Banks and Customers at Risk Due to The Rising Threat of ATM Fraud and Legal Liability

The High Court has set a precedent for how ATM fraud and liability are handled in Uganda, reinforcing the need for stronger banking security while ensuring customers also act responsibly.

On 12th January 2024, Hon. Justice Stephen delivered a landmark ruling in Stanbic Bank Uganda Limited v. Moses Rukidi Gabigogo (Civil Appeal 28 of 2023) [2024 UGCommC 23], emphasizing the need for heightened caution and vigilance by both banks and customers in ATM usage and operations.

Brief Facts:

Incident at the ATM:
The respondent, Mr. Gabigogo, attempted to deposit UGX 2,500,000 at Stanbic Bank’s ATM in Kampala.
After cancelling the transaction, he proceeded to check his balance and reinserted his ATM card.
A stranger suddenly reached over his shoulder, pressed buttons on the machine, and ejected the card.
The stranger handed the ATM card to him and walked away.

When the respondent tried to use the card again, the ATM displayed a “capture” message, indicating the card was retained.

Unauthorized Withdrawals:
The respondent later received SMS alerts indicating unauthorized withdrawals had emptied his account.
CCTV footage revealed that two individuals had conspired to steal his ATM card and PIN.
The fraudsters swapped his original ATM card with a fake one before making multiple withdrawals from various locations.

Legal Action:
The respondent sued Stanbic Bank, alleging negligence due to:
-Failure to secure the ATM area.
-Lack of security guards at the booth.
-Failure to prevent unauthorized access to customer accounts.
The trial court ruled in favor of the respondent, awarding him compensation for financial loss, general damages, and exemplary damages.

Stanbic Bank appealed the decision.

On appeal, the Court held as follows;
Bank’s Duty of Care: The court reaffirmed that banks have a duty to safeguard customers’ funds and banking information holding that Banks must ensure that ATM security measures, such as CCTV monitoring and security personnel, are in place to prevent fraud.
Balancing Test for Bank Liability: Courts apply a “flexible balancing test”, weighing:
The burden on banks to impose security measures.
The social utility of ATMs.
The likelihood and gravity of ATM-related fraud; If the likelihood and impact of fraud outweigh the burden of enhanced security, banks may be held liable.
Customer’s Responsibility: Court held that customers are responsible for keeping their PINs confidential. Banks are not liable if a customer’s negligence directly contributes to fraud (e.g., sharing PINs or failing to report a lost card immediately). If a customer does not promptly report ATM card retention or unauthorized withdrawals, they may bear part of the loss.
Liability in Fraud Cases:
Bank Liability: If the bank fails to take reasonable security measures, it may be held accountable for fraud losses. Banks must act swiftly to block compromised cards once a security breach is reported.
Customer Liability: If fraud occurs due to the customer’s negligence, such as sharing banking details or failing to secure their card, they may bear the loss.
Contractual Allocation of Risk: Banks often include terms in customer agreements limiting liability for unauthorized transactions. Courts examine whether such clauses are reasonable and whether the bank took adequate steps to mitigate fraud risks.
The information contained herein i is not a legal opinion but simply an alert. You are advised to read the case and familiarize yourself with it.

 By Rebecca Nakiranda