Wakilii

Barclays Bank of Uganda Limited v Eron Kabachwamba (Civil Appeal No. 10 of 2015)

High Court · [2026] UGCOMMC 105 · 2026 Appeal Allowed AI-generated summary ↓ Download Pin to watchlist Add to matter
Jurisdiction
Uganda
Case Type
Civil appeal from Chief Magistrate's Court judgment awarding damages for unauthorised debit card transactions
Decision
Suit dismissed; respondent held liable for losses due to gross negligence in safeguarding debit card and PIN

Observed later treatment

No later-treatment classification is recorded for this judgment.

Citator coverage is limited to judgments in the Wakilii corpus and source-matched treatment records. Absence of a signal is not an assertion that the case remains good law.

AI-generated summary. This summary was generated by AI from the full text of the judgment. It may contain errors or omissions—always read the source judgment before relying on it.

Holding

Held that a bank's duty to provide secure digital banking infrastructure does not extend to blocking transactions flagged as unusual unless there are reasonable grounds to suspect fraud. A cardholder who allows unsupervised access to her debit card by a third party and whose PIN is compromised through shoulder surfing or distraction techniques is grossly negligent. Such gross negligence makes the cardholder liable for losses from unauthorised transactions. The bank fulfilled its contractual duties by attempting to contact the cardholder and had no obligation to reverse settled transactions absent contractual terms or regulatory obligations requiring it.

Outcome

Suit dismissed; respondent held liable for losses due to gross negligence in safeguarding debit card and PIN

Facts

The respondent operated a current account with the appellant bank and was issued a VISA debit card. On 18 January 2013, UGX 8,538,356 was withdrawn from her account in Nairobi, Kenya, without her authorisation. She lodged a complaint on 19 January 2013, but the bank debited her account on 22 January 2013. The bank's investigation revealed that on 28 December 2012, the respondent had used her card at a Point of Sale at Emin Pasha Hotel in Kampala and left the card with a hotel attendant who claimed to be sorting out a technical problem. The bank suspected the card was cloned during this incident. The bank's fraud monitoring system flagged the Nairobi transactions on 18 January 2013, but the bank could not contact the respondent as her registered phone number was switched off. A subsequent attempted withdrawal on 22 January 2013 was successfully blocked. The trial magistrate found the bank liable for failing to safeguard the respondent's account and awarded her damages and interest.

Issues

  1. Whether the appellant bank failed in its duty to provide a secure infrastructure for digital banking and to prevent unauthorised debit card transactions.
  2. Whether the respondent cardholder failed in her duty to exercise vigilance in managing her digital credentials, specifically her debit card and PIN.
  3. Whether the trial court correctly attributed liability for the loss arising from unauthorised debit card transactions to the appellant bank.

Orders

  • The judgment of the Court below is set aside.
  • Judgment is entered in favour of the appellant dismissing the suit.
  • Costs of the appeal and those of the Court below awarded to the appellant.

Rules and key headnotes

Banking Law — Duty of Banks — Secure Digital Infrastructure — Scope and Extent
Banks have a comprehensive duty to provide a secure infrastructure for digital banking extending to the entire digital ecosystem, including the core banking system, customer-facing applications, and the security of outsourced service providers.
Banking Law — Duty to Execute Payment Instructions — Quincecare Duty — Threshold for Suspicion
A bank must comply with a customer's authorised payment instructions promptly, provided the instructions fall within the mandate and there are no legal or regulatory barriers to compliance. The Quincecare duty to refrain from executing a payment instruction arises only when the bank has reasonable grounds to believe that the instruction is an attempt to misappropriate the customer's funds. Mere unease, perception of a risk of fraud, or finding a transaction unusual or uncomfortable is insufficient to trigger the Quincecare duty.
Banking Law — Unauthorised Debit Card Transactions — Apportionment of Liability
Liability for losses due to unauthorised use of a debit card is typically apportioned based on which party was best placed to prevent the fraud. Where a fraudster gains control of a customer's account and gives instructions to the bank without the customer's knowledge, courts often place liability on the account holder if they negligently allowed a third party to access their PIN or card, or if they failed to report the incident immediately.
Contract Law — Banking Contracts — Customer's Duty to Safeguard Digital Credentials
A debit cardholder has a fundamental, contractual, and legal duty to exercise vigilance in managing their digital credentials (PINs, passwords, OTPs, and user IDs) to prevent unauthorised access to their funds. Allowing someone else to have unsupervised access to the card or sharing a PIN is considered a breach of this duty. A debit cardholder's gross negligence in protecting their card and PIN will lead to the cardholder's liability for losses resulting from unauthorised transactions.
Evidence — Circumstantial Evidence — Standard of Proof in Civil Cases — Gross Negligence
Gross negligence may be proved by circumstantial evidence. In civil cases, when a party relies on circumstantial evidence, if the facts permit more than one inference, the court must select the most plausible. The inference must be based on reason, experience, and common sense, not on mere conjecture, speculation, or suspicion. It is enough if the circumstances appearing in evidence give rise to a reasonable, definite, and logical inference that is more likely to be drawn than not.
Banking Law — Debit Card Transactions — Settlement Process — Duty to Reverse Unauthorised Transactions
An issuing bank's ability to stop settlement or reverse a debit after settlement in VISA debit card transactions is governed by a combination of Visa Operating Rules, national banking regulations, and the contractual terms agreed upon between the bank and the cardholder. In the absence of contractual terms and regulatory obligations allowing for chargebacks or reversals in electronic payments, the Quincecare duty is generally subordinate to the bank's obligation to execute valid and proper orders promptly unless there is evidence of dishonesty or fraud. Once a transaction is authorised and the cardholder's account is debited, the transaction generally cannot be stopped or reversed by the issuing bank.

Legislation cited (1)

Cases cited (16)

  • Father Nanensio Begumisa and three Others v Eric Tiberaga (SCCA No. 17 of 2000)
  • Aida Atiku v Centenary Rural Development Bank Limited (H.C. Civil Suit No. 754 of 2020)
  • Stanbic Bank Uganda Limited v Moses Rukidi Gabigogo (H.C. Civil Appeal No. 28 of 2023)
  • Barclays Bank Limited v. WJ Simms Son & Cooke (Southern) Limited [1980] 1 QB 677
  • Barclays Bank Plc v. Quincecare Ltd [1992] 4 All ER 363
  • Braganza v. BP Shipping Ltd [2015] UKSC 17
  • Harvey v. Santander UK Plc [2023] All ER (D)
  • Lipkin Gorman (a firm) v. Karpnale Ltd and another [1992] 4 All ER 331
  • JSC BM Bank v. Kekhman [2015] EWHC 3073 (Comm)
  • Wagner v. Somerset County Memorial Park, 372 Pa.
  • Polk v. Steel Workers Organizing Committee, 360 Pa. 631, 62 A.2d 850
  • De Reeder v. Travelers Insurance Co., 329 Pa. 328, 198 A. 45
  • NSB Ltd (in liquidation) v. Worldpay [2012] EWHC 927 (Comm); [2012] All ER (D) 156
  • Sainsbury's Supermarkets Ltd and others v. Mastercard Incorporated and others [2020] All ER (D) 89
  • Shojibur Rahman v. Barclays Bank PLC (2012), [2014] EWCA Civ 811
  • Nsovo Holdings (Pty) Ltd v. Standard Bank of South Africa (22594/2018) [2019] ZAGPJHC 237; 2020 (2) SA 619

Full judgment

↓ Download PDF

The original judgment as reported. Read the original PDF before relying on any passage.

Barclays Bank of Uganda Limited v Eron Kabachwamba (Civil Appeal No. 10 of 2015) [2026] UGCommC 105 (1 April 2026)
Source: this page presents Wakilii’s issue analysis and metadata for a publicly reported Ugandan judgment. Any AI-generated summary is marked as such. Judgment text is sourced from the Uganda Legal Information Institute (ulii.org). Wakilii is not affiliated with ULII.