his statement that he only spoke to the caller once, it is apparent from the forensic report that it could not have been through the one time call that he alleged he received from the bank. I find, as per the report that the calls were several and his realization came afterwards. To that extent, the appellant could not escape liability. The appellant’s act of sharing the OTPs therefore enabled the transactions to be completed. However, his negligence was to a lesser extent, this court having found above that the transactions were initiated and carried out on the respondent’s banking system, to the point of sending out the OTPs, including the use of the initial number that called the appellant and duped him into believing that what he was about to do was sanctioned by the bank.
39. The duty of care owed by each to the other is similar and in the circumstances, I find that both were equally liable in negligence for enabling the fraudster transact on the appellant’s account.
40. Among the findings of the learned Adjudicator were that it was the duty of the Claimant (the appellant herein) to safeguard his account by ensuring his OTP was safe and in case of loss of funds to report the same to the bank immediately. This finding is not supported by the material on record which in fact showed that the appellant reported his case to the bank. There was no indication from the respondent that there was a time limit within which he ought to have reported and he failed to do so.
41. Another finding of the learned Adjudicator in her concluding remarks was that, “The upshot of this matter is that the Claimant failed to prove its case on a balance of probabilities. It ought to have utilized the opportunity to proof that the OTP’s that approved the transactions were fraudulently shared which should have put this matter to rest.” I find that either this last statement was misplaced as not being meant to be part of the judgment or it was out rightly not in line with the earlier findings. Otherwise how would the Claimant prove that the OTPs were fraudulently shared with him when he was not the source thereof?
42. From the foregoing analysis, I find learned Adjudicator was in error in failing to appropriately determine the issue of the banker-customer relationship and the duty of care towards each other. She therefore failed to appropriately apply the law. I find that had she done so, she would have come to a different conclusion that the respondent was culpable to a larger extent for breach of its duty of care towards the appellant. In the circumstances I will apportion liability between the respondent and the appellant in the ratio of 90:10.
43. In the final analysis, I find that the respondent was largely to blame for the loss of the funds from the appellant’s account and is liable restore the appellant’s account with the extent of 90% of the amount that was fraudulently withdrawn therefrom. Interest is payable on that sum at court rates from the date of filing the claim before the SCC.
44. Consequently, the appeal succeeds to that extent. The decision of the learned Adjudicator is set aside and substituted with a finding that the claim before the SCC by the appellant succeeds to the extent explained herein.
45. The appellant shall get the costs of the appeal and before the SCC.
46. Orders accordingly.
47. Dated, signed and delivered, at Milimani on the Virtual Platform, Teams this 11th day of February 2026.
ANDAYI W. F.
JUDGE
In the presence of:
Keyonzo for the Appellant.
N/A for the Respondent.
Ummu: Court Assistant.
JUDGMENT
1. The appellant, Joram Emenwa Mutumbi is a customer of the respondent, KCB Bank Limited. The appellant operates a Bank Account No. 1209....21(other particulars withheld) held at the respondent’s Moi’s Bridge branch (the appellant though indicated erroneously that it is Moi Avenue branch). On 21st February 2024 an aggregate sum of KShs 242,464/= was withdrawn from the appellant’s said account. The details of the withdrawals are contained in the appellant’s statement of account and also in a forensic report prepared by the respondent and referred to herein afterwards. The amounts were withdrawn in three batches of KShs 100,046.50, KShs 42,557/= and 99,850/= in quick succession within 3 minutes between 16.04 Hrs and 16.07 Hrs.
2. It was the appellant’s case before the Small Claims Court (SCC) presented through his statement of claim dated 5th March 2024 and supported by his witness statement of the same date and bank statement dated 22nd February 2024, that, the money was withdrawn from his said account without his authority or consent. He claimed that the respondent was negligent and/or in breach of contract in the discharge of its duty of care towards him to have allowed the money to be withdrawn from his said account in such a manner. He therefore claimed from the respondent the said sum of money together with interest at court rates.
3. In his statement he stated that on 21st February 2024, he received a call from his mobile phone number 0722...153 from someone who told him that he was calling from Kenya Commercial Bank and who requested to know if he was a customer with the bank to which he answered in the affirmative. Nothing further happened. He had withdrawn KShs 15,000/= using his ATM that day. He became suspicious of the call he had received and on checking his bank account balance the following day he found that it had a credit of KShs 23,209.60 instead of KShs 265,733.35. The three withdrawals indicated above had been made.
4. According to the appellant, the statement seemed to indicate that the first withdrawals had been made through ATM but he had not made any ATM withdrawals that day and in any case, his debit card withdrawal limit was KShs 40,000/=. He therefore could not understand how each of the three transactions exceeding the KShs 40,000/= was made.
5. It was therefore the appellant’s case that the respondent was negligent and in breach of its duty of care to him as its customer as well as breach of contractual relationship with him.
6. The respondent through its response dated 25th March 2024, denied the claim in toto, even that the appellant held an account with it as alleged in the statement of claim. In the alternative, however, it contended that the transactions on the appellant’s account were done with the knowledge and/or authority of the appellant being the custodian of the ATM card. Further, that the transactions were not within the respondent’s knowledge and the same were caused by the appellant’s own negligence and want of care in so far as the security of his ATM card was concerned. It outlined the alleged particulars of the appellant’s negligence.
7. However, in its only material supporting its defence before the SCC, which was a forensic report dated 25th April 2024 and titled “Report on Disputed Card Load Wallet Transactions Aggregating KES 242,464 from AC 1209...21 Held at KCB Moi’s Bridge Branch by Joram Emenwa Mutumbi – Report No. 201 of 2024” in respect of the appellant’s said account, it indicated that the questioned transactions were processed to the debit of the said account on the 21st of February 2024 and were narrated as ATM withdrawals and Vooma transactions in his account statement. The report states further that in the entire period of his relationship with the bank, the customer has undertaken the bulk of his transactions from KCB Mtaani Agents. Further that the three transactions were three card load wallet transactions done on the 21st of February 2024 between 16:04 Hrs and 16:07 Hrs. The report goes on to state that two of the transactions for KShs 100,056.50 and KShs 42,557.50 were transfers to NCBA Loop Wallet while the transactions for KShs 99,850/= was a transfer to Vooma wallet Account No. 254100500135 i.n.o. Felix Opiyo Odede. Further that in all the instances in which the transactions occurred, One Time Passwords (OTP) to complete the transactions were sent to the customer’s Safaricom line number +254722...058. The report further indicates that shortly after the three transactions, the appellant’s card was restricted at the KCB Card Transaction Monitoring Unit at 16.08 Hrs after the system flagged the suspicious transactions. The report indicates that there were three further fraudulent attempts to access the appellant’s account between 16.07 and 16.09 Hours of the same day.
8. The report indicates further that the investigating team engaged with the appellant whereat he confirmed that prior to the transactions on 21st February 2024, at around 3.30 p.m., he received a call from phone number 0760000027 from someone who claimed to be working at KCB Moi Avenue branch and who informed him that the bank was in the process of changing the debit cards and that he should arrange to collect his new card from the branch. The appellant confirmed to the investigators that he shared certain codes or One Time Passowrds (OTPs) sent to his phone from the bank with the caller which calls were used by the caller to complete the fraudulent transactions.
9. The case proceeded by way of the pleadings and witness statements filed by the parties under section 30 of the Small Claims Court Act (Cap. 10A) Laws of Kenya. Section 30 of the SCCA provides that:
S. 30. Subject to agreement of all parties to the proceedings, the Court may determine any claim and give such orders as it considers fit and just on the basis of documents and written submissions, statements or other submissions presented to the Court.
10. Upon considering the material placed before it the court, the learned Adjudicator found that the appellant had failed to prove his case on a balance of probability because he had not offered any credible evidence to prove the claim and therefore dismissed it.
11. Arising out of that decision, the appellant filed the present appeal through a memorandum dated 29th July 2024 which contains based on three grounds as follows:
a. The learned Adjudicator/Magistrate was wrong and erred in holding that appellant contributed to the loss of funds from his account and further erred in failing to find that it was the inactions and omissions on the respondent’s part in not securing its system which enebled fraudsters to defraud the appellant.
b. The learned Adjudicator/Magistrate was wrong in failing to find that the respondent’s employees and agents with access to the respondent’s security infrastructure and records who had been placed in those positions by the respondent who committed theft of funds from the appellant’s account with the respondent and for which the respondent was vicariously liable.
c. The learned Adjudicator/Magistrate erred in holding that the appellant had shared passwords with persons who transferred money from the appellant’s account when there was no evidence to support such a finding.
12. The appellant therefore prays to this court that the appeal be allowed and the judgment of the SCC be set aside and in lieu thereof be substituted with an order allowing the claim with costs to the appellant.
13. An appeal to this court from the SCC is on points of law only as provided for under section 38 of the SCC Act. Therefore, this court is not permitted to interfere with the findings of fact by the trial court unless the decision is bad in law and cannot be supported by the evidence tendered. On that issue the Court of Appeal in M’Riungu v. Republic [1983] KLR 455, held thus:
“where a right of appeal is confined to question of law, an appellate court has loyalty to accept the findings of fact of the lower court(s) and resist the temptation to treat findings of fact as holdings of fact and law and it should not interfere with the decision of the trial court or the first appellate court unless it is apparent that on evidence, no reasonable tribunal could have reached that conclusion, which would be the same as holding that the decision is bad in law”.
14. The appellate court may however interfere with the findings of the trial court where it is demonstrated that there was no evidence at all upon which such findings were based or that the evidence relied upon was of such a nature that no reasonable tribunal, properly addressing its mind on it, could have made such findings (see for instance Bashir Haji Abdullahi v Adan Mohammed Nooru & 3 others [2014] eKLR).
15. The appeal was canvassed by way of written submissions filed by learned counsels for both parties.
16. I have considered the grounds of appeal raised in the memorandum of appeal, the record of appeal and the submissions by learned counsels for the parties.
17. An important feature to bear in mind while considering the appeal is that the SCC Act exempts the court’s proceedings from the rigid application of the standards of evidence applicable in other court proceedings and permits the court to include as evidence any material that it deems credible or trustworthy (emphasis by underlining supplied). It follows from this provision that it is largely upon the Adjudicator to determine the material to rely upon. Section 32 of the Act provides that the strict evidentiary rules applicable in other courts are not wholly applied in the Small Claims Court. It further, provides that the Court may admit as evidence any oral or written testimony, record, or other material even though the same is not admissible as evidence in any other Court under the law of evidence (emphasis supplied). This means the Adjudicator has the discretion to admit any evidence which may be helpful in establishing whether or not the claim is proved.
18. Moreover, the procedure applicable before the SCC is unlike the procedure before the magistrates’ courts. Section 3 of the SCC Act on the guiding principles of the court provides inter alia that the court shall be guided by the principles of judicial authority prescribed under Article 159(2) of the Constitution and without prejudice to the same, the Court shall adopt such procedures as the Court deems appropriate to ensure fairness of process and simplicity of procedure (emphasis supplied). The fairness of process is further reinforced under Part IV which is the substantive part that deals with procedure. Section 17 of the Act which falls under Part IV, it provides that:
S. 17. Subject to this Act and Rules, the Court shall have control of its own procedure in the determination of claims before it and, in the exercise of that control, the Court shall have regard to the principles of natural justice.
19. Therefore, the principles of natural justice rather than the technical procedural rules under the CPR take centre stage in a SCC hearing. In Justice Amraphael Mbogholi Msagha v. Chief Justice of the Republic of Kenya & 7 Others Nairobi HCMCA No. 1062 of 2004; [2006] 2 KLR 553; [2006] eKLR, the Court, in discussing the rules of natural justice, cited De Smith and Brazier, Constitutional and Administrative Law 6th Edition (Penguin United Kingdom: 1989) (pages 557-558) which states:
“The content of natural justice is therefore flexible and variable. All that is fundamentally demanded of the decision maker is that his decision in its own context be made with due regard for the affected parties’ interests and accordingly be reached without bias and after giving the party or parties a chance to put his or their case....”
20. In the contractual relationship of a banker and customer there exists a duty of care between them. Each owes a duty of care to the other.
21. The issue for determination then is the scope of the respondent’s duty towards the appellant and whether the same was discharged and therefore whether the learned Adjudicator erred in law in holding that the respondent had not breached its duty of care towards the appellant.
22. According to the appellant, the threshold was not met and so the respondent was in breach of that duty of care towards the appellant.
23. The respondent submits on that issue that the learned Adjudicator did not err by holding that the PIN usage did not automatically imply authorization by the account holder, the respondent herein, as contended by the appellant.
24. In the banker and customer relationship the banker has a large portion of control as regards the transactions in the customer’s. For instance, the bank has to sanction the release of money from the account to the customer’s or any athorised third party. For the customer, he has the safeguard of his mobile phone which is presumed to be in his possession whenever a transaction is being initiated and carried out. In addition, the respondent has stated in its report submitted in evidence that it sends receives a One Time Password (OTP) to the customer to authorize the transaction to proceed. Therefore, only the customer authorizes any transaction by insertion of the OTP sent to his phone by the bank.
25. The appellant’s case herein is that he did not initiate any transaction on his ATM card for the withdrawal of the amounts the subject of the claim. Indeed, there is no indication in the forensic report relied upon by the respondent that the appellant through his phone number or at the ATM initiated the transactions that caused the withdrawal of the funds from his account. The question is, from which point were the transactions initiated and secondly, from where were the OTPs that were sent to the appellant sourced? The respondent did not answer these questions through its said report. Under section 112 of the Evidence Act, only the respondent had the special knowledge of where the transactions were initiated and the OTPs sourced. It therefore had the obligation to adduce evidence on those issues which it failed to. Therefore, the answers can only be that they were initiated by somebody who had access to the respondent’s banking system and to the appellant’s account. The respondent’s only case against the appellant is that he shared his OTPs with the caller.
26. The question that emerges is, who had access to the appellant’s account details with the bank to know that he had money in his account that could be withdrawn? It was held in the case of Barclays Bank of Kenya Limited v Diana Sambo Mwasela [2020] KEHC 7569 (KLR) that:
“The Appellant seems to suggest that the Respondent is liable for the lost suit amount since the withdrawals were enabled by the Personal Identification Number that was only privy to the Plaintiff. I have a difficulty with the Appellant. This is because the Appellant only alleged that the Respondent caused the money to be withdrawn since her pin was used in the process of withdrawing such monies. There are other persons other than the Respondent which may have access to the Appellant’s details and this includes the bank employees, directors among others. Secondly, the bank ought to have other mechanisms to trace the exact person who withdrew the said monies without the Appellant’s authorization such as CCTV. If such mechanisms are not in existence, then many customers are at risk of losing their money through unauthorised transactions.”
27. I am persuaded to follow this decision that there are persons within the respondent’s establishment who may have access to the respondent’s database of its customers such as employees, directors among others and therefore have details of the customers and these can be fraudulently applied to cause transactions on unsuspecting customers’ accounts such as the case herein. In that case the banker is in breach of its duty of care and must be held to account for any loss arising.
28. The respondent did not disclaim that phone number 0760000027 from which the appellant received the calls alleging to be from the respondent’s Moi Avenue branch actually came from the bank. In that case, the appellant could not be faulted for responding to the call. That is what an ordinary prudent person, placed in the appellant’s position would have done. In its contention that the appellant was negligent in receiving the call from the alleged stranger and then sharing the OTPs, the respondent did not demonstrate that what the appellant did was conduct that fell below what an ordinary prudent person, that is, a reasonable person, would be expected to do under those circumstances.
29. From the forensic report, it emerged that the bank sends the OTP to the customer in order to complete a transaction. The forensic report shows that those OTPs were used to complete the transactions, that is, to access the appellant’s account for the withdrawals of the funds. It is common knowledge that the OTP is a security code generated by the bank and tied to the specific account operated by a customer and then tied to the customer’s mobile phone line. This ensures that the specific customer account cannot be accessed without authorization from his phone line.
30. The bank has not denied that the OTPs actually came from its system or a source linked to its system. The operations of these interconnected systems could only be in the special knowledge of the appellant and therefore the none other than a person who had access to the bank’s system sent generated and sent the OTPs to the appellant.
31. Finally, the forensic report showed that the appellant’s phone line was not illegally swapped. The forensic report further showed that having received the OTP on his phone line, the appellant did not enter it on his phone line but had to share it with the third party in order to complete the transaction. The question that was not answered by the bank as the operator of the banking system is how did the third party manage to feed the respondent’s system and therefore to access the appellant’s account with the OTP when the same had not come from the appellant’s phone number yet, as found above, the account, the phone line and the OTP are tied together?
32. The only logical conclusion from the foregoing evaluation of the material placed before the SCC is that the transactions were done with someone who had access to the appellant’s account with the respondent and therefore to the respondent’s system and he could generate the OTPs and send to the appellant’s phone line and then upon receiving them back from the appellant, to feed them into the system.
33. Even if the appellant simply entered the OTP on his phone without sharing it (which the forensic report has not stated to be the case) the respondent would still be liable for causing the OTPs to be generated fraudulently and sent to the appellant’s phone.
34. Further, the respondent states that after the first three transactions, it detected the unusual activity on the appellant’s account and then caused it to be restricted so that further transactions were thwarted and not carried out. However, this was rather late in the day as a substantial sum of money had been siphoned out of the appellant’s account. The respondent said in its forensic report that it was aware that the bulk of the appellant’s transactions were undertaken from KCB Mtaani Agents. In the present case, two of the transactions were to NCBA Loop Wallets while the third was a transfer to Vooma wallet account of a third party by the name of Felix Opiyo Odede A/C No. 254100500135. I find that armed with the information that the appellant ordinarily conducted his transactions through KCB Mtaani Agents and not through the wallets as indicated in the report, the respondent was negligent in not flagging out the first transaction before issuing the OTP since it was an unusual transaction on the appellant’s account. The respondent had the capability, as it did afterwards to restrict the account immediately it detected the suspicious transaction and then call the appellant to confirm whether he was indeed carrying out those unusual transactions. The failure to do so was negligent on the respondent’s part.
35. I am guided to this conclusion from the decision in the case of Simba Commodities Limited v Citibank N. A. [2013] KEHC 5859 (KLR) where the High Court made reference to the writings of the learned authors in Ross Cranston’s Principles of Banking Law 2nd Edition at P. 187 where it is state that:
“There is long-established authority, in the context of bills of exchange, that a bank can be in breach of its duty of reasonable care and skill in failing to make inquiries. Certain transactions are so out of the ordinary course that they ought to arouse doubts and put the bank on inquiry. If the bank fails to inquire, it cannot be said to have acted without negligence in converting a bill. The Quincecare case applies the principle in another context – the care and skill the bank should exercise in paying money away from a customer’s account: it will be liable if it does so knowing that the instruction is dishonestly given by, for example, fraudulent directors of the borrowing company, shutting its eyes to the obvious fact of dishonesty, or acting recklessly in failing to make such inquiries as an honest and reasonable bank would make. Factors such as the standing of the customer, the bank’s knowledge of the signatory, the amount involved, the need for prompt transfer, the presence of unusual features, and the scope and means for making reasonable inquiries may be relevant”.
36. To that extent, I find no other conclusion other than that the respondent was negligent to expose its user system to persons within its employment who used their inside knowledge to access details of the appellant’s account and deal with it as happened in this case leading to the withdrawal of funds. The respondent would still be negligent if its system was susceptible to fraudsters who managed to carry out the transactions for the withdrawal of funds.
37. In arriving at this conclusion, I am persuaded to follow the decision in the case of Karak Brothers Company Ltd –vs- Burden [1972] AII ER 1210, as cited in the case of Ombonya v Housing Finance Ltd & 3 others [2024] KEHC 869 (KLR) where it was held that:
“… a bank has a duty under its contract with its customer to exercise ‘reasonable care and skill’ in carrying out its part with regard to operations within its contract with its customer. The standard of that reasonable care and skill is an objective standard applicable to bankers. Whether or not it has been attained in any particular case has to be decided in the light of all the relevant facts, which can vary almost infinitely.”
38. On the part of the appellant, the forensic report says that the transactions could not have been successful without the authorizing OTPs sent from the bank via texts to the customer and which he shared with the fraudsters. I have found above that the report indicates that the authorizing OTPs were sent from the bank via SMS to the appellant. The appellant had to share then with the fraudster in order for the transaction to be completed. The forensic report on the fraud on his account, which he did not dispute the contents, indicated that he kept forwarding the OTPs to the fraudulent caller thereby enabling the caller to withdraw the money. Indeed, he conceded that after sometime, he realized that it must be a fraud. Although he stated in his statement that he only spoke to the caller once, it is apparent from the forensic report that it could not have been through the one time call that he alleged he received from the bank. I find, as per the report that the calls were several and his realization came afterwards. To that extent, the appellant could not escape liability. The appellant’s act of sharing the OTPs therefore enabled the transactions to be completed. However, his negligence was to a lesser extent, this court having found above that the transactions were initiated and carried out on the respondent’s banking system, to the point of sending out the OTPs, including the use of the initial number that called the appellant and duped him into believing that what he was about to do was sanctioned by the bank.
39. The duty of care owed by each to the other is similar and in the circumstances, I find that both were equally liable in negligence for enabling the fraudster transact on the appellant’s account.
40. Among the findings of the learned Adjudicator were that it was the duty of the Claimant (the appellant herein) to safeguard his account by ensuring his OTP was safe and in case of loss of funds to report the same to the bank immediately. This finding is not supported by the material on record which in fact showed that the appellant reported his case to the bank. There was no indication from the respondent that there was a time limit within which he ought to have reported and he failed to do so.
41. Another finding of the learned Adjudicator in her concluding remarks was that, “The upshot of this matter is that the Claimant failed to prove its case on a balance of probabilities. It ought to have utilized the opportunity to proof that the OTP’s that approved the transactions were fraudulently shared which should have put this matter to rest.” I find that either this last statement was misplaced as not being meant to be part of the judgment or it was out rightly not in line with the earlier findings. Otherwise how would the Claimant prove that the OTPs were fraudulently shared with him when he was not the source thereof?
42. From the foregoing analysis, I find learned Adjudicator was in error in failing to appropriately determine the issue of the banker-customer relationship and the duty of care towards each other. She therefore failed to appropriately apply the law. I find that had she done so, she would have come to a different conclusion that the respondent was culpable to a larger extent for breach of its duty of care towards the appellant. In the circumstances I will apportion liability between the respondent and the appellant in the ratio of 90:10.
43. In the final analysis, I find that the respondent was largely to blame for the loss of the funds from the appellant’s account and is liable restore the appellant’s account with the extent of 90% of the amount that was fraudulently withdrawn therefrom. Interest is payable on that sum at court rates from the date of filing the claim before the SCC.
44. Consequently, the appeal succeeds to that extent. The decision of the learned Adjudicator is set aside and substituted with a finding that the claim before the SCC by the appellant succeeds to the extent explained herein.
45. The appellant shall get the costs of the appeal and before the SCC.
46. Orders accordingly.
47. Dated, signed and delivered, at Milimani on the Virtual Platform, Teams this 11th day of February 2026.
ANDAYI W. F.
JUDGE
In the presence of:
Keyonzo for the Appellant.
N/A for the Respondent.
Ummu: Court Assistant.