‘Too Late’: Family Bank Loses Court Battle Over KSh720,000 Stolen From Customer’s Account

For more than two decades, Lucy Wamaitha Kiarie trusted Family Bank with her savings. Then, within four days, KSh720,000 disappeared from her account.

On July 2, 2026, the High Court ruled that the bank must take responsibility, not due to its role in the initial fraud, but because it failed to respond adequately after being notified that the theft was occurring.

In a judgement that could reshape how Kenyan banks respond to customer fraud complaints, Justice Benard Wafula Murunga dismissed Family Bank’s appeal and upheld an earlier Small Claims Court decision awarding Kiarie KSh350,000, interest, and costs.

The court also ordered that KSh280,000, deposited as security during the appeal, be released to the customer in partial settlement of the decree.

At the heart of the dispute was a simple but increasingly common question in Kenya’s digital banking era: when fraudsters access a customer’s account using the correct PIN, where does the bank’s responsibility begin and end?

Family Bank insisted it should not bear liability. Its lawyers argued that every disputed transaction had been authenticated using Kiarie’s correct Personal Identification Number, making it technically impossible for the bank to distinguish genuine instructions from fraudulent ones.

Unauthorised Withdrawals

The bank further argued that customers are solely responsible for safeguarding their confidential PINs and warned that compensating account holders under such circumstances could expose banks to fraudulent claims.

The facts, however, painted a more nuanced picture.

Between February 7 and February 10, 2022, Kiarie’s account was emptied through a series of unauthorised withdrawals totalling KSh720,000.

She immediately reported the transactions to Family Bank and later to the Banking Fraud Investigation Unit.

Police eventually recovered KSh40,000, while Family Bank refunded another KSh150,000 more than a year later, after she had already filed suit.

She then pursued the remaining balance before the Small Claims Court, which ruled in her favour.

Eight Grounds

Family Bank challenged that decision on eight grounds. Yet the High Court found that most of those complaints never truly belonged before it.

Justice Murunga observed that appeals from the Small Claims Court are deliberately narrow. Parliament limited such appeals to questions of law, not fresh disputes over factual findings.

The judge said six of the bank’s eight grounds merely invited the High Court to reweigh evidence, an exercise expressly prohibited under the Small Claims Court Act.

“The gateway is therefore not merely narrow; once passed, it is the end of the road,” the judge observed while explaining the restrictive nature of appeals from the Small Claims Court.

Only one issue survived judicial scrutiny: whether the Small Claims Court had applied the wrong burden of proof.

The High Court answered that question firmly in the negative.

Justice Murunga found that the trial court had correctly relied on Sections 107 and 109 of the Evidence Act before concluding that Kiarie had proved her claim on a balance of probabilities.

Disagreeing with that conclusion, he said, did not transform a factual dispute into a legal one.

Yet the judgement reached beyond procedural technicalities. It offered a pointed reminder of the obligations banks owe their customers once fraud is reported.

“The relationship between banker and customer is contractual,” Justice Murunga wrote, adding that banks have “a duty… to exercise reasonable care and skill” in managing customers’ accounts.

More importantly, he stressed that this obligation is continuous and intensifies once a bank learns an account may have been compromised.

That distinction ultimately proved decisive.

The court expressly acknowledged that it could not determine how Kiarie’s PIN had originally been compromised.

Instead, liability arose because Family Bank failed to freeze the account after receiving notice that fraudulent transactions were taking place.

In one of the judgement’s most striking findings, Justice Murunga noted that the bank itself had admitted during the trial that its internal practice required freezing an account immediately after receiving a fraud complaint.

It also acknowledged that this was not done in Kiarie’s case, prompting the later refund of KSh150,000.

The judge held that the Small Claims Court merely enforced the standard Family Bank had set for itself.

Internal Findings Report

Equally damaging was the bank’s failure to produce its own investigation report.

Although Family Bank had traced the movement of the stolen money, it chose not to present its internal findings during the trial.

Since that report was exclusively within the bank’s possession, the court drew an adverse inference that its contents would not have supported the bank’s defence.

The judge also accepted evidence showing that Kiarie had always conducted her banking through the bank’s USSD platform, while the disputed transactions originated from an

Android application she said she had never used.

The stolen funds were transferred to third parties unconnected to her, strengthening the court’s conclusion that the withdrawals were unauthorised.

Justice Murunga distilled the case into a memorable analogy that is likely to resonate well beyond the courtroom.

“A bank is the keeper of the gate through which its customer’s money passes; where it is warned that the gate stands open and does not close it, it cannot afterwards be heard to say that the thief carried the right key.”

The ruling arrives as digital banking fraud continues to test the boundaries between customer responsibility and institutional accountability.

While the judgement stops short of making banks automatic insurers against every cybercrime, it sends a clear signal that prompt action after fraud reports is not merely good customer service.

It is a legal duty.

READ ALSO: Three Kenyans Lose Six Vehicles in Major Asset Recovery Case Over Drug Money Trail

For Kenya’s financial sector, that may become the judgement’s most enduring legacy.

A correct PIN alone, the High Court has now made clear, is no defence when a bank knows the gate is open and chooses not to close it.

PAY ATTENTION: Reach us at info@gotta.news.