Centenary Bank has admitted its customer lost millions of shillings in ATM fraud, a revelation that sheds light on the growing cases of financial fraud hitting Uganda’s commercial banks.
It all started on January 16 with a customer identified as Angella Caroline Idoot threatening to sue Centenary Bank for illegally deducting money from her account number 2120044*.
Idoot had earlier on October 17, 2019, received a call from a one Mackline, a staff of Centenary Bank, informing the custom of suspicious online transfers being made on her account.
Idoot extracted a bank statement which showed “various illegal transactions” amounting to Shs 1.8m.
Idoot’s lawyers told Centenary Bank’s management that the customer made a formal complaint to the financial institution’s branch at Nakivubo on October 18, 2019 but “never obtained any assistance from any of your employees but rather arrogant replies from them asserting that she misused her card.”
“This is therefore to demand that the said transactions be reversed and all monies returned to our client’s account by close of business on the 20th day of January 2020 to avoid further escalation of this matter,” lawyer Bernard Banturaki said on behalf of Idoot.
In its response dated February 6, 2020, Centenary Bank admitted that Idoot is “a bank customer who signed up for the ATM card service and the same was availed to her. The customer was given a pin number which she would use to transact on her account using her ATM card.”
The bank’s Secretary Peninnah T Kasule further wrote: “The bank duly conducted an investigation into the circumstances complaint of alleged unlawful/illegal deductions on her account to a tune of Shs 17m and discovered that the suspicious transactions that were made on the customer’s account amounted to Shs 8.8m of which Shs 5.4m was confirmed as illegal transactions.”
Kasule said Shs 5.m was refunded by the bank to the customer while Shs 3.3m was declined by the financial institution because they are genuine transactions (deductions) conducted by the card holder (customer).”
The bank’s failure to refund Shs 3.m has since attracted fury from Idoot, saying Centenary “did not clarify how proven illegal transactions were possibly occasioned to our client’s account.”
Idoot also denied conducting any transactions amounting to Shs 3.3m, saying the bank should “bear the responsibility to totally remedy your mess.”
“In your letter, you also indicated that you had attached a statement thereon yet no physical statement was actually attached. We find your conduct to be a veiled attempt to cover up internal fraud in your bank.”
This development comes at a time banks are facing major fraud hits by cyber fraudsters who work closely with bank staff.
Police last week arrested six suspects to help investigations into the hacking of aggregator Pegasus Technologies Ltd, leading to the theft of billions of shillings from commercial banks.
MTN Uganda said Pegasus Technologies Ltd on 3 October 2020 “experienced a security breach that impacted Bank 2 Wallet transfers.”
The apprehended suspects include 3 Nigerians who live in Kampala; two employees of Pegasus Technologies and a hacker who was found in Munyonyo.
According to Bank of Uganda, ATM and credit fraud occurs when a stolen or cloned card is used by criminals to withdraw cash from a customers’ account.
The fraud takes various forms. A bonafide customer may be accompanied by a close friend or even a relative to an ATM point to withdraw cash. In the process the relative or friend may learn the PIN number of the card and subsequently steals the card and withdraws the money from the bank without the knowledge of the customer.
In more sophisticated cases, fraudsters mount cameras and other gadgets on ATMs and steal or capture the details of the card plus the PIN as it is entered, make a copy of the card and withdraw funds using the obtained details. These gadgets are cleverly disguised to look like normal ATM equipment or leaflet/brochure holders.
In other instances criminal gangs or employees obtain the particulars of a credit card through imaging techniques when being used to pay for goods and services and use the information to clone a fraudulent card which is then used to defraud the holder of the card.
To protect against such frauds, customers are advised to memorise their PINs and never to write it down or share it with any other person.
Customers also are encouraged to desist from the habit of giving cards and PINs to other people to withdraw money on their behalf.
Nevertheless, Idoot wants a full investigation regarding all the questioned transactions on her account and know “who did the illegal deductions”.
She also wants a review of CCTV evidence that she conducted the disputed transactions and a payment of Shs 10m as compensation for the inconvenienced caused to her by the bank’s “internal frauds.”