1.      This Revision Petition is filed under Section 58 (1)(b) of the Consumer Protection Act, 2019 (the “Act”) against the order of Goa State Consumer Disputes Redressal Commission, Panaji (‘the State Commission’) dated 31.03.2023 in First Appeal No. 78 of 2018, wherein the State Commission allowed the Appeal and set aside the Order of the District Consumer Disputes Redressal Forum,  South Goa at Margao, (“District Forum”) dated 05.07.2018 in C.C. No.23 of 2018 wherein the complaint was dismissed.

2.      For convenience, the parties are referred to as in the complaint before the District Forum. Vibhav Real Estate through its Partners Vibhav Parkar and Smt. Surekha Parkar are referred to as the complainants and Union Bank of India (Earlier Corporation Bank) is denoted as the Opposite Party (OP).

3.      Brief facts of the case, as per the Complainant, are that the complainant is a partnership firm holding a Current Account No. 510101001310002 with the OP Bank. The complainant’s registered mobile number for online transactions, 9822120629 belonging to partner Mr. Vibhav Parkar, received messages on 23.08.2017 about two unauthorized transfers totalling Rs.9,00,000. These transfers were split into two payments of Rs.4,50,000 each, sent to accounts held by Mr. Deepannita Hownik and Mr. Jaiswar Amardev Kumar.  The Complainant immediately disputed these transactions, filed a police report, and sought a refund from the Bank. Despite an assurance from the Bank Manager to process the refund, no action was taken, resulting in financial loss and mental stress for the complainant who sent a legal notice to the Bank demanding refund of Rs.9,00,000 with 18% interest per annum from 01.09.2017, Rs. 10,00,000 as compensation for harassment, Rs. 15,000 for legal costs and miscellaneous expenses but no avail. Being aggrieved, the complainant filed a Consumer Complaint before the District Forum.

4.      In Written Version before the District Forum, the OP contended that the registered mobile number associated with the account for online transactions was actually 9970472024 and not 9822120629.  The OTPs for the disputed transactions were sent to 9970472024, which was the complainant’s registered number. The Bank noted that on 19.08.2017, the complainant requested a SIM replacement for this number. The fraudulent transactions occurred after this SIM changed and the complainant may have played a role in the transactions. There was no fault or negligence on its part, as the Bank followed the correct procedures and the OTPs were sent to the registered number. There was no promise of refund by its manager and they traced the funds to their final recipients. The Bank contended there was no deficiency in service and requested the dismissal of the complaint.

5.      The District Forum, vide its Order dated 05.07.2018 dismissed the complaint with the following reasons:

“26. In the case at out hand, the bank had sent SMS to the Complainant on the registered mobile. There is no evidence to show that the Complainant had intimated to the bank that his registered mobile number should be changed from 9970472024 to 9822120629. In that background, the Opposite Party was not bound to send SMS on Mobile No. 9822120629. The Complainant has also not brought anything on record to show that the bank in fact has sent any SMS to said No. 9822120629. Since it is the case of the Complainant that SMS was sent on said number it was for the Complainant to prove the same. The Complainant has failed to prove the same. The decision in the case of Thomas(supra) is, therefore, not applicable to the facts of the case at our hand.

27. For the reasons discussed hereinabove, based on material on record and for want of sufficient evidence, it is not possible to decide whether there was any deficiency in service on the part of the Opposite Party. No compensation, therefore, can be awarded to the Complainant.

Issue is, accordingly, answered in the negative.

24. For the reasons discussed hereinabove and findings reached at by us, the complaint is bound to fail. The Complainant is at liberty to approach appropriate Forum to seek their remedy. Hence we pass the following order:

O R D E R

    The complaint is dismissed with no order as to costs.”

6.      Being aggrieved by the impugned order, the Complainants filed Appeal No.78/2018. The learned State Commission vide order dated 31.03.2023 allowed the Appeal and set aside the order of the District Forum dated 05.07.2018 with the following order:

“4. On hearing the parties and having heard the Learned Counsels of both parties our observations are as follows:

1. The Judgement of the Hon’ble Supreme Court in the case reported in 2022 SCC Online SC 1017 in the matter of Arun Bhatiya v/s HDFC Bank ltd has held a person who avails of any service from a bank will fall under the purview of the definition of a ‘consumer’ under the 1986 Act. As a consequence, it would be open to such a consumer to seek recourse to the remedies provided under the 1986 Act.
2. The Appellants being the Complainant availed of services of OP Bank. The Appellant has categorised stated in paragraph 5 of the complaint stating about the unauthorised transactions in the respondents’ bank in respect of the account being held by the Appellant. This categorical statement has been admitted by the respondent in their Written Statement at paragraph 5 and 6 of the Written Version.
3. The Appellants categorically at Paragraphs 5 and 6 of the Complaint have alleged of unauthorised transaction in the said Account. These facts at Paragraphs-5 and 6 have been admitted. It is settled law that facts admitted need not be proved in evidence.
4.  The Counsel for the Appellant had pointed our attention to the RBI Circular bearing No. RBI/2017-18/15 DBR.No. Leg.BC.78/09.07.005/2017-18 dated 06/07/2017 which reads as

6   “Limited Liability of a Customer

(a) Zero Liability of a Customer

A customer's entitlement to zero liability shall arise where the unauthorised transaction occurs in the following events:

1. Contributory fraud/ negligence/ deficiency on the part of the bank (irrespective of whether or not the transaction is reported by the customer).
2. Third party breach where the deficiency lies neither with the bank nor with the customer but lies elsewhere in the system, and the customer notifies the bank within three working days of receiving the communication from the bank regarding the unauthorised transaction. On being notified by the customer, the bank shall credit (shadow reversal) the amount involved in the unauthorised electronic transaction to the customer’s.

The burden of proving customer liability in case of unauthorised electronic banking transactions shall lie on the bank”.

5. On reading the combined clauses of the said RBI guidelines it is crystal clear that the onus of proving an unauthorised transaction lies on the bank.

6.  On applicability on the facts of the matter, the Appellant informed about the unauthorised transactions on 23.8.2017 of the unauthorised transaction which happened on 21.8.2017 which is within 3 days as per the RBI Circular dated 6.7.2017.

7.  As such the consequences will have to follow, on reading clause 6 and 9 of the said RBI Circular, the customer notifies the bank within three working days of receiving the communication from the bank regarding the unauthorised transaction and on being notified by the customer, the bank shall credit the amount involved in the unauthorised electronic transaction to the customer’s account within 10 working days from the date of such notification by the customer.

8. The counsel for the Appellant has cited a judgement of the Honble National Commission in the matter of HDFC Bank Limited versus Jesna Jose reported in CDJ 2020 (Con.) Case No. 544 which reads at paragraph 11.

“The Petitioner-Bank cannot rely on arbitrary term:' and conditions to wriggle out of its liability towards customers and any such terms and conditions must be in conformity with the directions issued by the RBI which is responsible for safekeeping of the Banking Systems and maintaining checks and balances in the same. As per the RBI circular, zero liability will rest with the customer, where the deficiency lies in the banking system. The first unauthorized transaction took place on the 15.12.2008. Admittedly, the said transactions were observed by the Bank on 15.12.2008 itself The Complainant’s father was contacted only on 18.12.2008. Thereafter, on 20.12.2008, within three days of receiving information from the Bank the Complainant’s father notified the Bank that the transactions were unauthorized. In such circumstances, therefore, even if the deficiency was not with the Bank, but elsewhere in the system, the Bank will be held liable for all the 29 unauthorized transactions which were effected from 15.12.2008 till the card was hot listed, i.e. till 20.12.2008. The aforesaid RBI circular as well decision of this Commission in Punjab National Bank and Anr. V Leader Valves II (2020) CPJ 92 (NC), are both squarely applicable in the present matter. In Punjab National Bank and Anr. V Leader Valves II (2020) CPJ 92 (NC), this Commission while addressing the question of liability of a Bank in case of unauthorized and fraudulent electronic banking transactions, has observed as under:

The first fundamental question that arises is whether the Bank is responsible for an unauthorized transfer occasioned by an act of malfeasance on the part of functionaries of the Bank or by an act of malfeasance by any other person (except the Complainant/ account¬ holder). The answer, straightaway, is in the affirmative. If an account is maintained by the Bank, the Bank itself is responsible for its safety and security. Any systemic failure, whether by malfeasance on the part of its functionaries or by any other person (except the consumer/ account-holder), is its responsibility, and not of the consumer”

9.  The Counsel for the Respondent has raised a contention that the Mobile number operated by the Appellant for online transaction was 9822120629. We observed that the contention of the Appellant is that the factum of an unauthorised electronic transaction has not been disputed by the Respondent and as such we need not go into the nitty-gritty aspect of it. We also find that once the Consumer alleges a deficiency in service provided to the Consumer, and the Opposite Party does not dispute the same, we therefore need not go into the aspect that to which representative of the Opposite Party Bank has done the unauthorised electronic transactions.

10. Also, The contention of the respondent is that the respondent does not send the OTP for electronic transactions but the same is obtained from the Bangalore based web centre. We hold that the above contention is devoid of any substance since these are technical aspects within the working of the bank and the consumer cannot be held liable for the manner of internal functioning of the bank. We observe that it is duty of the bank to preserve and protect the account of its customers from such unauthorised transactions. The consumer holds their hard earned money in trust with the bank and this trust with the bank should kept with honestly and sincerely. Today we live in a world where online fraud, unauthorised transactions arrive and therefore consumers ought to be vigilant of their accounts maintained in banks.

11. We have to bear in mind that when a Consumer/ Complainant deposits or invests their hard earn money into the account of the bank, it is the bounden duty of the bank to protect and safeguard the bank accounts of its Customers from any fraudulent or unauthorised transaction. Additionally, we observe that the banks have to strictly abide to the RBI circular issued to the bank from time to time and follow such rule or circular in “letter and spirit’.

12. In the present matter, the Respondent bank has miserably failed to abide with the RBI circular dated 06/07/2017 and therefore we quashed and set aside Judgement dated 05/07/2018 passed by the District Commission, South for the reason stated herein above:

ORDER

1. The Appeal is allowed.

2. The Impugned Order dated 05/07/2018 is quashed and set aside.

3. The Respondents are directed to pay a sum of Rs.9,00,000/-(Rupees Nine Lakhs only) with interest at 7% from date of Legal Notice 14/11/2017 (being date of Legal Notice) within 30 days of pronounced of this Judgement.

4. Along with compensation Rs.15,000/- (Fifteen thousand only) to be paid to the Appellant.

5. An amount of Rs.10,000/- (Ten thousand only) as litigation cost to be paid within 30 days.

6. Pronounced in open court.

7. Proceedings in the matter stand closed.

8. Pronounced on 31/03/2023, ready on 10/04/2023.”

7.      In his arguments, the counsel for the petitioner/OP reiterated the grounds taken in the Revision Petition and contended that the complainant was negligent in managing the account securely. The registered mobile number for OTPs was 9970472024 and not 9822120629. As per OTP records, OTPs for all disputed transactions were sent exclusively to the registered mobile number. The complainant was aware that their registered mobile number was compromised, as stated in the police complaint filed on 24.08.2017, that an unknown party had deactivated the SIM linked to mobile number 9970472024. Further, on 19.08.2017, the complainant requested a SIM card change for this number with Bharti Airtel, acknowledged via email. This sequence confirms that the complainant prior knowledge of the compromised security and lack of timely action to protect their account. After the complaint, the Bank took immediate actions to restrict further loss. On 23.08.2017, the Bank emailed Saraswat Bank, Thane requesting freeze on the suspected fraudulent account. Saraswat Bank subsequently froze the beneficiary’s account on 24.08.2017 and informed Axis Bank, where the funds were transferred, to place a lien on the amount. These actions indicate that the OP Bank acted responsibly and in good faith, contradicting any claim of service deficiency. He relied on of Union of India Vs Justice Ram Naresh Thakur and Ors, 1994 (2) CPC 195 NC.  The ruling emphasized that mere allegations are insufficient for relief; claimants must produce concrete evidence to substantiate claims. This principle supports the Bank's assertion that the complaint lacks sufficient proof of the Bank’s deficiency. He further relied upon the judgment of SBI v. A.G.I. Switches and Ors, 1999 (2) CPJ 37 NC upholding that compensation cannot be awarded without concrete evidence proving the claimed losses. He argued that the claims for damages lack evidence. RBI Circular dated 06.07.2017 stipulates that losses due to customer negligence, such as sharing credentials, are borne by the customer until the unauthorized transaction is reported to the bank. The complainant failed to secure the registered mobile number and did not promptly notify the Bank. OP Bank took timely action to prevent further losses. There is no deficiency in service that has been established.

8.      Per contra, the learned Counsel for the complainants argued in favour of the impugned order passed by the State Commission.  He sought to dismiss the present Revision Petition with costs.

9.      I have examined the pleadings and associated documents placed on record, including orders of the learned District Forum and the learned State Commission and rendered thoughtful consideration to the arguments advanced by learned counsels for the parties.

10.   The primary issue in this case revolves around determining the liability, if any, of the OP Bank for unauthorized transactions conducted through internet banking (INB) from the Account of the complainants-Respondents. Key contentions include whether:

A. The OP Bank was negligent in allowing online transactions from the complainant’s Account with OTPs from Mobile No 9970472024 as against 9822120629 allegedly registered by the complainant?

B. The OP Bank adhered to RBI guidelines on customer protection in unauthorized electronic banking transactions?

C. The OP Bank adequately demonstrated the burden of proof on authenticity of transactions and was there any negligence on the part of Complainants in securing their banking credentials.

11.    It is undisputed position that the complainant held Current Account No. 510101001310002 with OP Bank. It is the contention of the complainant that the registered mobile number of the complainant for online transactions was 9822120629. It belonged to its partner Mr.Vibhav Parkar, who on 23.08.2017 received a message about two unauthorized payment transfers of Rs.4,50,000 each totalling Rs.9,00,000. These transfers were made to the accounts held by Mr.Deepannita Hownik and Mr.Jaiswar Amardev Kumar. They immediately disputed these transactions, filed a police report, and sought a refund from the Bank. While the Bank Manager assured process for refund, no action was taken and thus the complaint. On the other hand, the OP asserted that the registered mobile number for online transactions was 9970472024 and not 9822120629. Accordingly, OTPs for the disputed transactions were sent to 9970472024. It is the contention of the OP Bank that on 19.08.2017, the complainant requested a SIM replacement for this number. The fraudulent transactions occurred after this SIM changed and the complainant may have a role in the transactions. There was no negligence as the OP Bank followed correct procedures and the OTPs were sent to the registered number. No promise of refund was ever made by its Bank Manager and they traced the funds to their final recipients.

12.    It is the contention of the complainant that he received messages of Bank transactions from the account on Mobile No. 9822120629 on 23.08.2017 about two unauthorized payment transfers of Rs.4,50,000 each totalling Rs.9,00,000. The complainant asserted that while the messages of transfer were received, no OTPs were received on that number. On the other hand, the OP Bank contended that the complainant’s registered mobile number for the online transactions was 9970472024 and not 9822120629 and accordingly OTPs for the disputed transactions were sent to 9970472024. Upon discovering the transactions not authorized by the complainant, he immediately reported to OP Bank and a police complaint (FIR) was also lodged. It is not clear as to how OTP was sent to mobile No. 9970472024 and transaction messages were sent on 9822120629. The learned Counsel for the Petitioner/ Bank argued that the complainant was negligent in handling their account security, as the SIM change and knowledge of potential compromise were known to him and documented. They took immediate action to freeze the suspected account to prevent further losses, demonstrating their proactive approach.

13.    As regards liability of the Appellant bank with respect to the loss due to such unauthorised transactions, it is clear that as part of modernization of banking facilities, transactions by individuals with respect to their own accounts was facilitated through Internet Banking was authorised by the OP bank. This is provided as an additional facility to facilitate efficiency, with security precautions and liabilities of the parties duly stipulated. While the RBI guidelines provide for the timelines between which the complaint is to be filed, in the present case, the complainant immediately reported fraudulent transactions made from his Account to the OP Bank as well as police. How the change of registered mobile number was allowed, the request of the complainant, if any, for such change made to OP Bank, how the OTP was sent to the new number while the transaction details were sent to the existing number, were not brought on record. It is undisputed that the said unauthorised transactions have in fact occasioned from the account of the complainant. RBI Circular No. RBI/2017-18/15 DBR. No. Leg.BC.78/09.07.005/2017-18 dated 06.07.2017 brought on record provides for liabilities of the parties. As per the same, zero Liability is fastened on customer where the unauthorised transaction occurs in the events of contributory fraud/ negligence/ deficiency on the part of the bank (irrespective of whether or not the transaction is reported by the customer) or third party breach where the deficiency lies neither with the bank nor with the customer but lies elsewhere in the system, and the customer notifies the bank within three working days of receiving the communication of unauthorised transaction from the bank. It also provides that, on being so notified by the customer, the bank shall credit (shadow reversal) the amount involved in the unauthorised electronic transaction to the customer’s. And, further, that the burden of proving customer liability in case of unauthorised electronic banking transactions shall lie on the bank. Therefore, the onus of proving an unauthorised transaction lies on the bank.

14.    In the present case, the complainant notified the unauthorised transactions happened on 21.08.2017 to the OP bank on 23.08.2017 itself. Which is within 3 days, as per RBI Circular dated 06.07.2017. Paras 6 & 9 of the said RBI Circular is explicit that when a customer notifies the bank about unauthorised transactions from his account within three working days of being aware, the Bank shall credit the amount involved in the unauthorised electronic transaction to the customer’s account within 10 working days from the date of such notification by the customer.

15.    While the Bank contended that the mobile number used by the complainant for online transaction was 9822120629, the complainant contended that he same was 9970472024 where he received the details of the said unauthorised transactions. The learned State Commission considered it appropriate not to go into the disputed details, while the onus of establishing the contentions is on the OP Bank. At the same time, the factum of unauthorised transactions from the account of the complainant is undisputed. Without doubt, it is the bounden duty of the OP Bank to secure the interest of the account holders who deposit their hard earned money in the account of the bank, against fraudulent or unauthorised transactions. The RBI circular dated 06.07.2017 is explicit in this regard. Therefore, to that extent, the deficiency in service of the OP Bank with respect to complainant is manifest. The learned state Commission has gone into significant details with respect to the facts and evidence brought before it and passed a well reasoned and detailed order.

16.    In view of the discussion above, I am of the considered view that the detailed and well reasoned Order of the learned State Commission dated 31.03.2023 in FA No 78 of 2018 does not suffer from any illegality or impropriety and no interference is warranted, except for award of compensation of Rs.15,000/-. This is because, compensation in the form of interest element of 7% is already granted and multiple compensations are inadmissible for same cause of action. Therefore, the instant Revision Petition No. 1551 of 2023 is Dismissed.

17.    Keeping in view the facts and circumstances of the present case, there shall be no order as to costs.

18.    All pending applications, if any, also stand disposed of accordingly.