The High Court in Mbale has ordered United Bank for Africa (UBA) Limited to pay Shs108.23 million to a Ugandan worker whose compensation for injuries sustained while working in Afghanistan was withdrawn by an impostor who had allegedly opened a bank account in his name.
The court further awarded the plaintiff, Mazuno Micheal Wilson, Shs20 million in general damages, costs of the suit and interest at eight per cent on the awarded amounts from September 7, 2026, until full recovery.
In a damning judgment delivered electronically on September 7, 2026, Justice Lubega Farouq found that UBA acted negligently and fraudulently in the opening and operation of an account bearing Wilson’s name, allowing a person whose photograph did not correspond with the identity details to access more than Shs108 million.
The judgment arose from Civil Suit No. 006 of 2024, in which Wilson sued the bank over the loss of money that had been awarded to him as compensation following injuries he sustained while working for an American private security company in Afghanistan.
Impostor allegedly used Wilson’s NIN
According to the evidence before court, Wilson had been recruited on January 8, 2019, as an armed security guard with Trip Canopy Global Operations Inc., an American private security company operating in Afghanistan.
In 2020, he reportedly fell from a guard tower during his employment and suffered multiple injuries, including spinal damage, hearing impairment and psychological trauma.
Unable to continue working normally, Wilson pursued compensation from his former employer through lawyers before the United States Department of Labour’s Office of Workers’ Compensation Programs.
His lawyers later informed him that his claim had been settled and that a US$30,000 award had been approved and remitted to his bank account.
But when Wilson followed up on the money, he discovered that an account had allegedly been opened in his name at UBA months earlier.
The account, according to the judgment, was opened on April 22, 2023, using Wilson’s National Identification Number (NIN), but the photograph on the identification document presented at the bank belonged to a different person.
On August 10, 2023, the Shs108.23 million compensation money was deposited onto the account.
The money was subsequently withdrawn in two instalments on August 10 and 11, 2023.
Bank failed to verify photograph and address
The case turned heavily on the bank’s customer identification procedures.
Wilson accused the bank of failing to properly verify the identity of the person opening the account, obtain and scrutinise the original identification documents, verify the applicant’s details with the National Identification and Registration Authority (NIRA), confirm the physical address and independently comply with its Know Your Customer (KYC) procedures.
The court found the evidence particularly damaging on the question of identity verification.
A former UBA branch manager, Oryokot Joseph, testified that after the money had already been withdrawn, Wilson went to the bank to establish whether he had an account there.
The bank then discovered that an account existed in Wilson’s name but carried the photograph of a different person.
The bank subsequently attempted to trace the person using the physical address supplied during account opening, only to find that people in the area said they did not know anyone matching the identity provided.
The court also heard conflicting evidence from the bank.
While its witnesses maintained that KYC procedures had been followed, one of the bank’s witnesses conceded during cross-examination that the photograph on the applicant’s National Identity Card had not been verified.
The judgment notes that the bank also failed to verify the physical address before opening the account.
Justice Lubega held that these failures amounted to a breach of the bank’s duty of care.
“I find that the Bank breached the duty of care it owed to persons who were reasonably foreseeable victims of harm arising from such negligence.”
Shs108m withdrawn despite Shs15m daily limit
Perhaps the most striking aspect of the judgment was the court’s concern over how the entire compensation payment was withdrawn despite the account having a daily withdrawal limit.
The court found that the account had a daily withdrawal limit of Shs15 million, yet the impostor managed to withdraw the entire Shs108.23 million in only two instalments.
The court recorded the withdrawals as Shs85 million on August 10, 2023, followed by Shs23.23 million on August 11.
Justice Lubega said the circumstances should have raised immediate suspicion and prompted heightened scrutiny by the bank.
The account had been opened only a few months before receiving the large payment, and the funds were withdrawn almost immediately after being deposited.
According to the judge, these were “visible red flags” that the bank failed to act upon.
The court concluded that the bank did not exercise the requisite degree of care and good faith in opening the account or permitting the substantial amount to be withdrawn shortly after deposit.
Court finds bank acted fraudulently
The judgment went beyond negligence.
After examining the evidence, Justice Lubega found that the bank had acted fraudulently in opening the account without properly verifying the identity and physical address of the purported account holder.
The judge also found that the bank acted fraudulently in authorising the withdrawal of the entire amount despite the account’s daily withdrawal limit.
“I am satisfied that the Defendant Bank acted fraudulently in opening Bank Account No.0768025176 without properly verifying the identity and physical address of the purported account holder.”
The judge further found that the bank acted fraudulently when it authorised the withdrawal of the entire amount without proper justification.
The ruling also highlighted internal disciplinary issues involving bank employees connected to the account.
The court heard that two bank officials were reprimanded over their involvement in opening the account, while another employee, Job Ariebi, was dismissed.
The bank’s human capital witness, however, told court that Ariebi had been dismissed for receiving Shs6 million from a client within the vicinity of the bank’s premises, rather than specifically for the account-opening incident.
Justice Lubega nevertheless said the circumstances surrounding the employee’s dismissal could not be lightly disregarded.
UBA ordered to make good the loss
Although the court found that UBA did not itself take Wilson’s money, Justice Lubega held that the bank’s negligence and failures created the circumstances that enabled the impostor to access the funds.
The judge therefore ordered the bank to compensate Wilson for the entire Shs108.23 million loss.
The court additionally awarded Shs20 million in general damages after considering the trauma and distress suffered by Wilson, who had already sustained serious injuries at work and was forced to pursue recovery of his compensation.
The court noted that Wilson had difficulty walking and that the compensation intended for his workplace injuries had been obtained by an impostor exploiting weaknesses in the bank’s systems.
Wilson had sought Shs50 million in general damages, but the court awarded Shs20 million.
His claim for exemplary damages was rejected, with the judge holding that the bank had already been ordered to compensate him for the financial loss and pay general damages.
Court ruling sends warning on bank KYC systems
The judgment could have wider implications for financial institutions, particularly over the responsibility of banks to properly identify customers and detect suspicious transactions.
Justice Lubega held that a bank’s duty of care can extend to third parties who are not direct customers where the bank’s negligent or unlawful conduct causes foreseeable harm.
The court relied on a 2025 High Court decision involving Absa Bank, which held that a bank’s duty of care may extend to third parties under the neighbour principle where negligent, fraudulent or unlawful conduct causes injury.
In Wilson’s case, the court expressly found that UBA owed him a duty of care despite the fact that he was not a direct customer of the bank.
The ruling also stressed that financial institutions are legally required to establish the identity of clients and maintain procedures capable of detecting unusual or suspicious transactions.
Justice Lubega cited the Financial Institutions Act, which requires financial institutions to demand proof of and record the identity of clients when establishing business relationships, including when opening accounts.
The court also referred to anti-money laundering requirements concerning customer identification, ongoing monitoring and detection of unusually large or suspicious transactions.
Final award
Justice Lubega entered judgment in Wilson’s favour and ordered UBA Limited to pay:
- Shs108.23 million — money lost through the fraudulent withdrawal;
- Shs20 million — general damages;
- Costs of the suit; and
- 8% interest on the Shs108.23 million and Shs20 million from September 7, 2026, until full recovery.
The judgment was delivered on September 7, 2026, bringing the total principal compensation and general damages awarded against the bank to Shs128.23 million, before costs and accruing interest.
The case exposes the potentially costly consequences of failures in customer identification and transaction monitoring, particularly where a bank account opened in another person’s name becomes the vehicle through which a substantial payment is diverted to an impostor.
