Cybercrime Complaint In 3 Days Means' Zero Liability' For Victim, Rajasthan HC Orders IDBI Bank To Refund Rs 58 Lakh

In a case hearing regarding a fraudulent transfer of Rs 58 lakh from a customer's account, the Rajasthan High Court held IDBI Bank accountable and affirmed 'zero liability' on the customer.

Justice Anoop Kumar Dhand referred to the Reserve Bank of India (RBI) circular dated July 6, 2017, which established the customer's zero liability because he reported the fraudulent transaction within three days. The court held the petitioner (the customer) not at fault as he informed the Bank within the stipulated time frame, as per the Live Law report.

The court said, "As per the RBI circular dated 06.07.2017 in such like matters, the complaint is required to be made within three working days, while in the instant case, the complaint was made on the next day of fraud which is prior to the stipulated period."

What Is Zero Liability?

According to the RBI circular, "A customer's entitlement to zero liability shall arise where the unauthorised transaction occurs in the following events:

• Contributory fraud/ negligence/ deficiency on the part of the bank (irrespective of whether or not the transaction is reported by the customer).

• Third-party breach where the deficiency lies neither with the bank nor with the customer but lies elsewhere in the system, and the customer notifies the bank within three working days of receiving the communication from the bank regarding the unauthorised transaction.”

The court observed negligence on the part of the Bank and directed it to pay the entire amount to the petitioner within three months along with 6 per cent interest per annum effective from the December 13, 2022, the date of order of the Banking Ombudsman.

Brief Background:

• The petitioner has an overdraft (OD) account linked with his current account with IDBI Bank, where the OD limit was Rs 1.39 crore.

• On February 11, 2022, and the intervening morning of February 12, 2022, Rs 58. 93 lakh were transferred from the OD account to third parties.

• The petitioner lodged the complaint with the IDBI Bank within 48 hours and has also sent an application to the RBI Banking Ombudsman to return the amount stolen from his account by third parties.

• On December 13, 2022, the Ombudsman directed the Bank to pay Rs 15 lakh to the petitioner.

• As the stolen amount was much higher than the amount directed to be returned, the petitioner approached the high court seeking the return of the full amount stolen.

Arguments:

The counsel of the Bank first argued to reject the petition because Ombudsman and the service provider were not impleaded as party respondents.

The counsel also argued that several messages were sent to the customer on his mobile, but he did not reply, and thus, the money was transferred, leaving the Bank not liable for these transactions. The petitioner has not provided email address, therefore, the Bank could not send him emails regarding the transactions. Further, the Ombudsman has heard all these facts before passing order in December 2022 to pay back a partial amount. Therefore, the petition should not be accepted.

The petitioner's counsel argued that the Ombudsman is a 'persona designata' (a person described as an individual as opposed to a person ascertained as a member of a class, or as filling a particular character) who passed an order for the complaint submitted. So, it is not necessary to implead the Ombudsman as a party in the case.

The counsel further argued that the petitioner's SIM card was missing and not inserted in the phone, and thus, he has not received any message from the Bank. So, he (the petitioner) is not at fault.

The Court Observation:

The court noted, "Since the petitioner's mobile SIM was inactive or compromised, he had no means of receiving information about the fraudulent transactions made from his current account. Upon discovering that his SIM was not functioning, the petitioner promptly contacted the service provider to resolve the issue. Thus, he acted without any delay by reporting the matter to the respondent bank."

It observed, "Despite the petitioner's prompt intimation regarding the fraudulent transaction, the respondent bank failed to demonstrate any sense of urgency or exercise due diligence. This reflects a clear negligence on their part, in discharging of their duty to act swiftly upon receiving notice of the fraud. No immediate steps were taken by the respondent to initiate a chargeback, retrieve the funds, or freeze the suspicious accounts, thereby failing to prevent the petitioner's money from being illegal and unauthorizedly transferred to unknown accounts."

The court said that it is the banks' responsibility to safeguard its customers' interests and protect their accounts. A bank cannot walk away from this responsibility.

"Any systematic failure, whether by malfeasance on the part of its functionaries or by any other person (except the customers/account -holder), is its responsibility and not of the customers", held the court while also noticing the failure of the Banking Ombudsman to look into the whole 'gamut of controversy' and ignoring the material aspects and RBI's circular on zero liability.

The Court Order:

It set aside the order passed by the Banking Ombudsman and directed IDBI Bank to pay the entire amount to the petitioner along with interest.

The court highlighted the need to spread cybersecurity awareness among people. 

It said, "It is right and high time to launch a public campaign through print, electronic, social media, television, and FM radio, ensuring that awareness is spread every hour, every day, to reach the general public" and directed the order to be forwarded to the Department of Finance and RBI for taking necessary and suitable measures to safeguard customers from such frauds.