Why Family Bank Lost Its Appeal on Kshs 720,000 Mobile Banking Fraud Case

High Court upheld Small Claims Court finding that bank's duty to protect a customer's account does not end when the fraud begins — it begins when the bank is told

The High Court at Milimani has dismissed an appeal by Family Bank Limited against a Small Claims Court judgment that found the bank liable for failing to act after a customer reported that her account was being drained by fraudsters, in a ruling that sharpens the legal test for how far a bank's duty of care extends once it has been put on notice of theft.

In a judgment delivered on 2nd July 2026 by Justice Bernard Wafula Murunga in Civil Appeal No. HCCOMMA/E078 of 2026, the court upheld a September 2023 decision of the Small Claims Court ordering Family Bank to pay Lucy Wamaitha Kiarie Kshs 350,000, with interest and costs, over unauthorised withdrawals from her account.

The fraud: Kiarie had held an account with Family Bank for over two decades. Between 7th and 10th February 2022, a series of withdrawals she says she neither made nor authorised drained a total of Kshs 720,000 from her account.

She reported the loss to the bank and, through the Banking Fraud Investigation Unit, to the police.

Of the amount lost, Kshs 40,000 was later recovered by police, and Family Bank reimbursed a further Kshs 150,000 in April 2023 — but only after Kiarie had already filed her claim in court.

She pursued the remaining balance before the Small Claims Court, which found in her favour and awarded her Kshs 350,000 plus interest and costs.

Family Bank appealed on eight grounds, and deposited Kshs 280,000 in court as security for the decretal sum pending the outcome.

The bank's defence: Family Bank, represented by G.M. Gamma Advocates LLP, argued that every disputed transaction had been carried out using Kiarie's own Personal Identification Number, entered through its mobile banking platform, and that the bank had no way of distinguishing a fraudulent instruction from a genuine one once the correct PIN was used.

It argued Kiarie, who was obliged to keep her PIN confidential, bore responsibility for the loss.

The bank also argued that the trial court had wrongly shifted the burden of proof onto it, and that compensating an account holder simply because the correct PIN was used — without examining how fraudsters came to possess it — would expose banks to a risk of customers colluding to withdraw funds and later claim fraud.

A narrow gate: The High Court began by narrowing the field of what it could even consider. Appeals from the Small Claims Court, it noted, lie only on matters of law under Section 38 of the Small Claims Court Act, and that court's decision on questions of fact is final.

Citing earlier authority, the court described the Small Claims Court as “the queen when it comes to evidence,” and held that a litigant cannot convert a factual disagreement into a legal one merely by invoking the Evidence Act.

On that basis, six of Family Bank's eight grounds of appeal were thrown out at the threshold — they amounted, the court found, to an invitation to reweigh the evidence and reach a different factual conclusion, which is not the High Court's role on a first appeal from that forum.

Only the bank's argument that the trial court had misapplied the burden of proof survived as a genuine question of law, since whether a court applied the correct legal standard is distinct from whether the evidence in fact met it.

Why the bank still lost: Even on that surviving ground, the court found no error.

The trial court had correctly identified and applied the balance-of-probabilities standard, citing the relevant provisions of the Evidence Act and settled case law on how the evidential burden shifts during trial.

The High Court also found the trial court's factual conclusion was not perverse. The fraudulent transactions were initiated through a mobile application Kiarie testified she had never used, breaking from her established pattern of transacting only by USSD.

The stolen funds moved to third parties unconnected to her. She reported the fraud promptly and repeatedly. And Family Bank, despite having traced the movement of the funds internally, did not produce its own investigation report — allowing the court to draw an adverse inference that the report would not have helped the bank's case.

Crucially, the judgment turned not on how Kiarie's PIN was compromised, but on what Family Bank did after she reported it.

The trial court had expressly declined to find the bank liable for the initial breach, acknowledging it could not determine whether her password was compromised before she reported the fraud. Liability was instead pinned to the period after the bank was notified — when, by its own admitted practice, an account should have been frozen and was not.

The High Court noted that this was effectively the bank's own admission: in submissions before the trial court, Family Bank had conceded that its practice required freezing an account once a fraud complaint is lodged, that this was not done in Kiarie's case, and that this was the very reason it later refunded Kshs 150,000 of the stolen funds.

“A bank is the keeper of the gate through which its customer's money passes,” the court held. “Where it is warned that the gate stands open and does not close it, it cannot afterwards be heard to say that the thief carried the right key.”

The order: The High Court dismissed the appeal in full, upheld the Small Claims Court's judgment and decree, ordered the Kshs 280,000 Family Bank had deposited as security to be released to Kiarie's advocates in partial satisfaction of the decree, and directed the bank to bear the costs of the appeal.

Kiarie was represented by Tim Njenga & Co. Advocates.