Similar Digital Banking Fraud, Different Results: Lessons from Equity Bank Uganda Ltd v Irene Birungi HCCA No.0032/2024 [2026] and Nakku Joweria v Stanbic Bank (U) Limited HCCS No. 197/ 2024 [2026]
Equity Bank Uganda Limited vs Irene Birungi HCCA No.0032/2024 [2026] UGCommC 333 and Nakku Joweria vs Stanbic Bank (U) Limited HCCS No. 197 (2024) [2026] UGCommC 368
Related practiceSimilar Digital Banking Fraud, Different Results: Lessons from Equity Bank Uganda Ltd v Irene Birungi HCCA No.0032/2024 [2026] and Nakku Joweria v Stanbic Bank (U) Limited HCCS No. 197/ 2024 [2026]
The High Court of Uganda (Commercial Division) delivered two closely related but divergent judgments on a similar broad issue. The decisions in Equity Bank Uganda Limited v Irene Birungi and in Nakku Joweria v Stanbic Bank (U) Limited, each related to unauthorized electronic funds transfers from a customer’s account, but the outcomes were different; in Uganda Shillings UGX 25 million, plus UGX 5 million in general damages, interest and costs were awarded against the bank in one case, while a UGX 68 million claim was dismissed with costs in the other.
At first glance, the two decisions seem contradictory, but they are not. The customers in both cases denied authorizing the digital transactions, and the banks responded by arguing that the responsibility for protecting devices and sensitive information such as passwords and PINS is on the customers. Both courts identified the same general framework: the bank owes a duty of reasonable care to the customer, but the customer also has reciprocal obligations. However, the differences in the evidence led to the different conclusion. Taken together, the two cases illustrate that a bank’s position is not automatically strengthened by a customer’s dispute with a digital transaction or the mere fact that a bank’s system recognized it as authorized. The cases highlight that the allocation of loss depends on whether the bank can prove an absence of customer negligence or a properly authorised digital banking process.
In Equity Bank v Birungi, for instance, the bank was unable to prove informed customer consent or customer negligence.
Brief facts.
Irene Birungi opened an account at Equity Bank’s Katwe branch and deposited a total of UGX 27 million in cash. After withdrawing UGX 2 million, she returned to the bank and was told that only UGX 27,100 was available in her account. The bank attributed the unauthorized UGX 25 million withdrawal to its Eazzy digital banking platform, which, according to the bank, had been compromised by persons impersonating Airtel agents and tricking the respondent into providing her phone details, National Identification details and PIN.
Ms Birungi’s testified that she was illiterate and had opened the account at the Katwe branch and continued to do her transactions there. She denied using the Eazzy digital platform and giving fraudsters any information. The bank’s main argument was based on the respondent’s account statement noting an “EAZZY” entry against the opening transaction and one witness’s testimony about an alleged customer admission during an internal investigation.
Court on the banker–customer relationship, noted that the bank owes a duty to the customer as a debtor of the money deposited with it to exercise reasonable care and skill in managing the account. The customer had to establish that she opened the account, deposited the monies and that it was withdrawn without her consent.
Once these facts were proved, the onus shifted to the bank to prove either that the transactions in question were properly authorised and authenticated or that the loss was attributable to the customer’s proven gross negligence or unauthorised disclosure of operational instructions to the bank. It was not incumbent upon the customer to prove that the bank was negligent, but the bank should have provided the Court with sufficient evidence to find that the transactions at issue had been properly authorised and authenticated or that the customer had acted with gross negligence that caused the unauthorised transactions to occur.
“The law does not permit a bank to shift liability onto a customer on the basis of conjecture alone.” Paragraph 20, Equity Bank Uganda Limited v Irene Birungi.
Why the “EAZZY” notation was insufficient to prove informed consent or authorization.
The evidence did not establish that a) the customer was informed, approved, consented to or authorized opening of a digital account or enrolment in the Eazzy mobile money platform; b) she understood the associated risks; c) a PIN was issued to or controlled by her; d) that she initiated the withdrawal of UGX 25 million. These facts had to be proved by the bank as it created the system that enrolled customers in the Eazzy account, collected their money and allowed them to withdraw it. The Eazzy notation on the statement merely indicated that the transaction had been done via the mobile channel, but it did not establish any of the elements of informed consent or that the customer used the Eazzy digital wallet to conduct the unauthorized withdrawals.
Consumer protection and onboarding duties
The Court emphasized that the Bank of Uganda Financial Consumer Protection Guidelines, 2011, require banks to advise consumers of the key features and terms of the financial products or service they propose to acquire, including the risks and controls available and necessary for proper use of the products or service. This includes advising electronic money customers of the need to safeguard their PINs and other credentials and informing them of the dangers of disclosing such information to third parties. Since the customer neither signed a consent form nor a digital banking agreement and the bank could not prove that she had been informed about the Eazzy mobile wallet’s terms and conditions, it was for the bank to prove that she had accepted the service terms.
The bank’s witness testified that the bank does not install the Eazzy application but advises customers of how it works. This testimony did not establish what process had been followed to enrol this particular customer in the Eazzy platform. The Court stressed the importance of documenting informed onboarding, especially for illiterate and predominantly branch-based customers. It should not be presumed that these customers have received or understood the bank’s terms and conditions simply because they opened an account at a branch or used a mobile channel.
Failure to prove the alleged disclosure of credentials.
The bank argued that Ms Birungi had admitted to having given fraudsters her PIN, NIN and phone details. However, the bank did not produce the investigation file, the alleged admission or statement, or any Airtel official who could testify to the alleged disclosure.
In addition, the Court highlighted the bank’s failure to produce forensic evidence, such as the phone used to complete the transactions, OTPs sent and received, associated IP addresses or audit trail records for the SIM card and/or device used, or any other evidence that could prove that the respondent had disclosed her credentials.
Since the bank had control of the relevant record or was in the best position to investigate and prove the allegations, the evidence was insufficient to support the bank’s position.
The Lesson: Technical evidence of customer misconduct in a digital transaction may not always be available, but a bank must be able to demonstrate that such evidence was obtained.
The Aida Atiku Exception
The Court noted the difference between the instant case and Aida Atiku v Centenary Rural Development Bank Ltd CS No.0754/2020 and held that Ms Birungi had not enrolled for digital transactions and had not authorized the UGX 25 million withdrawal. The Court pointed out that in Aida Atiku, the bank proved that the customer had enrolled for the digital service herself using her phone and that the fraudulent transactions were also done through the phone from the same number. The bank further proved that the customer’s daughter had access to the phone and that the bank’s security analyst had explained the features, authentication, and SMS alerts to the customer, as well as the corresponding mobile money statements. The Court held that the customer was best placed to prevent the loss and accordingly placed responsibility on her for failing to secure her phone and account.
However, in the case of Ms Birungi, the bank failed to prove informed enrolment or that the customer had used the Eazzy mobile money wallet to conduct the unauthorized transactions. The same legal principle was applied to different facts to reach a different conclusion.
Remedies
The Court dismissed the bank’s appeal and confirmed the award of UGX 25 million to the customer. In addition, it ordered the payment of UGX 5 million general damages to the customer because she had been deprived of the use of her savings and had been inconvenienced. It also ordered the payment of interest on the outstanding amount at the rate of 8% per annum from the date of filing until the date of payment.
On the other hand, in Nakku Joweria v Stanbic Bank, the bank proved that the authentication environment had been compromised, and the customer failed to report the loss of control of her phone in a timely manner.
Brief facts
Nakku was a long-standing Stanbic customer with a savings account she opened in 2001. On 7 and 8th February 2023, a series of unauthorized transactions totalling UGX 68 million were concluded through the Flexipay digital wallet. The transactions used different Airtel numbers and followed several unsuccessful enrolment attempts.
The Plaintiff contended that her phones had been stolen on 6th February and that she had never enrolled for Flexipay. She further argued that the large withdrawals from her savings account, which mostly remained closed, should have raised the bank’s suspicions.
The bank, on the other hand, argued that Ms Nakku’s phone and NIN had been compromised and that the Flexipay authentication process had been completed successfully.
The transactions were notified to the respondent’s phone, and the bank was not alerted until almost a month later. The bank further argued that the respondent had failed to report the alleged theft of her phone to the police or the telecommunication network and provided an audio recording and transcript of a customer interview.
This was the key difference between Nakku Joweria vs Stanbic Bank and Equity Bank Uganda Limited v Irene Birungi. The Court accepted the audio recording and transcript as evidence after considering the foundation laid by the bank’s investigator. The investigator testified about the recording process and how the recording had been transferred to the Court for verification. Ms Nakku’s counsel objected to the recording on the grounds that the maker and transcriber did not testify and that the recording cut off unexpectedly.
The Court noted that the recording was received without objection and that the respondent had been cross-examined about its authenticity. It further remarked that she failed to substantiate her objection to the recording with any evidence at trial. The Court found that the foundation for receiving the recording as evidence was sufficient under Section 7(4) of the Electronic Transactions Act and evaluated the weight of the evidence accordingly.
The accepted recording contradicted the respondent's version of events, suggesting that she reported the police later than she claimed, that her original NIN card was kept behind the stolen phone and that the alleged abductor had been communicating with her for several days. Based on this, the Court inferred that Ms. Nakku's authentication credentials had been compromised via her phone.
The Customer’s Duty to Report
The Court agreed with the respondent that a customer is not expected to constantly monitor the account to discover unauthorized transactions. However, it further found that the customer failed to satisfy her duty of taking reasonable steps to alert the bank to the unauthorized transactions after suspecting that her phone and the authentication environment had been compromised. It noted the customer’s failure to notify the telecommunication network and the police of the alleged phone theft and to inform Stanbic about the suspected compromise.
The Court further cited the ruling in Equity Bank (U) Ltd v Bamwite Augustine Muhindo that notifying the police alone is not sufficient where the bank linked SIM or phone is stolen and directed Ms. Nakku to take these steps Nakku to take these steps to secure her account.
The consequence of Ms Nakku’s failure was that the bank was not notified about the irregular transactions. Consequently, the Court held that the bank had no duty to restrict the transactions once they began. It further noted that the customer’s failure to notify the bank about the irregularities in a timely manner was a breach of her reciprocal duty to the bank under the contract.
The Bank’s Evidence of Authentication Was Accepted
Unlike in Equity Bank Uganda Limited v Irene Birungi, Stanbic presented satisfactory evidence regarding Flexipay enrolment and the transactions in question. The Court found that the validation codes and authentication codes had been sent to the respondent’s phone. It further accepted that the initial failed transaction attempts had been followed by a successful Flexipay enrolment process and that the UGX 68 million transactions had been completed using the respondent’s authentication credentials.
The Court further accepted that Flexipay had the following safeguards: the customer’s NI or NIN, PIN, security questions, verification codes, and SMS notifications. It further found that there was no evidence that the required authentication procedures had been bypassed. It further noted that the fact that Ms. Nakku’s phone had been stolen and her authentication details compromised could explain the fraudulent Flexipay enrolment and transactions.
This was the key difference between Nakku Joweria v Stanbic Bank (U) Ltd and Equity Bank Uganda Limited v Irene Birungi. In the latter case, the bank relied on the “EAZZY” notation or an unproved customer admission during an internal investigation to establish that the customer had authorized the unauthorized transactions.
However, in the former instance, the Stanbic investigator provided satisfactory evidence of the compromised authentication environment, including the respondent’s phone, to the Court. This allowed the Court to infer that the fraudulent Flexipay enrollment and transactions had occurred.
Unusual Activity Was Not Automatically Suspicious
Ms Nakku argued that the sudden, unusual volume of transactions should have prompted the bank to freeze the account. She further argued that the use of different Airtel numbers and the numerous validation code attempts were also suspicious. However, the Court found that suspicious or unusual activity alone is not enough to shift the onus of proof to the bank.
The Court further cited Barclays Bank of Uganda Ltd v Eron Kabachwamba to hold that although a bank has a duty to take reasonable precautions and act diligently to protect a customer’s property, a mere suspicion, worry, concern, unease, abnormality or deviation from normal patterns of behaviour is not enough to establish a bank’s negligence.
The Court also found that Stanbic fulfilled its duty to obey a valid customer mandate since the transactions had bypassed the bank’s defences due to the customer’s failure to report the phone theft and suspicious activity in a timely manner. It further found that no breach of the bank’s duty to the customer had occurred.
Remedies
Although the Court found that Stanbic owed the customer a duty to exercise reasonable care, it further held that the duty was not breached since the customer’s credentials had been compromised. Since no breach of duty had occurred, the bank was not found to be liable to the customer for the unauthorized transactions. The court dismissed the customer's claim with costs.
Why the outcomes are not contradictory
The two cases are consistent with each other.
The two courts answered one question: whether the customer proved and an unauthorized withdrawal and the bank proved either a properly authorized process or the customer’s negligence. In other words, the Court asked two questions;
1. Is the customer a victim of unauthorized withdrawal?
2. Is the bank entitled to rely on an absence of customer negligence or a properly authorized digital transaction process?
Practical guidance for bankers
Onboarding must be demonstrable, not assumed
Banks should ensure that they keep an auditable trail of how a customer subscribes to a digital channel, including obtaining the customer’s informed consent. This trail should capture the terms and conditions provided and accepted, the risks explained and accepted, the device or number registered, the date of enrollment and the method of enrolment. As the two cases illustrate, a statement indicating a mobile channel subscription or a transaction via “EAZZY” might be sufficient to show the channel used but not the informed consent, authorization or control exercised by a customer. This should be particularly important where the customer is illiterate, elderly, unfamiliar with the process or a branch-based customer accustomed to transacting at the counter.
Monitoring should be risk-based, not unlimited
Nakku Joweria does not eliminate the bank’s fraud monitoring responsibilities. It states that the bank is not automatically liable for every unauthorized transaction just because it occurred through a digital channel. The Court directed the customer to take reasonable steps to report a suspected phone theft to the relevant telecommunication network and the police. By contrast, the Court further directed the bank to take appropriate steps to monitor and secure the account, depending on the suspicious activity detected, such as large or sudden transactions, new or unauthorized devices or beneficiaries, or failed attempts. Transactions alerts are important fraud controls, but sending an alert does not absolve a bank of the responsibility to investigate and respond appropriately if the alert indicates specific irregularities or unauthorized activity.
Practical guidance for customers
Customers should treat a bank-linked phone, SIM, National Identification information, PIN, OTP and authentication device as components of one security arrangement. If a phone or SIM is lost, or if identification information associated with digital access may have been exposed, the customer should immediately notify the bank, the telecommunications provider and, where appropriate, the police. Reporting only to the network provider or police may not give the bank timely notice to restrict the account.
Customers should also read or obtain an explanation of the terms governing digital services before enrolment. They should ask the bank to record that they do not wish to use a digital channel where that is their preference, and they should retain confirmation of any complaint, blocking instruction or request to disable a service.
In conclusion, bankers must make digital-banking security and customer consent provable. For customers, they have a duty to protect and promptly report the loss of every device or credential connected to their account.