A Western Cape man who lost R23,800 in unauthorised banking transactions after leaving his cellphone in an Uber has been told by the National Financial Ombud Scheme South Africa (NFO) that Nedbank cannot be held liable for the loss.
The complainant, whose phone was stolen on January 25, 2026, disputed the bank's position that criminals accessed his banking profile using his existing credentials.
However, in an assessment dated June 24, 2026, the ombud found no evidence of negligence or maladministration by Nedbank and concluded that the complainant's claim for reimbursement should be pursued against the account holder who received the stolen funds.
The decision leaves the complainant with an outstanding loss of R19,800 after only R4,000 was recovered.
Six unauthorised transactions in 31 minutes
According to the documents submitted to the ombud, the complainant had travelled in an Uber on January 25, with the trip ending at approximately 1.53pm.
He said he immediately realised that he had left his cellphone inside the vehicle, but the driver had already departed before he could retrieve it.
The complainant said he repeatedly attempted to contact the driver within minutes of the trip ending but received no response.
The first disputed transaction took place at 5.41pm, almost four hours after the phone went missing.
Six transactions were processed between 5.41pm and 6.13pm, amounting to R23,800.
These included two R2,500 send-money transactions, two R2,500 prepaid voucher purchases, a R9,800 payment to an account held at Access Bank and a R4,000 payment to another Nedbank account.
The complainant reported the incident to Nedbank at approximately 8.47am the following day, January 26, after which his banking profile was suspended.
The bank said it contacted Flash and Access Bank in an attempt to recover the money. It managed to secure R4,000 from the account that received the payment.
Complainant questions how banking security was bypassed
In his response to Nedbank's submission, the complainant maintained that he had not authorised the transactions and questioned how criminals could have accessed his banking profile.
He said his cellphone was protected by biometric authentication, with a PIN as a backup, and that he had neither written down nor shared the PIN with anyone.
He also maintained that he had not stored banking passwords on the device and that his Nedbank Money App had additional two-factor authentication.
The complainant argued that Nedbank's explanation that his device and login details had been compromised did not establish how the security measures had been bypassed.
He further questioned why the bank's fraud-monitoring systems had not flagged the six transactions, which involved multiple payments and voucher purchases over a short period.
According to the complainant, the unusual transaction pattern should have prompted additional verification or intervention before the money was lost.
He also told the ombud that another individual had contacted him about an allegedly similar incident involving a phone left in an Uber and unauthorised banking transactions. He said that incident had reportedly occurred two days before his own.
The complainant raised the possibility that the incidents could point to a pattern of criminal activity targeting Uber passengers.
However, the documents do not establish that the two incidents were connected.
Nedbank says transactions used existing credentials
In its response to the complaint, Nedbank said the disputed transactions were conducted through the complainant's existing banking profile and credentials after criminals gained access to his cellphone.
The bank said there was no evidence of a password reset or SIM swap before the transactions took place.
Its records indicated that the Money App profile had been enrolled on a Samsung device on April 22, 2025.
Nedbank also confirmed that it had recovered R4,000 and said it had offered the complainant a once-off goodwill payment of R9,700 as a settlement gesture.
The complainant rejected the offer, arguing that it was made without an admission of liability and required him to sign a full and final settlement agreement.
He maintained that the amount was insufficient to cover his outstanding loss of R19,800.
According to the ombud's assessment, the offer had subsequently expired and was no longer available.
Ombud finds no evidence of bank negligence
The NFO said it had considered the submissions from both parties and accepted, on a balance of probabilities, that fraudsters had accessed the Money App through the stolen cellphone.
It noted that the disputed transactions took place before the complainant notified the bank of the theft and fraud.
The ombud said it had not found evidence that Nedbank's systems had been hacked or that bank employees had been involved.
It also said the available evidence did not establish negligence or maladministration by the bank in relation to the compromise of the complainant's banking credentials.
The assessment acknowledged that the sequence of events suggested the credentials had been compromised but said the ombud could not determine how, when or under what circumstances this had happened.
The ombud added that banking credentials could be compromised days or even weeks before unauthorised transactions occurred.
It concluded that the evidence did not provide a basis to hold Nedbank responsible for the loss.
Money had already been withdrawn or redeemed
The assessment also detailed what happened to some of the stolen funds.
Information obtained from Access Bank showed that the account receiving the R9,800 payment was credited on January 25 at 6.40pm. The money was subsequently used for withdrawals between 6.41pm and 7.55pm that evening.
The two send-money transactions processed at 5.41pm and 5.48pm were successfully redeemed at 5.53pm and 5.54pm, respectively.
The ombud noted that the funds had been used before Nedbank was informed of the incident.
It said the complainant appeared to be a victim of a crime and that his claim for repayment lay against the beneficiary of the account that received the money, rather than Nedbank.
The ombud explained that investigating or prosecuting the beneficiary account holder fell outside the scope of its role in resolving disputes between banks and their customers.
Complainant advised to pursue legal action
The NFO concluded that it could not recommend that Nedbank refund the complainant's total loss because it had found no evidence of negligence or maladministration by the bank.
It advised that the complainant could pursue legal action against the beneficiary account holder to recover the funds.
The assessment explained that banking confidentiality rules prevent the bank from simply disclosing the beneficiary's identity. The complainant would need to obtain a subpoena under section 205 of the Criminal Procedure Act to compel the bank to release the relevant account-holder information.
The ombud said the complainant was not bound by its outcome and that a court could be better placed to resolve disputes of fact where oral evidence and expert testimony might be required.
The matter was closed, although the NFO said it would consider any new, relevant and substantial information that could change its finding.
sinenhlanhla.masilela@iol.co.za
IOL News