Court Rules a Correct PIN Is Not a Defence: Safaricom and DTB to Pay KES 4.4M SIM Swap Victim

The High Court at Machakos has upheld a ruling that makes both Safaricom and Diamond Trust Bank pay for money stolen from a customer after her line was fraudulently swapped. Justice Asenath Ongeri dismissed appeals from both companies on 18 June 2026.

The total taken was KES 4,418,601. Safaricom carries 60% of it, which comes to KES 2,630,000. DTB carries the remaining 40%, or KES 1,788,601. Two companies, one theft, two different failures.

What happened

The customer, Mercy Wairimu Kariuki, had her SIM swapped on 6 February 2022. A SIM swap moves your phone number onto a new SIM card. It exists for a good reason. Lose your phone, and you need your number back. The problem is that whoever holds your number also receives every one-time password sent to it, and SMS one-time passwords are what most Kenyan banks use to confirm you are you.

Kariuki noticed something was wrong and called Safaricom customer care the same day. The swap went through anyway. She recovered her line at a Safaricom shop the next day.

By the morning of 8 February 2022, her DTB account was empty. The money left through DTB mobile banking and Pesalink, in transfers sized to stay under the bank’s daily ceiling of roughly KES 2 million. The theft straddled a weekend, so the daily limit reset midway and the fraudsters carried on.

The Chief Magistrate’s Court at Mavoko ruled in March 2024 that both firms had breached their duty of care and split the blame 60:40. DTB appealed. Safaricom cross-appealed, saying its share was too high. Both lost.

Why the telco was blamed

Safaricom’s argument was jurisdictional. It runs telecommunications infrastructure. It cannot see inside a bank account and does not authorise transfers.

Justice Ongeri rejected the separation. Permitting the swap was, in the court’s words, “a direct and proximate cause of the loss.” The theft could not have happened without the swap, and the swap was Safaricom’s to prevent.

Why the bank was blamed

DTB relied on the defence banks have used for years. The correct PIN was entered, so the transactions were authorised, and the SIM swap was a third-party act that broke the chain of responsibility.

The court rejected it. “A bank cannot hide behind a customer’s PIN when it is presented with a series of transactions that are so glaringly out of the ordinary that a reasonable banker would have been put on inquiry,” Justice Ongeri held.

DTB also argued some transfers happened on a non-business day, outside human oversight. The court found banking systems run automatically around the clock. The weekend limit reset that let the fraud continue was treated not as a defence but as proof of the weakness DTB should have been watching.

What is new here

Kenyan courts have held Safaricom liable for SIM swap losses before. In the Kafwa case, the High Court upheld a finding against Safaricom for KES 751,680 taken from an M-PESA account. Courts have also gone the other way in smaller claims.

The bank is the new part. Kariuki’s case establishes that Safaricom and DTB owed her concurrent and independent duties. Neither could point at the other.

The tools already existed

In March 2023, we covered Safaricom’s SIM Swap Check API, which lets a bank ask when a customer’s SIM was last swapped before approving a transaction. A bank running that check would have seen a two-day-old swap on Kariuki’s line. We have also explained how to block SIM swaps at agent shops by dialling *100*100#.

The internal problem is real too. Safaricom fired 113 employees for fraud in a single year. It processes about 28,000 SIM swaps a day and says roughly 40 in every 750,000 are fraudulent.

The banking side is worse. Central Bank of Kenya figures for 2024 put mobile banking fraud losses at KES 810.68 million, a 344% jump, within total banking fraud losses of KES 1.59 billion.

What this means for you

If your number is stolen, the loss is not automatically yours to absorb. Two courts have now said your telco and your bank both owe you a duty of care, and a correct PIN does not settle the matter when the transactions look obviously wrong.

Lock your line by dialling *100*100#, so it can only be swapped in person with your ID. Enrol in Jitambulishe voice biometrics. If you suspect a swap, call Safaricom on 333 and your bank straight away, and follow up in writing. These claims are winnable. Kafwa started in the Small Claims Court.

Neither Safaricom nor DTB has said publicly whether it will appeal further. If either does, this precedent gets tested again.