A customer of I&M Bank is demanding answers after KSh180,700 was transferred from their bank account to an Airtel number without their knowledge or consent.
The I&M Bank customer now wants to know how the transaction was initiated and what security measures were used to authorise the movement of the money.
In a complaint shared with this editor, the customer says they use biometric authentication to access their banking accounts and insists that they did not authorise the transaction.
Despite this, KSh180,700 was moved from the account to Airtel number 254100057823, leaving the customer demanding to know who initiated the transfer, what authentication was used and who controlled the receiving number.
The customer says the matter has already been reported to I&M Bank and the police, but is now calling for a deeper investigation into the transaction and the circumstances under which the money left the account.
Hello Nyakundi, I AM HURT, ANGRY AND DEMANDING ANSWERS!” “How does KSh 180,700 disappear from my I&M Bank account and get transferred to Airtel number 254100057823 WITHOUT MY CONSENT?” “I use biometric authentication to access my accounts. I did not authorise this transaction. I did not consent to it. Yet my hard-earned money is gone!” “How was this transaction initiated? Who authorised it? What authentication was used? Who owns or controlled the receiving number? And where did my money go?”
The customer says the matter goes beyond the loss of KSh180,700 because the circumstances raise questions about the security of electronic banking and whether another customer could experience a similar incident.
I&M Bank itself advises customers who suspect fraudulent transactions to report them immediately and preserve evidence such as screenshots, suspicious messages and other information that could assist an investigation. The bank also provides dedicated channels for reporting cybersecurity incidents and says customers should act immediately if they suspect their accounts have been compromised.
Kenya's National Payment System Regulations also provide important protections around electronic transfers. The regulations state that a payment service provider can be liable for payment transactions performed without the customer's knowledge, although liability can be excluded in certain circumstances where the provider proves an element of fault on the customer's part or demonstrates that the payment instruction was carried out by the legitimate customer. Where a payment service provider is liable for a defective transaction, the regulations provide for restoration of the debited account without undue delay.
The Computer Misuse and Cybercrimes Act also criminalises unauthorised access to computer systems and various forms of unauthorised interference and fraudulent use of electronic data. Where electronic systems are used to unlawfully obtain or transfer money, the circumstances can therefore raise issues beyond an ordinary banking dispute.
Kenyan courts have previously dealt with disputes involving unauthorised transactions and the responsibility of banks to protect customers' funds. In one case, the High Court found a bank liable after concluding that it had failed in its duty of care to protect a customer's money from unauthorised withdrawals, with the court noting that customers reasonably expect banks to maintain safeguards against such transactions.
The customer wants the bank and investigators to answer several straightforward questions: How was the KSh180,700 transfer initiated?
What authentication was recorded?
From which device or channel was the transaction made?
Who controlled the receiving Airtel number?
Was the transaction flagged by the bank's security systems?
And where did the money go after reaching the receiving number?
The customer says they will not remain silent until those questions are answered and the money is recovered.