KCB Ruling Clarifies Banks' Responsibilities Following Mistaken Mobile Transfers

A High Court ruling arising from a Sh2,050 mistaken mobile money transfer involving KCB could have implications far beyond the value of the disputed payment.

By dismissing the bank’s appeal, the court clarified that banks have a legal duty to act promptly to preserve disputed funds once they are notified that an electronic transfer was made in error. The decision offers clearer guidance on how financial institutions are expected to respond when customers report mistaken digital payments and reinforces the standard of care surrounding Kenya’s mobile money ecosystem.

The dispute dates back to February 12, 2023, when Nakuru advocate Sammy Kamonjo Kiburi accidentally sent Sh2,050 through M-Pesa to the wrong KCB Paybill.

After discovering the mistake, he immediately contacted Safaricom and was referred to KCB because the funds had already been credited to a KCB account. According to court records, he called KCB’s customer care within minutes, received a complaint reference number and was informed that the matter would be handled.

Seven days later, KCB informed him that the money had already been withdrawn from the recipient’s account and could not be reversed.

The Small Claims Court found in his favour, awarding him the value of the transfer together with costs and interest. KCB appealed, arguing that the customer had caused his own loss by entering the wrong Paybill number and that the bank could not reverse funds without the recipient’s consent.

The High Court disagreed.

Rather than focusing on the mistaken payment itself, the court examined what happened after KCB became aware of the problem.

Justice Joseph Sergon accepted that banks cannot simply reverse money that has reached another customer’s account without following the appropriate legal process.

That, however, was not the issue before the court.

The judgment distinguished between reversing funds and preserving them.

According to the court, once KCB received notice that the transfer had been made in error, it had a duty to take reasonable steps to prevent the money from leaving the account while the recovery process was underway.

Evidence presented during the appeal showed that KCB acknowledged receiving the complaint on the same day but only froze the account after the funds had already been transferred elsewhere and withdrawn.

The court found that the bank failed to demonstrate what action it took during the period between receiving the complaint and the withdrawal.

It also criticised delays caused by KCB’s internal process of escalating the complaint from its headquarters to the customer’s branch.

On the question of confidentiality, the court noted that KCB’s own witness admitted during cross-examination that the recipient’s identity should have been disclosed once the mistaken transfer had been reported. By withholding that information, the court found, the bank also limited the customer’s ability to pursue recovery directly.

The High Court therefore upheld the Small Claims Court’s finding that KCB had acted negligently after receiving notice of the mistaken payment.

Although this case concerns a mistaken Paybill payment rather than fraud, it echoes another recent High Court decision involving Diamond Trust Bank and Safaricom.

In that judgment, the court held both organisations liable after a customer lost KSh4.4 million following a fraudulent SIM swap. The court ruled that compliance with internal procedures and successful PIN authentication did not remove a bank’s wider obligation to identify transactions that presented obvious warning signs.

Taken together, the two decisions point to a consistent judicial approach.

The courts are looking beyond whether institutions followed their own processes and examining whether they responded reasonably once they became aware of a foreseeable risk to customer funds.

In the DTB case, that meant questioning unusual transaction patterns after a SIM swap had been reported.

In the KCB dispute, it meant asking whether the bank acted quickly enough to preserve disputed funds before they could be withdrawn.

The facts differ, but both judgments place operational response at the centre of a bank’s duty of care.

The ruling also arrives weeks after the National Computer and Cybercrime Coordination Committee announced plans to strengthen cooperation between banks, mobile network operators and government agencies to improve the recovery of wrongly sent digital payments.

At the time, the committee described recipients who knowingly retain money sent by mistake as one of the country’s most common digital offences and said closer coordination was needed to improve recovery.

The announcement, however, stopped short of explaining whether banks would receive new powers or whether customers would benefit from faster recovery procedures.

This High Court judgment addresses part of that uncertainty.

Rather than introducing a new recovery framework, it clarifies that banks already carry legal responsibilities once a mistaken transfer has been reported. Even where a reversal cannot happen immediately, institutions are expected to act with reasonable diligence to prevent disputed funds from disappearing while the matter is being resolved.

The decision does not require banks to freeze or reverse customer funds automatically whenever a complaint is received.

Instead, it places emphasis on the speed and effectiveness of their response.

Financial institutions may now face greater scrutiny over how quickly complaints about mistaken transfers are escalated, whether disputed funds can be preserved before they are withdrawn, the documentation showing what action was taken immediately after notification, and communication with customers during recovery efforts.

The judgment also serves as a reminder that internal workflows may themselves become evidence where delays contribute to customer losses.

For customers, the decision reinforces that making an honest mistake does not automatically end the possibility of recovering lost funds.

The High Court rejected KCB’s argument that the customer should bear responsibility simply because he entered the wrong Paybill number. Instead, it recognised that he acted reasonably by reporting the mistake almost immediately.

The judgment does not guarantee that every mistaken mobile money transfer will be recovered.

Each dispute will still depend on its own facts, including how quickly the customer reports the error and how the receiving institution responds.

What the ruling does establish is that once a bank has been placed on notice, its actions—or its failure to act—may carry legal consequences.

That clarification is likely to influence how banks approach mistaken payment disputes as digital banking and mobile money continue to handle a growing share of everyday transactions across Kenya.

Download the free Kaspersky SMB Cybersecurity Guide here to learn how businesses can move beyond traditional antivirus and build a more resilient approach to cybersecurity.