When a hacker found and used the password of bank employee Shakil Pathan Ismail he was short-paid for a year while police investigated. Then the bank went under and the financial institution that took over its assets and liabilities ended the staffer’s employment while denying they were responsible to sort out the problem of his hack-related short pay. So how was he to get his money? – He headed to Uganda’s Commercial Court where Judge David Wangutusi came to the rescue.

Read judgment

For a year following a breach of cyber security at Uganda’s Crane Bank, staffer Shakil Pathan Ismail was drawn into the investigation. After his password and that of another member of staff were used in an electronic hacking fraud during August 2015, the investigators put his salary on hold, promising that it would be “reinstated” once the police inquiries were completed. But this never happened.

His salary account reflects what he said were unlawful deductions from his account, while for a whole year he was paid less than he should have been.

He waited patiently for the investigations to end, but nothing was ever repaid. How was he to get back the UGX 62,000,000/= ( approx. USD 16,500) that he claimed he was owed by Crane?

While he pondered the way forward, the fortunes of the bank had taken a dive. Claiming that Crane Bank was significantly undercapitalized, the Bank of Uganda took over management of Crane Bank and placed it under receivership. In January 2017 another financial institution, DFCU Bank, reached agreement with the central bank to take over some of the assets and liabilities of Crane. Among the excluded liabilities were terminal benefits and all other employment dues in relation to staff let go within two months of a certain date.

Ismail’s employment contract was assigned to the new bank and his contract was ended in January 2017. That prompted Ismail to go to court. Though his employment had come to an end he had still received no settlement of the deductions from his salary and he applied to court for an order that it be repaid.

DFCU argued that it was not responsible for the debt to Ismail and that liability lay with central bank because it had indemnified DFCU in the event of such claims. DFCU also said the claim was “entirely founded” on Ismail’s employment contractual rights and thus Judge David Wangutusi had first to decide whether the case was actually a labour dispute, in which case a complaint should have been made to a labour office.

The judge held, however, that the application concerned “a banker-customer relationship” and that he thus did have jurisdiction. For example, Crane had credited the account and then removed the money by way of internal transfer. Once the money was credited to an account “it now became an issue governed by banker-customer relationship laws”, and thus the “unauthorized removal of the money” was a proper subject for the commercial division of the high court.

He then found that in terms of the agreement between the central bank and DFCU, any court-sanctioned liability for repayment to Ismail would have to be reimbursed by the central bank to DFCU.

The records of Ismail’s account indicated that he was short of UGX. 62,000,000/= and the court sanctioned this award. But he also claimed general damages, though without specifying an appropriate amount. Judge Wangutusi said that taking into account the inconvenience experienced by Ismail in being deprived of part of his salary, the court would use its discretion to award him UGX. 20,000,000/= (approx. USD 5400) in general damages.

What about interest on these awards?

This is a part of Judge Wangutusi’s decision that any bank customer will enjoy reading. There was no doubt that the bank kept Ismail from access to his own money and that it used this money for commercial purposes, the judge said. Certainly, if Ismail had borrowed that money from the bank, he would have had to pay it back at the commercial interest rate. “What is good for the goose should also be good for the gander,” said Judge Wangutusi. “I find that since (the bank) must have used the money at commercial rate, it is only fair to treat (Ismail) in the same manner.”

The court thus ordered that the salary repayment should attract interest of 21 % per annum from April 2016 until it was paid in full. The general damages award, however, was to be paid at 6 % until settled in full, and the bank was also to pay the legal costs of Ismail’s litigation.

In addition to this satisfying end to the story, there’s an interesting side note.

At one point, MMAKS Advocates filed an application for Crane Bank (in receivership) to be added as a defendant in the case. The law firm had, however, represented Crane for several years before the bank went under and the court referred to this in rejecting the application: it was improper for the firm to bring an application such as this against its own client, the court ruled.

Judge Wangutusi said the principle had been settled in an earlier decision involving the same parties. In that case the court had found that MMAKS was involved in a conflict of interest because of the “canteen factor”. Even if the firm had many lawyers and the lawyer dealing with the current case did not personally handle the earlier cases, there would still be a “canteen factor” risk.

The court in this earlier case wrote: “Canteen factor in this case included social chat between colleagues or with client that gives away vital information. So, if the interaction is between one of the partners, it will be imputed to the others.”

Following that ruling, the court in Ismail’s case said it could not allow MMAKS to bring an application that the bank be added to the list of defendants.

  • Newsletter, Judicial Institute for Africa (Jifa), 28 February 2019