Court throws out online identity theft case against Safaricom

The High Court has absolved mobile service provider Safaricom from blame in an online identity theft case.

Boniface Wangai Wachira sued the telco over claims that his national identification card was used to register for a loan that was never repaid.

Wachira blamed Safaricom for illegally using his data to register the line without his authority.

He argued that he was listed as a loan defaulter despite a third party being the beneficiary of the loan.

Wangai said he learned about the fraud when he went to apply for a loan from a bank in 2020 and was informed that the Transunion Credit Reference Bureau had listed him as a defaulter.

However, Justice Reuben Nyakundi found that Wangai had not proved that Safaricom was negligent.

The Judge said the case involved multiple actors: the mobile service provider, the institutions issuing the loan, and the CRB.

“While this court acknowledges that the Plaintiff may have suffered damages due to unauthorised lending and adverse CRB listings, such claims should be properly directed at the relevant lending institutions and credit reference bureaus, not the telecommunications provider,” he said.

Justice Nyakundi said Safaricom could not be blamed as its role was limited to registering the line.

“Each of these actions occurred without the defendant's direct involvement or control. Indeed, the evidence shows that the defendant neither lends money nor reports to Credit Reference Bureaus, making it difficult to establish a direct causal link between their actions and the plaintiff's alleged damages,” said Nyakundi.

According to him, fraud happening through a mobile number does not automatically establish liability on the part of the telecommunications provider.

The judge was of the view that shifting the burden to Safaricom beyond the registration part would ultimately kill digital financial services.

“Such a finding would effectively require telecommunications providers to monitor and assume responsibility for all subsequent uses of their services by third parties. This would not only be impractical but would likely impede the development of digital financial services that have proved crucial to Kenya's economic growth,” he ruled.

The Judge further said Wangai needed to prove the link between Safaricom and the digital loan.

He concluded that there was no evidence to show the firm was responsible.

“In the present instance, I may be right or wrong. The circumstances under which the CRB information is shared fall within the corresponding duty of the financial institution, bank, or licensed digital loan platforms to submit any such information in the event of a default of the loan agreement. In this regard, this court has not been told that the loan application and the amount dispersed to the alleged name of the plaintiff was under the watch of the defendant’s company or its subsidiaries,” the judge said.

In the case, Wangai asked for Sh52,395.84 in special damages and Sh30 million in general damages.

He claimed that the mobile services provider had refused to cooperate with the police and the Office of Data Protection to arrest the persons behind the identity theft.

Safaricom called Joyce Wambui Mugwe as its witness. The telco denied issuing any loan or referring Wachira to the CRB.

Mugwe told the court that her employer had followed due process while registering the line.

According to her, Safaricom has a separate commercial relationship from banking platforms like KCB M-pesa.

She explained that Safaricom merely provides merchant till numbers without access to or visibility into transactions conducted through banks' platforms.

Mugwe asserted that the telco operates independently with its own security and verification processes.

The witness said that while it provides platforms that third parties may use for mobile money services, it is not responsible for those services' security, credit risk, or CRB listing decisions.

She argued that Safaricom agents conduct a thorough verification procedure before registering a line, including physical verification requirements, system checks, and photo identification matching.

The witness argued that it cannot control how subscribers use mobile numbers once registered.

She said telecommunications service providers cannot reasonably be expected to monitor or control all subsequent uses of their platforms by third parties.

The court heard that Safaricom does not give loans nor list or forward names to Credit Reference Bureaus, and is not a reporting entity under the financial lending system.