KERALA STATE CONSUMER DISPUTES REDRESSAL COMMISSION,

VAZHUTHACAUD, THIRUVANANTHAPURAM

APPEAL No. 686/2015

JUDGMENT DATED: 29.10.2024

(Against the Order in C.C. 423/2010 of DCDRC, Thiruvananthapuram)

PRESENT:

HON’BLE JUSTICE SRI. B. SUDHEENDRA KUMAR            : PRESIDENT

SRI. AJITH KUMAR D.                                                                 : JUDICIAL MEMBER

SRI. RADHAKRISHNAN K.R.                                                     : MEMBER

APPELLANT:

HDFC Bank, T.C. 8/1225, Pongumood Branch, Medical College P.O, Thiruvananthapuram-695 011.

(By Adv. G.S. Kalkura)

                                                Vs.

RESPONDENT:

John Kurian, Thanal, BN-284, Mahila Samajam Road, Bapuji Nagar, Thiruvananthapuram-11.

(By Adv. Jayakrishnan D.)

JUDGMENT

HON’BLE JUSTICE SRI. B. SUDHEENDRA KUMAR  : PRESIDENT

The appellant is the opposite party and the respondent is the complainant in C.C. No. 423/2010 on the files of the District Consumer Disputes Redressal Commission, Thiruvananthapuram (for short “the District Commission”).

2.  The contention of the respondent/complainant is that the respondent opened a bank account with the appellant bank on 06.07.2002 and he opted for net banking facility from 08.07.2002 onwards.  The respondent had been using the net banking facility since 08.07.2002.  The respondent was having the customer ID and password for online transaction.  While so, on 03.01.2008, the respondent received an e-mail alert seeking the account details.  The said e-mail alert was having the logo of the appellant.  The respondent immediately informed the appellant through e-mail about the suspicious e-mail received by the respondent.  On 06.01.2008, when the respondent was in Dubai airport, he checked his e-mail.  Then he got a message from the appellant that an amount of Rs. 4,95,000/- (Rupees Four Lakh Ninety Five Thousand only) was transferred  from the account of the respondent to another HDFC account in the name of Mr. Deepak.  The respondent immediately informed the incident to the appellant through e-mail.  The money was transferred to another account in the control of the appellant.  However, the appellant did not do anything to stop the withdrawal of the money by the fraudster.  Therefore, the fraudster withdrew the money on 07.01.2008. The valuable opportunity to block the fraudster from enjoying the fruit of the fraud was lost by the inaction of the appellant.  Thereafter, by virtue of the power of attorney given by the respondent to the appellant, FIR was registered and the above said Deepak was arrested.  The respondent had been asking about the recovery/refund of the money illegally transferred from his account.  He also requested to take legal action against the fraudster.  However, the appellant did not take any step against the fraudster.  Finally, the respondent issued a legal notice and thereafter filed the present complaint alleging deficiency in service on the part of the appellant.

3.  The appellant filed version admitting that the respondent had an account in the appellant bank since 06.07.2002 and the respondent opted for net banking facility from 08.07.2002 onwards.  The appellant would contend that the respondent received a fake mail on 03.01.2008 seeking for the account details of the respondent.  When the matter was informed, the appellant had sent a reply immediately alerting the respondent not to respond to the said e-mail.  Thereafter, on 05.01.2008, the money was transferred from the account of the respondent to the account of Mr. Deepak, the fraudster.  On the same day, the said Deepak had withdrawn the said amount from his account at Mumbai by way of cheque.  Thereafter, on the request of the respondent, the account of the respondent was blocked.  Though the appellant had taken earnest efforts to recover the amount from the fraudster, the appellant could not recover the amount as the money was already withdrawn by the fraudster.  It is further contended by the appellant that the guidelines for alerting the internet fraud had been already issued and categorically displayed at a conspicuous location on the website by the appellant. The customer is expected to observe certain safeguards prescribed by the bank when the customer avails net banking facility.  The respondent was aware that the customer identification and the net banking password are confidential in nature and should not be revealed to any third party either intentionally or unintentionally.  While carrying out the net banking transaction, the respondent himself was responsible for his own acts and deeds.  The respondent is to answer as to how the stranger could use the ID and the password of the respondent to do the net banking transaction.  The respondent was well aware that the internal control of the appellant bank was very much secured.  It is manifestly a known phenomenon that any transaction done through net banking could only be known to the customer and not to the bank.  The respondent was well educated and was employed in Dubai, who used to utilize the net banking facility very often.  In spite of the efforts put in by the bank, the respondent had, due to the probable negligence on his part, appeared to have parted with his customer identification and password for the net banking to a third party.  The respondent had the liberty to block the TPT facility by himself through net banking.  The respondent did not also request the appellant to block the net banking facility immediately on receipt of the fake message.  The appellant had no role, whatsoever, in controlling the customer’s account except carrying out the instructions of the customers.  The respondent had provided the password and other details of his net banking facility to the fraudulent mail, knowing fully well that the same was a fraudulent one.  The appellant had given all assistance to the respondent for the recovery of his money which he had transferred to another account due to his own fault and negligence.  On 06.01.2008, the respondent/complainant made a request, after the occurrence of the incident, to block his net banking. However, the respondent did not make any such request at any time before that.  Though it was a Sunday, the bank had immediately arranged to block the account of the respondent/complainant.  The bank had also advised the respondent to file complaint before the Police.  As far as the security of the bank’s website is concerned, the bank had adopted adequate safety measures.  The appellant confirms that the website of the appellant was secured from the risk of hacking as the bank had adopted latest security standards. 

4.  The respondent/complainant was examined as PW1 and Exhibits P1 to P9 were marked for the respondent.  DW1 was examined and Exhibits D1 to D14 were marked for the appellant.  After evaluating the evidence, the District Commission found that there was deficiency in service on the part of the appellant and directed the appellant to pay Rs. 4,95,000/- (Rupees Four Lakh Ninety Five Thousand only) with interest till realization.  The District Commission also ordered to pay Rs. 20,000/- (Rupees Twenty Thousand only) as compensation and Rs. 5,000/- (Rupees Five Thousand only) as costs.  Aggrieved by the said order, this appeal has been filed. 

5.  Heard.  Perused the records.

6.  The learned advocates on both sides have advanced argument supporting their respective contentions.

7.  It is not disputed that the respondent/complainant received Exhibit P1 message through e-mail on 03.01.2008, seeking for disclosing the details of the account of the respondent.  The respondent, on 04.01.2008, informed the matter to the appellant as per Exhibit D2(a) e-mail.  From Exhibit D2 (a), it is clear that the respondent was aware that Exhibit P1 was a deceptive mail.  On 04.01.2008 itself, the appellant sent Exhibit D2 (b) mail to the respondent stating that Exhibit P1 was a deceptive mail.  Thereafter, the respondent sent Exhibit P2 mail to the appellant on 05.01.2008 stating that one person, namely, Deepak was added as an additional beneficiary in the account of the respondent.  Thereafter, Exhibit P3 e-mail was sent by the respondent on 06.01.2008 to the appellant stating that there was a transfer of Rs. 4,95,000/- (Rupees Four Lakh Ninety Five Thousand only) from the account of the respondent to the account of the said Deepak, the fraudster, by net banking.  Exhibits P2 and P3 are documents included in Exhibit D3 series, marked for the appellant.  Exhibit P4 is the letter sent by the respondent to the Manager of the appellant.  It is stated in Exhibit P4 that following an alert, from HDFC alert service, received on 06.01.2008 to the e-mail account of the respondent, the respondent noticed that his saving account had been hacked through the internet and a sum of Rs. 4,95,000/- (Rupees Four Lakh Ninety Five Thousand only) had been withdrawn through TPT facility by a person, namely, Deepak.  It is further stated in Exhibit P4 that the said Deepak had successfully put his account into the TPT facility of the respondent and made the transaction.  The respondent also requested the appellant to block the TPT facility of the respondent with immediate effect.  Exhibit P4 and Exhibit D4 are one and the same document.  Exhibit D5 is a letter sent by the respondent to the appellant on 11.01.2008.  It is clearly stated in the said letter that the abovementioned fund transfer was not initiated by the respondent; but was carried out by using the customer ID and password illegally acquired from the respondent by means of phishing attack/mail or through such other illegal means. 

8.  The learned counsel for the respondent has argued that even though the respondent had forwarded Exhibit P1 fraudulent e-mail to the appellant, the appellant did not incline to take any step to avert the incident and hence there was deficiency in service on the part of the respondent in this regard.  The learned counsel for the respondent has further argued that even though the respondent had informed the appellant about the fraudulent fund transfer, the appellant did not take any step to prevent the withdrawal  of the amount by the fraudster from the account of the fraudster, even though the fraudster was also having the account in the bank of the appellant and the appellant had got sufficient time to prevent the withdrawal of the amount by the fraudster at Mumbai and in the said circumstance also, there was deficiency in service on the part of the appellant.  The learned counsel for the appellant, on the other hand, has taken us through the evidence and argued that there was no deficiency in service at all on the part of the appellant in the present case.

9.  Exhibit D2(a) is the e-mail sent by the respondent to the appellant on 04.01.2008 informing the appellant about Exhibit P1 e-mail.  Exhibit D2(b) is the reply sent by the Manager of the appellant bank on 04.01.2008 itself.  In Exhibit D2(b), the appellant had clearly stated that Exhibit P1 mail was a deceptive mail.  Exhibits D2(a) and D2(b) were admitted by PW1 during his cross-examination. The respondent did not make any request to block the net banking facility and TPT facility at any time prior to Exhibit P4 letter dated 06.01.2008. The respondent had the liberty to block the TPT facility by himself through net banking.  Since the respondent did not request for blocking the account, that was not done by the appellant.  However, the appellant had warned the respondent that it was a deceptive mail and hence not to respond. That apart, the respondent himself had clearly stated in Exhibit D5 that the bank had taken best efforts to give all assistance to the respondent.  The above discussion would make it clear that the argument of the learned counsel for the respondent in this regard is devoid of merits. 

10.  As per the averments in the complaint and the averments in the affidavit filed by the respondent, the fraudster had withdrawn the money from the account of the fraudster only on 07.01.2008.  However, it appears from Exhibits D10 and D12 that the amount was transferred to the account of the fraudster on 05.01.2008 and on the same date itself, the said amount was withdrawn.  To say precisely, the amount of Rs. 4,95,000/- (Rupees Four Lakh Ninety Five Thousand only) was deposited in the account of the fraudster by transfer at 12.50 pm on 05.01.2008 and out of the said amount, an amount of Rs. 4,50,000/- was withdrawn at 1.02 pm and the remaining amount was withdrawn at 1.36 pm by cheque on the same day.

11.  Exhibit P4 is the letter whereby the respondent informed the bank about the fraudulent transfer of money from his account and the subsequent withdrawal of the same from the transferee’s account. Exhibit P3 would also mention about the fraudulent transfer of money from the account of the respondent. Exhibit P3 and Exhibit P4are dated 06.01.2008.  The respondent had contended in the complaint that on 06.01.2008, when the respondent was in Dubai, he got information with regard to the transfer of the amount by the fraudster from the account of the respondent on 06.01.2008.  However, Exhibits D10 and D12 would clearly show that the said amount had been withdrawn from the account of the fraudster on 05.01.2008 itself.  This would show that before the receipt of information by the bank from the respondent about the transfer of the amount by the fraudster from the account of the respondent, the amount transferred had been withdrawn by the fraudster.  It is admitted by PW1 himself that the customer ID and password are with PW1 alone.  It is further admitted by PW1 that if somebody uses the customer ID and password given by the respondent, the appellant bank would not be having knowledge about the same. In this case, the evidence of PW1 coupled with Exhibit D5 would clearly show that the fraudster had transferred the money from the account of the respondent by using the customer ID and the password illegally acquired from the respondent. In the said circumstances, the appellant bank was not having any knowledge about the transfer till the bank was informed about the transfer made by the fraudster by the respondent on 06.01.2008.

12. The appellant also filed a complaint before the Police as authorised by the respondent through the power of attorney of the respondent as the respondent was abroad. It is borne out from the evidence on record that the respondent did not have any grievance against the appellant till the respondent realized that, as the net banking system of the appellant bank was not hacked, the bank was not able to proceed against the fraudster to realize the amount lost by the respondent. The said fact is clearly reflected in Exhibits P5 and P6.  It is also clear from Exhibit D5 that the respondent had admitted that the bank had taken best efforts to give all assistance to the respondent.  Exhibit D5 was admitted by PW1. This being the fact, there is no substance in contending or arguing that the appellant did not do anything to prevent the withdrawal of the amount by the fraudster.  Though there was a feeble attempt to show that the fraudster was a staff of the appellant, DW1 vehemently denied the same. There is also no material at all on record to indicate that the fraudster was a staff of the appellant.

13.  The appellant had clearly contended in the written statement that the net banking of the appellant was not hacked as the appellant had sufficient security against hacking.  The respondent also does not have a contention that the net banking provided by the appellant was hacked.  The appellant would contend that the respondent, due to his negligent act, disclosed his customer ID and password to the fraudster to enable the fraudster to do the net banking transfer fraudulently.  The respondent in Exhibit P4 letter stated that an amount of Rs. 4,95,000/- (Rupees Four Lakh Ninety Five Thousand only) was transferred from the account of the respondent through TPT facility by Deepak and that the said person had successfully put his account into the respondent’s TPT facility and made the transaction.  Exhibit P4 and D4 are the same.  Exhibit D5 is a letter given by the respondent to the appellant wherein it is clearly stated that the fraudster had withdrawn the money from the account of the respondent by using the customer ID and password illegally acquired from the respondent by means of phishing attack/mail or through such other illegal means.  Exhibit D5 was admitted by PW1. The evidence of PW1 and Exhibit P4 coupled with the contentions of the respondent would clearly show that the net banking system of the appellant bank was not hacked.  On the other hand, a fraudulent transfer was made using the customer ID and password of the respondent.  It was admitted by PW1 himself that the customer ID and password were with PW1 alone.  It was further admitted by PW1 that if somebody had used the customer ID and password given by the respondent, the appellant bank would not be having knowledge about the same.  In this case, the net banking facility of the appellant was not hacked.  However, the money was transferred from the account of the respondent to the account of the fraudster.  Therefore, from the evidence on record, we are of the view that the bank was not at all responsible for the above said fraudulent transfer made by the fraudster.  In all probability, as contended by the appellant and admitted by the respondent in Exhibit D5,  the customer ID and password were obtained by the fraudster by means of phishing attack/mail or through such other means due to the negligence of the respondent and thereafter only, the fraudster could successfully use the TPT facility and effect the transaction.  From the evidence, it is clear that the appellant was able to give convincing explanation that their net banking system was not hacked in any manner.  The respondent also admitted the same.  Having gone through the relevant inputs, we do not find any fault on the part of the appellant in the incident whereby the respondent had lost an amount of Rs. 4,95,000/- (Rupees Four Lakh Ninety Five Thousand only) from his account.

14.  Any unauthorized transaction made by anybody would be the subject of criminal investigation only, as held by the National Commission in Punjab National Bank Vs. Lt. Col. Jagdeep Gahlot reported in 2014 STPL 8236 NC.  A crime was registered, on the basis of the First Information Statement lodged by the appellant on the strength of the power of attorney given by the respondent to the appellant, and the above said Deepak, the fraudster, was arrested. The investigation in the case is still going on.

15.  Having anxiously considered the relevant inputs, we are satisfied that there is no deficiency in service on the part of the bank in the case on hand. Therefore, the appellant is not liable to pay any amount to the respondent on this ground.  Consequently, the order passed by the District Commission in this regard cannot be sustained. 

In the result, this appeal stands allowed, setting aside order dated 30.05.2015 passed by the District Commission in C.C. No. 423/2010 and the complaint stands dismissed.  In the circumstances of the case, there is no order as to costs.

The statutory deposit made by the appellant shall be refunded to the appellant, on proper acknowledgment. 

JUSTICE B. SUDHEENDRA KUMAR: PRESIDENT

                                                                  AJITH KUMAR D. : JUDICIAL MEMBER

                                                                        RADHAKRISHNAN K.R.  : MEMBER  

jb