Investrust Bank v Diab (SCZ 8 240 of 2016) [2019] ZMSC 321 (8 October 2019)

IN THE SUPREME COURT OF ZAMBIA HOLDEN AT NDOLA SCZ/8/240/2016 APPEAL NO. 197/2016 (Civil jurisdiction) BETWEEN: INVESTRUST BANK APPELLANT AND IBRAHIM DIAB RESPONDENT Coram: Malila, Kabuka and Mutuna, JJS On 3rd September, 2019 and 8th October, 2019 For the Appellant: Mr. O. Sitimela - Messrs Fraser & Associates, with Mr, B. Msidi, In-house Counsel for Investrust Bank For the Respondent: Mr. M. Kabesha - Kabesha & Co. JUDGMENT Malila, JS, delivered the Judgment of the Court. Cases referred to: 1. Group Torras SA v. Al-Sabah (NO5) (1999) CLC 1469 at 1541 (affirmed CA [2001] Lloyds Report Bank 36). 2. Khalid Mohamed v. Attorney-General (1982) ZR 49. 3. Sobek Lodges Ltd. v. Zambia Wildlife Authority (2011 )(2) ZR 235. 4. Nkhata and 4 Others v. Attorney-General (1966) ZR 124. 5. Jennipher Nawa v. Standard Chartered Bank Zambia Plc. (2011) (1) ZR1. 6. Becmocs Ltd. v. AON Zambia Ltd. and Goldman Insurance Ltd. (SCZ Judgment No. 9/2012). 7. Indo-Zambia Bank Ltd. v. Lusaka Chemist (SCZ Judgment No. 5 of 2003). 8. Colgate Palmolive Inc. v. Shemi and Others (Appeal No. 11 of2005). 9. Barclays Bank Plc. v. Patricia Chipepa (Selected Judgment No. 16 of 2017). J2 10. Major Shipping & Trading Inc. v. Standard Chartered Bank. (Singapore) Ltd. (2018) SGHC4 11. Barclays Bank Plc. v. Quincecare Ltd. (1992) 4 ALLER 363. 12. Selangor United Rubber Estates v. Cradock (a bankrupt) (No. 3) (1968) I WLR 1555 at 1608. 13. Greenwoon v. Martins Bank Ltd. (1932) IRB 371 at 281 per Scrutton LJ). Legislation referred to: 1. re Dellow’s Will Trusts (1964) 1 WLR 451, 455. (No. 5) [1999] CLC 1469 AT 1541 (AFFIRMED CA [2001] Lloyds Reports Bank 36). 2. Modem Banking Law, 3rd ed. 2002 (GUP). Even the man on the Clapham Omnibus and, for that matter, any of his siblings, namely, ‘the right thinking member of society generally’, ‘the reasonable prudent person’, ‘the officious bystander’, ‘the reasonable parent’, ‘the fair-minded and informed observer’, ‘the reasonable landlord’, or indeed ‘the person having ordinary skill in the art’ - have good reason to be concerned about threats and challenges arising from the use of the internet generally, and the surge in online banking fraud, in particular. While online banking, especially that involving the use of electronic banking cards, has brought about considerable convenience in managing one’s finances any time anywhere, and promoting simplicity and speed in the payment for goods and J3 services, it has also brought about a different kind of challenge to banks and their account holders - a global challenge of vulnerability to online security threats. Internet banking frauds, perpetrated by fraudsters resulting in users’ account details being compromised and money siphoned off accounts, has generated difficult questions regarding the apportioning of responsibility and liability between banks and their customers; questions which are beyond the conventional ones arising from the traditional bank/customer relationship. In its legal bearing, the dispute in the present appeal speaks to that increasingly critical problem - a challenge for both the bank and the customer arising from internet fraud as it continues to afflict online users of bank cards. The dispute involves, on the one hand, a bank account and cardholder who woke up to an empty account and, on the other hand, a bank that denied culpability in any way. And so we are here faced with the challenging task of balancing the conflicting interests. The appellant’s version of events leading to the present impasse was that he had held a current account with the respondent bank at its Kabwe branch since 2013. He was in due J4 course issued with a Visa card which he had hoped to use to withdraw money from his account using the Automated Teller Machine (ATM); to make payments at points of sale terminals; to check his account status anytime, anywhere; and to make online purchases of goods and services. Upon being issued with the Visa card, the respondent, by way of testing its efficacy, used the card on an ATM and successfully withdraw K50, with a charge of K5 being debited to his account for that withdrawal. He also unsuccessfully attempted to purchase some medication online. When he reported that failed online transaction to the bank he was informed by a bank employee, whose name he could not recall at the trial of the matter, that internet transactions were not permitted on his account in order to protect the account from fraud. Later in time, and with a balance of K43,700-00 sitting in his bank account, the respondent travelled to Germany on a personal visit. While there he went to a bank with a view to withdrawing cash from his account using the Visa card issued to him by the appellant bank. To his astonishment, and probably J5 annoyance too, he was notified that he had insufficient funds in his account. Given the status of his account when he left it at the time he travelled to Germany, he surmised that either his bank card had been damaged, or there was something amiss with his bank account. This prompted him to contact his bank manager at the Kabwe branch of the appellant bank to ascertain the state of his account and the money that he assumed was still sitting in it. The bank manager’s response beggared belief. It was that his account was depleted. The respondent claims that he was forced to borrow money for the remainder of his stay in Germany. The respondent later came to learn that on diverse dates between 19th July, 2013 and 9th September, 2013, various online transactions, unauthorized by him (the offending transactions), were made through the Visa card linked to his account held with the appellant at its Kabwe branch. The respondent maintained, however, that he never used his card to transact, nor did he authorise any soul to use his said bank card or account. Upon his return to Zambia, he visited his bank where he was furnished with a complaint form, or something of the sort, J6 to complete, He duly filled in the form in which he indicated that he had never authorised any person to transact on his account the whole time since he received his bank card. Upon completing and handing back the form, he was advised that it would take 40 days to investigate the matter. As regards the investigations undertaken by Visa following the chargeback form completed by the respondent, the findings as was recounted to him by a bank official, were that some merchants never responded to complaints but that the transactions on the respondent’s account were performed successfully by persons in different locations. The investigation also revealed that the names of the persons who confirmed the transaction on the respondent’s account were different from that of the respondent. The respondent was refunded approximately KI,000. The appellant, for its part, had a slightly different narrative of the material events from that of the respondent. Its position was simply that the respondent had opened an account at its Kabwe branch, and having been encouraged to apply for a bank card, he did so on 8th February, 2013 and was subsequently J7 issued with Visa bank card. He made his maiden withdrawal with that card through an ATM on 1st March, 2013. Investigations by the appellant’s agents showed that the respondent had travelled to Germany in March 2013 and returned in April 2013, although he maintained that he never used his card during that period. The account statement, however revealed, according to the appellant, that the respondent had used his card to make withdrawals outside the country with an international charge of K15 reflecting on the statement. The appellant admitted that there was a distinct possibility that the respondent’s card could have been skimmed. With this difference as to what had transpired, the respondent attributed wrong doing to the appellant for debiting his account for the offending transactions. The appellant, for its part, denied any wrong doing by any of its officers or agent. This prompted the respondent to commence proceedings in the High Court, claiming a refund of the money he lost from his account arising from the offending transactions in the sum of K39,516- 00, interest and costs. J8 Sichinga J, as he then was, heard the evidence and received submissions from the parties’ legal representatives. He came to the conclusion that, as the offending transactions on the respondent’s account were done by persons other than the respondent, a prudent banker would not have authorized them in the way the appellant did. He accordingly found for the respondent and gave judgment accordingly. The appellant was aggrieved by that decision. It accordingly launched the present appeal, raising five grounds formulated as follows: 1. The court below erred in law and fact by shifting the burden of proof from the respondent to the appellant. 2. The lower court erred in both law and fact when it took the narrow view that only the respondent, as the VISA card holder, could pay for goods and services worldwide when anyone could do so provided they had access to the respondent’s VISA card and knew the VISA card details contained thereon. 3. The court below erred in both law and fact in holding that the respondent was entitled to the sum of ZMW38,491.38 as there was no specific finding as to whether or not the respondent had in fact proved his case on a balance of probabilities. J9 4. The lower court fell into error in both law and fact by formulating and directing its mind to the questions ‘whether or not the appellant owed the respondent a duty of care in making payments on his account' and ‘if it could be said that the appellant was negligent in making payments on the respondent’s account’ when the respondent did not plead or allege negligence on the part of the appellant nor supply any particular of negligence, [sic!] 5. The court below erred in law and in fact, by failing to uphold the provisions of the contract (VISA Application Form) between the appellant and the respondent. Through their learned counsel, both parties filed heads of argument upon which they principally relied. As regards ground one of the appeal, it was argued, on behalf of the appellant, that to the extent that the court below suggested that where a defendant’s explanations are improbable or unacceptable, liability would have been established, it reversed the burden of proof which should throughout rest on the plaintiff. The specific statement in the judgment of the lower court that the appellant’s counsel took issue with, reads as follows: The standard of proof in civil proceedings is on a balance of probabilities. The plaintiff in his evidence testified that the defendant did not protect his account against fraudulent conduct. He pleads that the defendant’s conduct was illegal and J10 caused his loss. I thus require clear and cogent evidence before making any finding. In the case of re Dellow’s Will Trusts (1964) 1 WLR 451, 455, Ungoed-Thomas expressed the requirement of the burden of proof in the following terms: The more serious the allegations the more cogent is the evidence required to overcome the unlikelihood of what is alleged and thus to prove it. On the converse, I also take on board the principle that if a defendant’s explanations are inherently improbable or unacceptable, then liability would have been established with the rejection of those explanations (see Group Torras SA v. Al-Sabah (No. 5) [1999] CLC 1469 AT 1541 (AFFIRMED CA [2001] Lloyds Reports Bank 36). Counsel submitted that the position postulated by the learned lower court judge in the passage we have quoted above, did not represent the correct legal position in this jurisdiction. The correct legal position, according to Mr. Sitimela, is as we articulated it in Khalid Mohamed v. Attorney-General2, namely that even where a defence fails, a plaintiff must still prove his case. By reason of adopting an approach which contradicts the attitude of this court in Khalid Mohamed2, the lower court judge was unduly swayed to reject the appellant’s evidence. This, according to counsel, is because he effectively shifted the burden of proof from the respondent, as the party that was making the Jll claim on to the appellant, resulting in the rejection of the appellant’s testimony that no other person than the respondent conducted transactions on the respondent’s account. To support this submission further, counsel quoted a passage from our judgment in the case of Sobek Lodges Ltd. v. Zambia Wildlife Authority3 where we stated, among other things, that: The burden of proof is fixed at the beginning of the trial by the state of the pleading, and it is settled as a question of law, remaining unchanged throughout the trial exactly where the pleadings place it, and never shifting in deciding which party asserts the affirmative, regard must be had to the substance of the issue and not merely to its grammatical form, the latter the pleader can frequently vary at will. The learned counsel then quoted from the endorsement on the respondent’s writ of summons, the relief he sought in the lower court before submitting that the respondent did not adduce any evidence to prove that claim. He further submitted that it was incumbent upon the respondent at trial to prove first, that the Visa card issued to him was not activated for online or any other banking transactions, and second, that the online transactions J12 in question were illegally authorized by the appellant. The respondent, according to Mr, Sitimela, failed to do so. The learned counsel brought out points of evidence - more specifically, the conflict in that evidence. He observed that the record indicates a finding by the lower court that although the respondent denied being in Germany in March or April, 2013, there was no evidence before the court as to where the respondent was during that period. In other words, the respondent failed to account for his whereabouts. On the other hand, the appellant’s witness (DW2), had testified that investigations had indicated that the respondent had travelled out of the country during the period March to April and had used his card during that time because the record of transactions reflected an international transaction charge of KI5. According to Mr. Sitimela, this evidence was crucial to the respondent’s case in the lower court and the court should thus have placed premium on it, particularly that the respondent admitted having been in Germany when he discovered that his account had insufficient funds to enable him transact as he J13 wished. The evidence on record, in counsel’s view, showed that the respondent was regularly out of the country. We were urged to uphold ground one of the appeal. As regards ground two, the appellant’s learned counsel contended that the trial judge was wrong to have adopted, what counsel describes as, a narrow view that only the respondent, as the Visa cardholder, could pay for goods and services worldwide when the truth, according to counsel, is that anyone with access to the respondent’s Visa card and/or knew the card details could do so. Counsel also submitted that this was a perfect instance in which this court should interfere with the lower court’s findings of fact as the circumstance for such interference as they were articulated by the Court of Appeal, predecessor to this court, in the case of Nkhata and 4 Others v. Attorney-General4, were present. The learned counsel referred us to Condition 2.3 of the Visa Electronic Debit Card Terms and Conditions, which obliged the card holder to take all reasonable precautions to prevent unauthorized use of the card, including not allowing anyone else to use the card. J14 Mr. Sitimela suggested that the lower court should have taken judicial notice that anyone with access to a Visa card and its details, was capable of successfully transacting on the cardholder’s account. He complained that these factors do not appear to have been considered by the lower court. As long as the Visa card remained in the possession of the respondent and was not reported stolen as provided for by Clause 2.5 of the Visa card terms and conditions, the appellant was contractually bound to debit the respondent’s account with the amount authorized for any transaction. Counsel went on to submit, with verve, that as the transactions in question could well have been done by anyone that had access to the respondent’s Visa card and its details, it was vital for the respondent to have established his whereabouts during the period of the transactions in question. His failure to do so must be to his detriment. Mr. Sitimela also referred to condition 5.2 of the Visa card terms and conditions which states that where a card holder disputes a transaction debit, the card holder must prove that the transaction was not authorized, whether or not the slip or J15 voucher was signed. Counsel also pointed to specific aspects of the evidence on record, and more particularly, the evidence of Pinzya Butambo Sikasula, a witness for the appellant, before submitting that the respondent’s Visa card was used in all the offending transactions, meaning in effect that the appellant had no reason to be suspicious of those transactions, and in fact had no choice but to honour its contractual obligation to debit the respondent’s account. Mr. Sitimela also contended that it was not possible for the appellant or its agents to have employed the traditional safeguards used to confirm transaction since, with the automated system, transactions are done without any interface between the bank and the customer. He also referred to a web­ based source, speaking to the duty to authenticate the identity of the transaction maker in online banking. We can state right away that we do not have much regard for that source as authority for the issues before us. Counsel also quoted a passage from the learned authors of Modern Banking Law on the nature of electronic purses. That authority does no more than merely state the resemblance J16 between physical cash and electronic or digital cash in terms of their ability to satisfy payment obligations. We were implored to uphold ground two of the appeal. With respect to ground three, Mr. Sitimela’s argument was substantially similar to that made under ground one. He submitted that the lower court should not have found that the respondent was entitled to K38,491.38 as there was no specific finding as to whether or not the respondent had in fact proved his case on a balance of probabilities. Counsel submitted that the learned judge in the court below based his finding on the appellant’s failed defence or ‘improbable explanation.’ He reiterated the same argument that he had made in respect of ground one that a failure of a defendant’s defence does not result in the automatic success of a plaintiffs case. The plaintiff must prove his case regardless of the fate of the defence. He again cited the case of Khalid Mohammed v. Attorney-General2. He additionally referred to Jennipher Nawa v. Standard Chartered Bank Zambia Plc2 whose holding was to the same effect. Counsel enjoined us to uphold ground three of the appeal. J17 Under ground four, the challenge to the lower court’s decision was on a procedural point. Counsel argued that the lower court should never have formulated and directed its mind to the question whether or not the appellant owed the respondent a duty of care in making payments on the respondent’s account, and making the finding of negligence on the part of the appellant. This is because the respondent never alleged or led any evidence of negligence. Counsel argued that an allegation of negligence ought to be pleaded. He relied in this regard on the case of Becmocs Ltd. v. AON Zambia Ltd. and Goldman Insurance Ltd.6. According to Mr. Sitimela, the endorsement on the respondent’s writ of summons shows that the respondent did not plead negligence. The court below, accordingly, fell into error on a point of procedure by delving into the question whether or not the appellant had been negligent. Alternatively, it was contended by Mr. Sitimela, that even assuming that the court could infer negligence from the pleadings, as it did, the respondent would still not be entitled to judgment. This is because the test of negligence in a typical banker-customer relationship dictates that a banker can only be J18 liable if he pays funds from the customer’s account out of the ordinary course of business. The case of Indo-Zambia Bank Ltd. v. Lusaka Chemist7 was cited as authority for this submission. According to the learned counsel for the appellant, nothing on the record could have put the respondent bank on inquiry with respect to the online transactions on the subject account as the respondent’s credentials were used throughout for the offending transactions. Mr. Sitimela also implored us to note that the respondent’s bank card had never been reported stolen or otherwise missing. The court should never, in those circumstances, have inferred negligence. He urged us to uphold ground four of the appeal. Ground five accuses the lower court judge of having failed to uphold the provisions of the contract between the appellant and the respondent with respect to the Visa card. It was contended that the Visa Electronic Debit Card Terms and Conditions were part of the binding contract between the appellant and the respondent and its terms ought to have been upheld by the court in keeping with the court’s understanding of the public policy around the concept of freedom to contract as J19 explained in Colgate Palmolive Inc. v. Shemi and Others8. That policy is to uphold contracts freely and voluntarily entered into between men of full age and understanding. According to Mr. Sitimela, the Visa card conditions that should have been upheld by the court below were in clause 3.2 which provides that: The card holder must take all reasonable precautions to prevent un-authorised use of the card including not allowing anyone else to use the card. And, in clause 4.2 which states that: If the Bank issues a PIN, the cardholder must take all reasonable precautions to avoid unauthorized use, including destroying the PIN mailer issued by the bank promptly after receipt, never disclosing the PIN to someone else, never writing the PIN on the card or any other item normally kept with the card, never writing the PIN in a way that can be understood by someone else. Mr. Sitimela submitted that the court below failed to establish whether or not the respondent had met or observed those conditions. The learned counsel submitted generally to the obligations of the parties under the Visa card terms and conditions and ended by urging us to uphold ground five of the appeal as well. J20 Both Mr. Sitimela and Mr. Msidi did orally augment the heads of argument filed on behalf of the appellant as we have summarised them. When Mr. Sitimela took the stand to orally supplement the heads of argument he, rather apologetically, announced that his oral augmentation of the arguments already presented in the heads of argument, was necessitated by the fact that since the appellant’s preparation and filing of its heads of argument, this court had decided the case of Barclays Bank Plc. v. Patricia Chipepa9 which, in his view, puts into proper legal perspective, many issues in dispute in the present appeal. In a manner reminiscent of repetition and circumlocution, Mr. Sitimela submitted that the court below proceeded in a way that appeared to shift the burden of proof from the plaintiff in that case to the defendant, contrary to what this court stated in the Chipepa case9. In that case, according to Mr. Sitimela, where a customer of a bank denies having authorized a transaction on his/her account, the bank has to prove two things, namely (i) that the Personal Identity Number (PIN) was used and (ii) authority was given by the customer to the bank. He submitted further that in the present case, the security credentials of the respondent’s Visa card were keyed in for the offensive J21 transaction and hence the success of the transactions in question. The acts of entering the PIN and, authorizing the transaction occurred simultaneously. The respondent in this case, according to Mr. Sitimela, satisfied the two-tier test as set out in the Chipepa case9. On the whole, the learned counsel in effect repeated the submissions he had made in the heads of argument, except this time he made constant reference to the Chipepa case9 which, he suggested in his submission, decided against what the lower court did. Mr. Msidi also made brief oral arguments by way of argumentation to the arguments on ground two. His submission was that as the record clearly showed, the appellant’s card was at all material times in the possession of the respondent. The only reasonable inference that could be made was that only the person in possession of the card and had the security details, in this case the respondent, could have transacted. The imputing of the onus of proof on the appellant by the lower court was, therefore, according to counsel, wrong. He joined Mr. Sitimela in the fervid prayer that we uphold the appeal. J22 Mr. Kabesha, learned counsel for the respondent, relied entirely on the heads of argument as filed. He expressed certain fears and wishes regarding the fate of bank card users generally but echoed his reliance on the heads of argument in responding to the specific arguments on appeal. The response to ground one of the appeal was that the lower court did not shift the burden of proof as claimed by the appellant in their submissions, from the respondent (as plaintiff in that court) to the appellant (defendant in that court). Accordingly, the legal position as articulated by this court in Khalid Mohamed v. Attorney-General2, was neither undermined nor purportedly changed. According to Mr. Kabesha, all that the lower court did was to state that where a defendant in his defence is inherently improbable or puts up unacceptable explanations, the liability will have been established with the rejection of the defendant’s explanation. The lower court, went on Mr. Kabesha, had paid close attention to the evidence before it and assessed whether the appellant had sufficiently rebuffed the respondent’s evidence in support of the claim. He referred us to the documentary evidence of the appellant in the record of appeal in the form of an airline facsimile and other transaction reports, all J24 Turning to ground two of the appeal, again Mr. Kabesha supported the holding of the trial court, maintaining that there was no error in either law or fact when the court took the position that only the card holder could transact. According to counsel, the court below rightly asserted that there was an implied term in the agreement between the parties that only the card holder - or more specifically, the account holder - was to, and not had to, pay for goods and services worldwide. In this regard, counsel cited clause 3.1 of the Visa terms and conditions, as supporting the position taken by the court. A proper construction of that clause, argued Mr. Kabesha, states that the card holder must be involved, not necessarily himself/herself in person, but must in any case authorize each transaction. There was no evidence provided that the respondent authorized the transactions in question. What is on record, according to counsel for the respondent, is a denial by the respondent that he ever authorized those transactions, and there was no rebuttal to that denial. The final submission of the learned counsel on this ground was that there was no evidence provided that any other person J25 had access to the respondent’s Visa card details. However, some details or information was likely to be known by the respondent bank staff as was acceded to by the respondent’s witness (DW2). Mr. Kabesha referred us to the lower court’s judgment where the trial court recorded thus: DW2 said he was aware that banks also committed fraud. The learned counsel implored us to dismiss ground two of the appeal. Regarding ground three of the appeal the respondent’s response was brief. Mr. Kabesha submitted, with remarkable confidence, that the ground cannot succeed as the case law on the burden and standard of proof was correctly reviewed by the lower court judge before he came to the conclusion that the respondent was entitled to the sum of K38,491.38. Counsel referred us to the finding of the court that it was curious that five or six persons were able to present the respondent’s card details to transact for various services, none of which benefited either the bank or the respondent. The court went further to make a finding of fact that the respondent’s card had been used by other persons. J26 Senior counsel Kabesha submitted that although the law takes the position that a plaintiffs case does not automatically succeed when a defence collapses, where the collapse of the defence strengthens the plaintiffs claim, as was the case here, the plaintiffs case should all the more succeed. Counsel reiterated that the respondent had proved his claim in the lower court. He prayed that ground three be dismissed, too. Turning to ground four, Mr. Kabesha argued that there was no error on the part of the trial judge in finding, as he did, that it would be reasonable to expect a bank not to debit the cardholder’s account without further verification. According to counsel, the court did not err to infer negligence from the pleadings. Counsel also pointed to the generic relief plea in the statement of claim, where the respondent had sought ‘any other relief the court may deem fit.’ Mr. Kabesha prayed that we dismiss ground four of the appeal as well. As regards ground five of the appeal, counsel argued that the terms and conditions of the Visa card did not oblige the appellant to debit the card holder’s account even in the face of reasonable suspicion regarding a transaction. Those terms and J27 conditions, according to Mr. Kabesha, only set out the obligations of the card holder which only benefits the bank. The card conditions are silent on issues of fraud or invasion of the cardholder’s account. Counsel urged us to dismiss ground five. He prayed that the whole appeal be dismissed for lacking merit. In his very brief reply, Mr. Msidi reiterated that this case involved virtual transactions that could be performed by anyone, anywhere, provided they had the cardholder’s credentials. It would defeat the efficacy of the electronic system if at every turn the bank was expected to confirm a transactions before authorisation. He reiterated the prayer that had been made earlier. We are grateful to counsel for their effort. As we pointed out at the beginning of this judgment the increase in cybercrimes being perpetrated through online banking scams whereby fraudsters impersonate account and cardholder, have brought about difficult legal issues not the least of which is to decide which party between the bank and the customer has to bear the risk of the fraud. We cannot at this stage, even consider how to J28 assign liability against fraudsters who often hide under the cloak of anonymity It is of course beyond argument that a bank is under a legal duty to exercise reasonable care in executing a customer’s instructions on the customer’s account. This position is confirmed by numerous authorities including Barclays Bank Plc. v. Quincecare Ltd.11. That duty must, however, generally speaking, be subordinate to the bank’s other conflicting contractual duties. Where a bank receives valid and proper instructions, it is prima facie bound to honour them promptly on pain of incurring liability for consequential loss to the customer. Where the bank executes payment/debit instructions knowing them to be fraudulently given while shutting its eyes to all the red flags that may be raised, or acting recklessly in failing not to make such inquiries as an honest and reasonable man would make, the bank would be plainly liable. To us this case has raised an acute problem of proof where it is undeniable that something unusual and detrimental to the bank customer has occurred on his card-linked account; something that could easily bring about a loss of confidence in J29 the online banking system as much as it is liable to bring about financial losses and raise reputational risk issues for the banks. To what degree can proof of one party’s wrongdoing be established where a third party fraudster is involved or suspected to be involved? On a proper conspectus of all the circumstances, as we understand them from the record of appeal and the arguments of counsel, it seems to us that the evidence adduced to fortify the claims of either party to this appeal is not conclusive. We say this because the respondent, as plaintiff in the lower court, was not able to conclusively point in definite terms to any specific wrongdoing by way of actions or omissions on the part of the appellant bank as the reason for the loss of money from his account. All that was established was that money in his account was withdrawn with the sanction of the appellant. At whose instance and under what circumstances, the respondent was unable to say with certainty, let alone prove conclusively. What is, however, not disputed is that the appellant was the custodian of the said account at all material times and sanctioned the debiting of the account as it is in fact obliged to do when instructions in regular form are received by it. J30 On the part of the appellant, it was not conclusively established that either the respondent transacted on his account resulting in the unauthorised debits, or that he authorized or recklessly facilitated any other person to undertake any of the offensive transaction on his account using his bank card or details, or indeed that someone else came in possession of his bank card credentials and transacted without the respondent’s authorization. In short all evidence provided by the respective parties came short in its conclusiveness and specificity in identifying who perpetrated the offensive transactions and how they were done. Yet, both parties agree that there was a problem with the respondent’s account. Liability has to lie somewhere - whether with the bank or with the customer. In other words we have to hold that, on a preponderance of evidence, the fault lay with either the bank or with the customer. There has, in either case, to be a cogent basis for apportioning such liability. We shall later in this judgment address this issue which we view as overarching in this appeal. Before doing so, however, we wish to appraise the specific arguments advanced in respect of each of the grounds of appeal. J31 Under ground one, the question is whether the learned High Court judge did in fact shift the burden of proof from the party obliged to prove allegations of impropriety to the party defending itself against those allegations. It is of course beyond peradventure that the burden of proof in civil matters lies with the plaintiff or the party alleging, to prove his case on a balance of probabilities. Authorities on this point are legion and no useful purpose will be served to cite them here, save to note that the parties’ learned counsel have referred to some of them in their submissions. In the present case, it was incumbent upon the respondent, as plaintiff in the court below, to prove his claim. That claim is properly set out in the writ of summons and statement of claim. It was for a refund of K39,516.00 in respect of the offensive transactions on his account. What the respondent needed to do to succeed in recovering that money from the appellant, however, was to establish that the appellant had wrongfully caused or facilitated the wrongful transactions on his account which resulted in those monies being debited to his account. J32 Paragraph 3 of the statement of claim, perhaps sums up what the respondent, as plaintiff, needed to prove. That paragraph states as follows: 3. The Defendant [appellant] without the authority from the plaintiff [respondent] on diverse dates but between 19th July 2013 and 9th September, 2013 allowed online purchases by unknown user(s) using the plaintiffs Visa card No. 4960430190010313 notwithstanding the fact that the defendant had earlier advised the plaintiff that online purchases were not allowed by the defendant. To understand whether the respondent did or did not discharge that burden requires one to break down and identify precisely what aspects of paragraph 3 of the statement of claim the respondent needed to prove; what evidence was adduced at trial in respect of those aspects requiring proof and the weight to be attached to that evidence. And so we ask: did the appellant, without the authority from the respondent, on diverse dates allow online purchases by unknown users on the appellant’s visa card? The starting point, and before considering whether there was sufficient evidence deployed by the respondent [plaintiff] to prove this aspect, is to note that the appellant denied the J33 averments in paragraph 3 of the statement of claim (this is in paragraph 2 of its defence). The evidence of the respondent at trial, as recorded by the lower court judge - which we have summarised earlier in this judgment, was that the respondent did not authorize anyone to withdraw money or use his account for any transaction. He called the manager of the appellant to complain about the state of his account. That evidence was not challenged. In fact, it was complemented by the evidence of the respondent’s witness (DW2) who confirmed that the several transactions were made on the respondents account and ‘it was suspected that the plaintiffs card was skimmed.’ DW3, for his part, confirmed that the offensive transactions were performed by persons whose names were not those of the respondent. The next facet of the respondent’s claim in paragraph 3 of the statement of claim calls for an answer to the question; were online purchases done on the respondent’s visa card No. 496043019001313. The answer is obviously yes, and the appellant produced in the lower court, transaction reports of J34 online activity on the respondent’s account using the respondent’s card details by persons other than the respondent. The final issue that required proof by the respondent of his claim as set out in paragraph 3 of the statement of claim should address the question whether the respondent had ever been told that online purchases were not allowed by the appellant? The appellant denied this allegation in paragraph 2 of its defence. In his evidence in chief, however, the respondent stated as follows: When I opened the account, I went online to buy some medicine but the transaction failed. When I went back they informed me that they were protecting my money from internet fraud... In cross-examination on the point, the respondent replied as follows; I wanted to buy medicine but transaction failed. I went to the bank to get help. I never used card for online transaction after attempts failed. Bank said they could not allow transaction for safety. I can’t remember his name. The issue of the bank’s advice to the respondent was not spoken to by any of the appellant’s witnesses in the court below. J35 And so, on the foregoing evidence, we again ask the question whether the respondent had discharged the burden of proving that his account, to which his Visa card was linked, was with the sanction of the appellant used by persons other than himself, without his authority during the stated period, resulting in the loss of the sum of money he was claiming? From the analysis of the claim and the evidence we have done, we are inclined to give an affirmative answer. In our considered view, when the lower court weighted the evidence, as we have set it out above, offered by the respondent to support his claim, in the absence of any direct, cogent evidence by the appellant, contradictory to that of the respondent, or which so diminished or undermined the respondent’s evidence as to lessen its weight, it was bound to come, as it did, to the conclusion that the claim of the respondent (plaintiff then) had been proved. The argument by the learned counsel for the appellant including those structured around the Chipepa case9 are therefore inapropos. We are in this regard in total agreement with the submissions made by the learned counsel for the respondent J36 that in making the statements in its judgment, which the appellant’s learned counsel suggested amounted to a reversal of the burden of proof, the lower court was merely stating that, so improbable and unacceptable was the appellant’s explanation that it left the respondent’s evidence totally unscathed. We do not, however, agree with Mr, Kabesha’s submission that the rejection of the appellant’s evidence by the trial court, proved the respondent’s averments independently of what the appellant’s witnesses said. The respondent had, in our view, proved his averment quite unaided by what the appellant’s witnesses said. We hold, therefore, that there was no holding by the lower court that the burden of proof was reversed. The appellant’s grievance under ground one is without merit. We dismiss it accordingly. Under ground two, the appellant’s complaint was that the view taken by the lower court judge was narrow given that any Visa cardholder could transact anywhere, anytime using the card, provided he had access to the card and its details. In specific terms, the learned judge held that; J37 In my assertion, there is an implied term in the agreement that only the cardholder or more specifically the account holder is the one that may pay for goods and services worldwide. On the facts of this case the plaintiffs account was presented by at least five to six other persons besides the plaintiff.[sic!] Of course, we have to agree with the learned counsel for the appellant on this ground. Regardless of what the terms of the Visa card agreement provided, where account details are compromised or the cardholder’s credential are shared with third parties by the cardholder , any person that obtains the card and its details would be enabled to transact on the cardholder’s account. In the statement of the learned judge as quoted, the impression portrayed was that because the agreement only allowed the cardholder to use it, only he and no one else could have used it. Naturally it would defy logic if one attempted to apprehend how the respondent’s card and account were used by other people. We think that ground two has merit, and we are bound to uphold it. Under ground three the appellant is grumbling about the holding by the lower court that the respondent was entitled to J 38 the sum of K38,491.38 which he lost as a result of the unauthorized debits on his account. Clearly, the response to this particular issue should follow our consideration of the basis or lack of it, for holding one of the two parties liable for the loss. The same applies to the appellant’s grievance under ground four where it raises the issue of liability for unpleaded negligence. Turning to ground five, we must state that it is unclear to us how the lower court did not uphold the sanctity of the contract created upon completing and signing the Visa application form between the appellant and the respondent. Our perusal of the lower court’s judgment shows that the learned lower court judge had paid due reverence to the Visa contract, if we are to call it that, and did not sanction the undermining or non observance of any of its provisions. What we can also state without hesitation, is that the unauthorised transactions such as occurred on the respondent’s account were by logic and necessary implication done outside the provisions of the contract. Criminals use all manner of tricks, including malware to steal bank customer’s online credentials, or they highjack J39 accounts in a manner that is beyond the ability of both the bank and the customer to contain. Breach of the Visa card contract could properly only be pleaded and sufficiently established where sufficient evidence exists that the customer failed to keep or maintain his/her card in accordance with the terms of its issue. As we pointed out earlier on, in the present case no such evidence was adduced nor was any plea in that regard made by the respondent. The upshot is that ground five has no merit and is hereby dismissed. We now revert to the issue that we had raised before we started traversing the appeal ground by ground. It is the question of the basis upon which liability for losses arising from online banking fraud should be attributable to one and not the other of the two parties in the absence of direct, conclusive evidence as to what wrong the party may have committed and the details of any such wrong. More importantly we have to identify whether such wrong is tortious or contractual. And here we are fully alive to the need for the law not to foist too onerous an obligation on banks which would shackle, as Mr. Msidi becried in his submission, the effective transaction of online banking business unnecessarily. On the other hand, the law J40 ought to guard against the abatement of fraud. It should thus demand a reasonable standard of care in order to combat online fraud to protect bank customers and innocent third parties. We think that to hold that a bank is only liable when it has displayed a lack of probity would be much too restrictive an approach. On the other hand, to impose liability on a bank whenever speculation might suggest that dishonesty has been perpetuated with a resultant loss on a customer’s account would be to impose wholly impractical standards on banks. It is beyond argument, however, as we have earlier on stated, that a bank is under a positive common law duty under its contract with its customer to exercise reasonable care and skill in canying out its part with regard to operations of its contract with its customer (per Ungoed-Thomas J in Selangor United Rubber Estates v. Cradock12), to protect its customer from fraud. A bank owes a duty to its customers to take necessary steps to prevent unauthorized withdrawals from the customer’s accounts. As a corollary, there is no difficulty in holding that if a customer suffers loss on account of the transactions not authorized by him; the bank is liable to the customer for the said loss. (See Greenwoon v. Martins Bank Ltd.13). J41 As far as online banking is concerned, we think it is the bank’s responsibility to secure the online channel so as to create a safe electronic banking environment to combat all forms of malicious conduct resulting in loses to their customers. Between the bank and its customer, it is the bank that has the key to the safe as it were, and sits in a vantage position to control who for, and when, to open the safe door. With its wherewithal, the bank is better placed to examine what it is doing from an online banking security point and take inventory of potential risk areas and address them. Our considered view is that it is incumbent upon banks such as the appellant in this case, to be generally more proactive and address the threat of fraud more strategically. The bank must, as a reasonable man would expect, be ahead of the curve through regular upgrading of its infrastructure so as to always improve the way in which it processes instructions to make payment via the online banking systems. Failure to do so is a breach of duty implied in the contract subsisting between a bank and its customer. On closer reflection, therefore, we think these are good legal reasons for the bank to be held responsible. It is for the foregoing reasons that we believe liability should in this case lie with the bank. Grounds three and four of the appeal are without merit and must fail In the ultimate, this appeal fails. The judgment of the lower court is upheld save for the finding by that court that the implication of the agreement between the appellant and the respondent (as cardholder) is that only the latter could in fact use it. We award costs to the respondent to be taxed if not agreed. MALILA SUPREME COURT JUDGE J. K. KABUKA N. K MUTUNA SUPREME COURT JUDGE SUPREME COURT JUDGE