Bank liable for online frauds

Banks are duty bound to take steps to assess risk, provide robust mechanism to prevent, detect fraud

Thomas Ninad had a salary savings account with Axis Bank. Even though he was using the account regularly, he was was not getting any e-mail alerts, as the bank had made a mistake while entering his identity. Ninad had corresponded with the bank to correct his e-mail address. On January 1, 2013, he received an e-mail from the bank seeking various details. He furnished the information sought. After that, Ninad found that Rs 14 lakh was withdrawn from his account through 22 internet transfers on January 8 and January 9, 2013. The transfer were made to 12 different accounts, of which 10 accounts were with Axis Bank.

Since Ninad’s mobile had been mysteriously disconnected on January 8, he did not even get any SMS alert. He had visited Reliance Communication’s franchise who advised him to change the SIM card and assured that it would be activated within three hours but it did not happen. Ninad later found that his SIM card was activated in Hyderabad. Ninad lodged a complaint with the bank’s branch manager as well as at the head office. He also registered a first information report (FIR) with the cybercrime cell and the police station.

Jehangir B Gai

As his grievance was not redressed, Ninad approached the Banking Ombudsman, which directed Axis Bank to pay Rs 1.4 lakh and IndusInd Bank to pay Rs 2 lakh. Since the amount awarded was very low, Ninad had a legal notice issued. He also filed a complaint before the Central Mumbai District Forum against Axis Bank and Reliance Communications (RCom). He alleged negligence, as the bank had allowed withdrawals through internet transactions beyond the prescribed limit. He blamed RCom for disconnecting and allocating his number to some third party.

The bank said Ninad had disclosed confidential bank details to an anonymous mailer, which led to fraudulent transactions. Another defence was that data on Ninad’s old mobile handset were used by the fraudsters. The bank claimed the transferred amounts had been siphoned off by the fraudsters and questioned the consumer forum’s jurisdiction, as the dispute involved complicated facts. The Forum dismissed the complaint. Ninad appealed to the Maharashtra State Commission, which observed saying that the dispute involves adjudication of complicated facts would not oust the jurisdiction of the consumer courts. It noted banks are duty bound to take steps to assess risk, provide a robust mechanism to prevent and detect fraud and also to provide for liability arising out such fraud. The Commission also considered the Reserve Bank of India’s  circular, dated July 7, 2017, regarding limiting liability of customers in unauthorised electronic banking transaction.

By its judgement dated August 7, 2017, delivered by Justice A P Bhangale for the Bench along with D R Shirasao, the State Commission held that the onus of proof to establish a customer's liability would lie upon the bank in all cases of the online internet transactions. A bank must show that it had taken immediate steps to prevent or detect fraud. Accordingly, it ordered Axis Bank to re-credit Rs 14 lakh to Ninad’s account within one month, or along with 9 per cent interest if delayed. It also awarded costs of Rs 20,000.

(The author is a consumer activist)