Safaricom not to blame for sim swap theft - court

Pennah Wanjiru lost Sh21,000 to the infamous Mulot Subscriber Identification Module (SIM) swap fraudsters on April 1, 2016.

Eight years later, Wanjiru has not only ="https://www.standardmedia.co.ke/the-standard/article/2001446801/how-to-protect-yourself-from-sim-swap-fraud#google_vignette">lost a landmark case on< who is to blame whenever hacker(s) swap and steal mobile money but will have to pay the cost of the case to mobile services provider Safaricom.

On the fateful day, Wanjiru got a call from an alleged Safaricom customer care staff. The caller on the other end first identified her by name and asked for mobile phone Personal Identification Number (PIN).

The call lasted 438 seconds (some 7 minutes) and then her line went off.  The hackers cleaned her M-Pesa account and used the Sh10 she had in airtime to buy internet bundles.

Wanjiru sued Safaricom and blamed it for alleged negligence and failure to secure her line and money wallet.

The magistrate court and subsequently the High Court, however, ="https://www.standardmedia.co.ke/national/article/2001464127/main-suspect-in-sim-swap-fraud-arrested-amid-dci-investigations">dismissed her case< and placed responsibility on her.

Justice Hedwig Ong’undi handled the case at the High Court. She found that Wanjiru was the author of her miseries as she gave out the critical information to the hackers.

“In the face of all the evidence before the court and on a balance of probabilities, it is clear that the appellant gave out her Mpesa PIN to the unknown person/persons. The respondent had no control over that. It is the appellant who had the control by keeping her PIN number confidential,” argued Justice Ong’udi.

In the case, Wanjiru was seeking Sh21,000 from Safaricom, which had been stolen from her. In addition, she had asked the court to award her an extra Sh2,300 as interest.

Before the magistrate’s court, Wanjiru testified that on the morning of April 1, 2016, she noticed that her phone did not have a network. She could neither get calls nor receive text messages.

The court heard that Wanjiru went to the nearest agent but before she could get assistance, the network restored itself.

Internet bundles

To her shock, however, her mobile money had been cleaned and used to buy internet bundles.

Wanjiru denied ever giving her PIN. She told the court that the caller had threatened to block her phone if she did not disclose her pin.

She argued that M-Pesa had a responsibility to secure her money. At the same time, she said the telecommunication company ought to have explained to her or flushed out the person who stole from her.

The court heard that all Safaricom customer care agent did was to ask her to change the PIN. Safaricom denied responsibility.

It called Gideon Mwanzige, its fraud investigations staff, as its star witness.

Mwanzige told the court that Wanjiru was called at around 11:17am from Mulot, Narok county.

After the call, ="https://www.standardmedia.co.ke/the-standard/article/2001434396/sim-swap-how-fraudsters-do-it-causing-you-loss-of-hundreds-of-thousands-of-shillings"> he said that there was a request “The request went through and the swap was completed. The victim could not go through since the network had gone to the new SIM card. For an Mpesa agent to do a swap, the customer needs to be there as there has to be an ID card and an original PIN that was bought with the card,” Mwanzige testified.

Mwanzige argued that Wanjiru blundered by disclosing her PIN. He said SIM swap is only done if a line is lost, damaged, not working or when doing an upgrade.

He said after Wanjiru’s line was swapped, the new line made several calls and sent some Sh10 to establish M-pesa balance, and thereafter bought bundles.

The investigator said the request for the swap was done from an M-Pesa agency though he could not tell from which part of the country.

In its submissions, Safaricom argued that Wanjiru knew about her mobile number, her PIN and her national identification card, hence, she was solely to blame for the theft.

It further argued that it had been warning its customers against sharing or disclosing their PINs or engaging other numbers than 0722000000.