Cristal Advocates

Imposition of Liability for ATM Fraud in Uganda

The case of Stanbic Bank versus Moses Rukidi Gabigogo

Cristal Knowledge Series

August 2024
Imposition of Liability for ATM Fraud in Uganda
The case of Stanbic Bank versus Moses Rukidi Gabigogo

1. Introduction
3. Duties of Banks and Customers
Since the first Automated Teller Machines (ATMs)
were installed in Uganda in 1997, these machines have Both banks and customers bear responsibilities that
become central to modern banking, revolutionizing may influence the assignment of liability in the event of
how financial transactions are conducted. Banks have ATM fraud as discussed further.
leveraged this technology to enhance service delivery
and broaden their reach, making ATMs the preferred a) Duty to obey the customer’s mandate
choice for customers. This advancement has allowed
users to access their accounts seamlessly outside Legally, a bank is required to process a customer's
traditional bank branches, avoiding long waits and payment order if the account has sufficient funds. In
restrictive banking hours. ATM transactions, when the customer inserts their
card and enters the correct Personal Identification
As the use of ATMs has grown, so too has the incidence Number (PIN), this action constitutes
of ATM-related fraud. Because the amounts involved authorization for the bank to dispense cash. The bank is
are usually minimal, many cases remain unreported or then obligated to execute the transaction as instructed
uncontested. When disputes however arise, by the customer.
determining who bears the liability between the bank
and the customer can be challenging. Recently in the b) Duty of care and rreasonable skill
case of Stanbic Bank Uganda versus Moses Rukiidi
Gabigogo Civil Appeal 28 of 2023, the High Court in Banks have a duty to exercise care and skill in
Uganda has examined the circumstances under which managing their customers' accounts. This
liability for ATM fraud may be assigned, clarifying responsibility extends to ensuring that their digital
when responsibility falls on either party. This article banking systems are secure, well-maintained, and
delves into these developments and their implications. updated. Essential security measures include the use of
digital certificates, strong encryption, and notifying
2. Instances of ATM Fraud customers via SMS after transactions.

ATM fraud continues to evolve as fraudsters develop Conversely, customers must safeguard their ATM cards
increasingly sophisticated methods to exploit bank and personal information, including PINs. They are
customers. One common technique is card skimming, responsible for taking reasonable precautions to
where devices are installed on ATMs to capture protect their card's security features and using the ATM
information from the magnetic strip of a genuine card, card in accordance with its terms and conditions.
which is then used to create a cloned card. Another
method, card trapping, involves placing a device in the c) Duty to keep customers safe while on their
card reader slot to prevent the card from being premises
returned to the customer; once the customer leaves in
frustration, the fraudster retrieves the card. Given the special relationship between a bank and its
customer, banks are generally responsible for keeping
Card swapping occurs when fraudsters replace a customers safe from violent attacks while on their
customer’s card with a dummy card under the pretense property and are required to provide customers with
of assisting with a transaction. Additionally, fraudsters adequate security measures such as: security
may target less tech-savvy individuals, offering help personnel, security cameras and adequate lighting.
while either copying their PIN or swapping their card.
Another tactic involves jamming the ATMs “enter” and 4. Liability for ATM Fraud
“cancel” buttons with glue or pins, making them
unusable. When the customer abandons the In determining liability for ATM fraud, the Courts have
transaction in frustration, the fraudster then uses the employed a flexible balancing test that considers
machine to withdraw funds. As technology advances, so several factors. This test evaluates the burdens of
do the methods of ATM fraud, requiring constant imposing a duty on the bank, the social utility of ATMs,
vigilance and adaptation. and weighs them against the severity of the ATM crime

Cristal Knowledge Series

August 2024
Imposition of Liability for ATM Fraud in Uganda
The case of Stanbic Bank versus Moses Rukidi Gabigogo

and its likelihood of occurrence. The bank is held liable occurring after the reporting of the unauthorised
if the burden of its duty and the utility of the ATM are transaction is borne by the bank.
outweighed by the gravity and foreseeability of the
fraud. Where the loss arose due to violent attacks on the
customer while on bank premises, the bank will be
Generally, the bank will be liable when the liable for the loss and breach of its duty if the Court
unauthorised transaction takes place in circumstances finds that the bank did not put in place measures to
of contributory fraud/negligence/deficiency on the protect against such attacks when the same were
part of bank, or third party breach where the deficiency reasonably foreseeable at the time of the creation of the
lies neither with the bank nor with the customer but lies contract between the Bank and its customer.
elsewhere in the system, and the customer notifies the
bank within a reasonable time of receiving the 5. Conclusion
communication from the bank regarding the
unauthorised transaction, or when it fails to ensure Instances of ATM fraud are numerous and diverse. In
sufficient security to prevent fraudsters from accessing determining liability for third-party actions, the Court
the technology behind its electronic payment system. evaluates each case by balancing the bank's duty and
the benefits of ATM use against the seriousness and
However, the customer will be liable for the loss foreseeability of the fraud. This approach ensures fair
occurring due to unauthorised transactions where the assignment of responsibility, considering both the
loss is due to negligence by a customer. The customer bank's security measures and the nature of the
bears the entire loss incurred until he or she reports the fraudulent activity.
unauthorised transaction to the bank. Any loss

Cristal Advocates accepts no responsibility for any loss occasioned to any person acting or refraining from acting as a result of
material contained in this publication. Further advice should be taken before relying on the contents of this publication.

2023

Cristal Knowledge Series

August 2024
Contacts for this Publication.

Opindeni Noah Priest Dragudi Denis Yekoyasi Kakembo

Author dkakembo@cristaladvocates.com

Energy & Infrastructure Tax

Business support Company Secretarial & Trustee Services
Employment Public Law & Policy Advocacy
Banking & Finance Dispute Resolution
School of Professional Excellence Corporate and Commercial

Contact us
Cristal Advocates P.O. Box 1769 Kampala, Uganda
32 Lumumba Avenue +256 (414) 971274
4th Floor, Padre Pio House admin@cristaladvocates.com
Lumumba Avenue www.cristal advocates.com