On the morning of February 8, 2022, Mercy Wairimu Kariuki checked her phone to find her Diamond Trust Bank account had been emptied overnight — KES 4.4 million ($34,000) gone through a series of transfers she never authorised. What made it worse: she had already reported the SIM swap that made it all possible, two days earlier.
Four years later, Kenya's High Court has delivered a landmark ruling that sets a new legal benchmark for how banks and telecom operators must protect customers from SIM swap fraud.
The Ruling
On June 18, Justice Asenath Ongeri of Kenya's High Court upheld a lower court's decision to split liability between Diamond Trust Bank (DTB) Kenya — listed on the Nairobi Securities Exchange — and Safaricom, the telecommunications giant behind M-PESA. DTB was ordered to pay Kariuki KES 1,788,601 ($13,800), while Safaricom was ordered to pay KES 2,630,000 ($20,300).
The 40:60 split was not arbitrary. The court found that while Safaricom's failure to stop the SIM swap enabled the fraud in the first place, DTB had independently breached its own duty of care by allowing suspicious transactions to pass through unchecked.
How the Fraud Unfolded
Fraudsters swapped Kariuki's SIM on February 6, 2022. She noticed something was wrong almost immediately, reporting the incident to Safaricom customer care the same day. Her line was restored the following day at a Safaricom shop, and she believed the matter was resolved.
It was not. By the early hours of February 8, her DTB account had already been drained through a combination of mobile banking transfers and Pesalink withdrawals. The transactions were deliberately timed to exploit a weekend reset in the bank's daily limits, keeping individual transfers just below the KES 2 million threshold.
It is a pattern that fraud investigators in Kenya's mobile money ecosystem have seen before — and one that Justice Ongeri found both institutions were equipped to detect and prevent.
The Banks' Defence — and Why It Failed
DTB's legal argument rested on two pillars: first, that every disputed transaction had been authenticated with Kariuki's correct PIN, meaning its systems had functioned exactly as designed. Second, the bank argued the SIM swap itself constituted a novus actus interveniens — a legal term for an intervening act that severs the chain of liability — effectively placing all blame on Safaricom.
Justice Ongeri rejected both arguments in pointed terms.
"A bank cannot hide behind a customer's PIN when it is presented with a series of transactions that are so glaringly out of the ordinary that a reasonable banker would have been put on inquiry," Justice Ongeri wrote, pointing to the rapid succession of transfers to unrelated accounts and phone numbers as red flags the bank ought to have caught.
The ruling drew a clear line: successful PIN entry does not discharge a bank's broader obligation to monitor for suspicious activity. A string of rapid, high-value transfers to unfamiliar recipients — especially over a weekend — should have triggered additional scrutiny. It did not.
What This Means for Banks and Telcos
The significance of this ruling extends well beyond Kariuki's case. For the first time, a Kenyan High Court has formally confirmed that banks and telecom operators each carry an independent duty of care to customers in SIM swap fraud scenarios — even when the fraud originates entirely outside one party's systems.
That framing matters. It means neither institution can point at the other and walk away. Safaricom cannot argue that the bank should have caught the transactions; DTB cannot argue that a rogue SIM swap is someone else's problem. Both owe the customer a reasonable standard of protection, and both failed to meet it here.
As online safety threats targeting mobile banking users continue to grow across Africa, this ruling is likely to draw close attention from financial institutions and regulators well beyond Kenya's borders. The mobile money sector has long operated in a space where fraud liability was contested and ambiguous — that ambiguity just got a lot smaller.