This is an application u/s.12 of the C.P. Act, 1986.

          The complainant by filing this complaint has stated that he is a customer of OP1, Punjab National Bank, Garpar Branch.  On the 21^st October, 2012 he made two transactions through the ATM of AXIS Bank, situated at the Rajabazar Area.  He made only two transactions of Rs.10,000/- and Rs.3,000/-.  After these two transactions, the complainant received a message in his mobile that besides these two transactions another transaction was made.  The complainant also withdrew an amount of Rs.10,020/- in addition to Rs.10,000/- and Rs.3,000/-.  It was really a bolt from the blue.  Because he made only two transactions, how this third withdrawal comes into picture.

The complainant approached to the PNB Manager, Mr. Bishnu Prask Naik and the Deputy Manager of the AXIS Bank, Mr. Abhisek Mookherjee to look into the matter and solve the problem.  After continuous approach to the Manager and Deputy Manager of the concerned Bank the complainant managed to get a transaction statement of the ATM  of AXIS Bank located at Rajabazar area and CD containing CCTV  Footage of October, 21^st 2012 of the concerned ATM Counter of Axis Bank.  But the CCTV footage did not show that the amount was withdrawn by the complainant.  As per mini bank statement of Punjab National Bank, the said amount of Rs.10,020/- was withdrawn in favour of the complainant.  the complainant strongly held that the third transaction for drawing the amount of Rs.10,020/- was not made by him.  The Axis Bank also affirmed that the money was drawn in favour of the complainant, Mr. Jalaluddin.  So, fact remains, there is no question of getting the money back by the complainant.  This highlights the negligence of the Axis Bank authority because no such transaction was made.  Hence, this case.

The two transactions were made within two consecutive minutes.  One at 18:59 p.m. vide record No.7387, Rs.10,000/- was withdrawn.  Then again at 19:00 p.m. on the same date i.e. on 21^st October, 2013, vide record No. 7388, Rs.3,000/- was withdrawn.  These timings do not match with the time mentioned in the CD of the CCTV Footage given to the complainant.  Another fictitious transaction was made at 19:01 p.m. vide record No.7389 Rs.10,020/- was withdrawn.  The complainant failed to make out how the third transaction was made and money is vanished from his account.

After watching the CD of the CCTV Footage, the Manager of Punjab National Bank pleaded to the Deputy Manager of Axis Bank for the refund of Rs.10,020/- to the complainant but with no result.

The complainant also knocked the door of the Banking Ombudsman’s Customer Grievance Department, but they took no step.  The complainant is deprived of getting the amount of Rs.10,020/-.  Banking Ombudsman heard the versions of both the banks and the complainant but the office does not find any deficiency in service on the part of the bank.

In the written version Punjab National Bank i.e. OP1 stated that the complainant’s claim was false and fictitious.

Banking Ombudsman also repudiated the complainant’s claim under clause 13A of the Banking Ombudsman Scheme, 2006.

The complainant used the ATM of the Axis Bank, so any dispute regarding the transaction should be met by the AXIS Bank, it is not the liability of PNB.  So, for any dispute regarding transactions of AXIS Bank ATM, PNB has no fault.

On the other hand, the Axis Bank, the OP2 states that the complainant does not come within the definition of the ‘customer’ because the complainant has an ATM Card of PNB.  He went to draw money from the ATM Centre of AXIS Bank.  So, fact remains that he is not a customer of the AXIS Bank.  There is no privity of contract between OP2 and the complainant.  Therefore, the complainant does not come within the purview of the definition of the consumer.

It is also submitted that the complainant has drawn out money from AXIS Bank ATM Centre on 21-10-2012 being Nos.7387, 7388 and 5030 and Rs.23,020 was taken out.  It is displayed in his account details.

The Electronic Journal (EJ) file in the ATM is the final proof of the authenticity of the transaction accepted across the world by all banks.  It cannot be manipulated in any way whatsoever.  The electronic journal shows that the third transaction being nos.5080 was made and Rs.10,020/- was withdrawn.

The ATM card holder uses his/her debit card and confidential PIN No. for withdrawing money.  But the complainant’s close one or relative might have an access to his card and knows his Pin No.  Somehow the disputed amount was withdrawn out by the third party.

There is no question of negligence on the part of the OP2.  They stated that the complaint is frivolous and vexatious.

Decision with Reasons

On proper study and of the entire materials on record and also hearing the argument of the Ld. Lawyer of the OP we have gathered that the Ld. Lawyer of the OP tried to convince that  complainant has failed to prove by any cogent evidence that the money has withdrawn by an unauthorized person from the ATM without ATM Card and knowledge of Pin Number and practically complainant has stated that Rs.10,000/- was withdrawn but fact remains complainant has not stated anywhere how it was possible if ATM card and Pin Number were not available to such a person who is unknown to the complainant withdrew the same in his absence.  It is further submitted by the Ld. Lawyer of the OP that unauthorized person is unable to withdraw money from the ATM without using ATM Card and knowledge of Pin related to the said ATM  Card then it is the complainant to prove how the said money was withdrawn from ATM Card related Pin which was in his custody and mind of the complainant but complainant is silent in this regard for which complaint should be dismissed and moreover Ld. Lawyer for the OP submitted that already National Commission by its judgment reported in 2011(2) CPR 26(NC) already observed that it is not possible for any Bank to refund money when the complainant has failed to prove any cogent evidence that money was withdrawn by any unauthorized person by ATM without ATM card and knowledge of Pin Number and further it is submitted J.P. Log supports that it was successful transaction being transaction no.5030 dated 21-10-2012 at 19:01 hours from ATM ID No.SPC No.1718 practically from J.P. Log what reveals that vide that transaction No. from ATM Machine Rs.10,000/- was withdrawn against the complainant account No.1963000101211672 whereas ATM Card No. is 5048848881012761014 but against that complainant has submitted actually he withdrew Rs.10,000/- against transaction no.7387 at 18:59 hours from ATM ID No.SPC No.1724 and also withdrew Rs.3,000/- vide transaction No.7388 at 19:00 hours.  Therefore, he did not withdrew any amount and regarding the present transaction complainant submitted that he brought out CD of CCTV Footage as supplied by the Bank Authority wherefrom it is found that after 19:00 hours he was not found in the said ATM room further he has submitted that he never used another ATM Machine being ATM ID No.SPC No.1718 wherefrom Rs.10,000/- was withdrawn.  It was further submitted by the OP that when the complainant prayed for producing the details of the transaction it was collected from AXIS Bank wherefrom it is found that Rs.10,000/- was not withdrawn from ATM Machine being SPC No.1724 at 19:01 hours on 21-10-2012 but that was withdrawn from another ATM ID No.SPC No.1718 and not only that prior to 19:01 the said machine was used by the said hacker from 18:47 to 19:01 hours and prior to 19:01 several times hackers tried to withdraw but transaction was declined due to wrong number of PIN but ultimately hacker able to withdraw Rs.10,000/- at 19:01 hours.  But complainant version is that he was well aware of his PIN No. so there is no scope on the part of the complainant to push the button of wrong Pin No. but considering the statement of account of said ATM ID No.SPC No.1718 it is found that it was done by some hacker who attempted from 18:47 to 19:01 but the Bank has failed to give any explanation how from 18:47 to 19:01 on several occasions transaction was declined for using such false PIN No. which is evident from their statement but OP has failed to give any satisfactory explanation in this regard but OP has tried to say that PIN No. was in the mind of the complainant and ATM Card was in the hand of the complainant so transaction was made by the complainant but the very fact that is the attempt of the hackers for withdrawing the said amount failed to use the correct PIN number so many times so in between 18:47 to 19:01 hours hackers failed to withdraw the same and transactions were declined but ultimately able to encash Rs.10,000/- vide transaction no.5030 through ATM ID No.SPC No.1718 what has not been used by the complainant and CCTV Video Footage does not speak that at 19:01 hours complainant was in the said ATM room.  So, it is clear that the hackers by adopting such measures withdrew the same and it was not withdrawn by the complainant. 

          After considering the said slips as supplied by the Axis Bank Authority to the complainant it is found that complainant used ATM Machine No.SPC No.1724 and withdrew Rs.10,000/- and Rs.3,000/- vide Transaction No.7387 and 7388 in between the period 18:58 to 19:00 hours but considering the very fact that complainant was in the said ATM upto 19:00 hours and CCTV Footage reveals that complainant was not in the said room after 19:00 hours then how the money can be withdrawn at 19:01 hours from another machine ATM ID No.SPC No.1718.  Another factor is that OP Axis Bank is failed to clarify how it was possible if actually complainant was aware of PIN No. several transactions were declined for PIN tries acceded.  Moreover, OP has failed to prove by any cogent evidence that complainant was in the said ATM Machine room at 19:01 hours.

          Considering the present fact it is clear some untoward incident  happened regarding withdrawal of the susceptible Rs.10,000/- for the transaction No.5030 at 19:01 from another ATM Machine of that room being ATM ID No.SPC No.1718.

          After considering the above fact and also the casual approach of the defence of the Axis Bank that without ATM Card and Pin any unauthorized person can withdraw ATM is not scientifically accepted in view of the present Hackers so the entire defence of the OP is unscientific and about the judgement of the National Commission as pointed by the OP Bank we find that in the said judgement art of fraud in ATM as adopted by the hackers is not at all discussed.  At the same time Video Footage supports that complainant was not in the ATM room after 19:00 hours and moreover the complainant is a businessman and he has no need to tell a lie before Bank Authority and Forum for such a money because said amount is apparently found withdrawn by adopting some scientific process by the hackers and that is proved by the complainant by producing those act of the hackers when on several occasions the hackers failed to give correct PIN numbers for which the transaction was found invalid or person were declined against withdrawal of the said amount.

          Further considering the argument of the Ld. Lawyer of the OPs and also the judgement of the Hon’ble National Commission as referred by the OP we have gathered that it is the normal procedure as it is found in all the ATM cases but fact remains the complainant pointed out a vital question and if observation of the National Commission is considered in the present case then Global Problem of ATM cannot be solved by the judgment.  So, for that purpose we have gone through some types of ATM threats practically card and currency fraud wherefrom it is found that card and currency fraud involves both direct attacks to steal cash from the ATM and indirect attacks to steal a consumer’s identity in the form of consumer card data and PIN theft and the intent of indirect attack is to fraudulently use the consumer data to create counterfeit cards and obtain money from the consumer’s account through fraudulent redemption.  Fact remains there is another procedure of hacking that is skimming and an ATM Card skimming is the most prevalent and well-known attack against ATMs.  Card skimming are devices used by perpetrators to capture cardholder data from the magnetic stripe on the back of an ATM card, these sophisticated devices smaller than a deck of cards and resembling a hand-held credit card scanner are often installed inside or over top of an ATM’s factory-installed card reader. When the consumer inserts his card into the card reader, the skimmer captures the card information before it passes into the ATMs card reader to initiate the transaction.  The transaction continues in a normal fashion.  When removed from the ATM, a skimmer allows the download of personal data belonging to everyone who used the ATM. An inexpensive, commercially available skimmer can capture and retain account numbers and PINs for more than 200 ATM cards.  Typically, criminals design skimming devices to be undetectable by consumers. 

Further there are certain kinds of card skimming attack and that generally occurs : External Card Skimming – skimming is made by placing a device over the card reader slop(motorized or dip) to capture consumer data from the magnetic stripe on the card during a transaction.  This is the most common form of card skimming and there is another procedure i.e. called card trapping or fishing and card trapping and fishing attempt to steal consumers’ cards as they are inserted into the card reader during a transaction.  The purpose of this type of attack is to steal the card and use it at a later time to make fraudulent withdrawals from the consumers’ compromised accounts but in this case such type of hacking was happened and that there is another type of trapping and fishing and currency trapping and fishing is an attempt by perpetrators to capture currency that is dispensed by the ATM during a transaction, but that has not been happened in this case but considering the repeated decline of transaction and invalid transaction made in between 18:47 to 19:01 against ATM ID No.SPC No.1718 it is clear that Card Skimming was done by the perpetrators (hackers) and they collected it by placing such device during transaction of the complainant from 18:58 to 19:00 hours and practically in between 18:58 to 19:00 hours another ATM ID No.SPC No.1718 was used by the hackers within that and ultimately after departure of the complainant from his ATM machine being No. SPC No.1724 at 19:00 hours the hackers managed to withdraw Rs.10,000/- from another ATM machine of the said room being ATM ID No.SPC No.1718 and that is evident from the document of the Bank but practically Bank has failed to give any satisfactory answer who used another machine from 18:42 to 19:01 but in this regard the complainant was sure about withdrawal by unknown persons from the copy of Video Footage which reveals that other person withdrew the sum and that is evident but Bank has not given any explanation in this regard in the written version when the documents which were supplied by the OP to the complainant simply proves that bilaterally during continuation of the transaction made by the complainant through ATM ID No.SPC No.1724 another ATM  machine situated with the said room being ATM ID No.SPC No.1718 had been used by other person for attempting withdrawal of that amount by using the next machine ATM ID No.SPC No.1718 and placing such devices managed to capture complainant’s data from the magnetic strip and that was used by next machine after departure of the complainant withdrew the same and it is one type of hacking and that procedure had been adopted in this case by the hacker.

OP Bank has not stated about present global problem of ATM hacking malware threats which are on rise and constantly evolving an attempt to stay ahead of security measures.   But peculiarity is that in all judgment nowhere all these types of hacking are discussed.  But only the simple method is adopted that an unauthorized person cannot withdraw money from ATM without using ATM Card and Pin Code but worldwide computer scientists have expressed that there is no necessity to get the card and ATM Pin No. from the customer and a person having computer knowledge of ATM System can easily trap the ATM card number and ATM by using devices and in this case that scientific hacking process was adopted by the perpetrators and they successfully withdrew after some attempts of transaction in between 18:47 to 19:01 hours but ultimately successfully withdrew on 19:01 hours but using ATM ID No.SPC No.1718.  further OP has failed to give any satisfactory answer about the scientific method of keeping the ATM Machine from any utter contract of the hackers and fact remains present ATM Machine is being used by the Banking Authority and at the same time banking Authority have their no knowledge of technologies of ATM fleet but in whole Asia more and more countries in Europe are migrating towards embedded chip cards and FLS expanding their network size, Asia is first becoming a target for ATM fraud. In India skimming is continuously followed by the hackers and for which as per report of the banking sector of India for card skimming and different kind of ATM hacking huge loss in banking sector is faced and also by the customers.  Whatever it may be knowledge goes that the Bank authority has not submitted any such document before this Forum that they adopted devices to check the ATM machine from card skimming then we are convinced to hold that OPs plea that ATM was quite ‘ok’ cannot be accepted but truth is that there is no such certificate issued by the Bank Authority that against the present two ATM Machines to check the fraud and card skimming they have expanded their network by migrating towards embedded chip and FLS in India.  Fact remains all these matters are not in the mind of administration of bank though more and more technologies are being invented by the hackers who are not simple thief but most intelligent thief but they are operating the ATM without any pin code.  In this case the perpetrators adopted such scientific procedure by hacking even after not getting the original ATM Card and Pin Code but the hackers withdrew it by adopting the skimming process and other process by placing scientific devices and it is proved that apparently the perpetrators attempted to withdraw it from 18:43 to 19:00 but after departure of the complainant, by using another machine, they were attempting the same from other machine ATM ID No.SPC No.1718 which had not been used by the complainant from 18:47 to 19:01 but actually the complainant used ATM No.1724.

Now, after considering the entire materials we are confirmed that preparators other than the complainant managed to withdraw the said amount by adopting modern technologies and hacking but it is not within the knowledge of the banking administration.  But we feel that more and more studies are required by the Forum and also by the lawyers to cope up with the present technologies, related to fraud hackers adopted who are handling the ATM fraud learning how and what manner fraud can be practiced by the hackers by adopting different technologies.  We pointed out two or three technologies but there are thousands of techniques.  Fact remains in this case similar incident happened but bank is always casual and in their hand there are two or three rulings of National Commission or State Commission and said view are common in all respects but we have failed to understand why even today no such authoritative approach has been adopted by the hierarchy and when all over the world ATM fraud is treated as a cyber crime so present technologies must be read daily or at the time of handling such case it shall be dealt with the line of technologies as adopted by the hackers and at the same time anti devices should be used by the authorities of the bank to save their ATMs or online transaction etc.  So, it is the duty of the Bank to submit such certificate that anti devices are used in the ATM so question of hackings does not arise but Bank Authority has not say so and that certificate has not been submitted by the bank Authority but it is the duty of the Bank to transact all type of transactions with safely and when Bank has fixed ATM for smooth service then smooth security and smooth anti devices must be fixed so that the hacker must not have any access by applying the technologies to withdraw the amount in absence of ATM card and Pin.  On thorough study of different books of ATM fraud and securities and also different types of anti devices which are used by the different countries we are astonished that Banks are not thinking over such matter for proper safety of the customer and no doubt in this regard the Indian Bank very poor and truth is that in this case the perpetrators (hackers) attempted a at large to withdraw money during transactions hours when complainant was present on another machines in same room.

          So, considering all the above facts we are convinced to hold that Rs.10,000/- which was successfully withdrawn at 19:01 hours on 21-10-2012 by using ATM ID No.SPC No.1718 was not withdrawn by the complainant but same was withdr awn by some hackers after departure of the complainant from the said ATM room on 19:00 hours and no doubt it was the overact of some hackers having their full knowledge of skimming and trapping of the ATM number and Pin code during continuation of transaction of the complainant from another machine and in this regard no doubt security measures were not properly taken by the Axis Bank and it was unsafe because no anti-device was used by the banker in the said ATM machine.

          Fact remains Axis Bank has submitted that complainant is not the consumer of the Axis Bank and he has no account in the Axis Bank, so complainant cannot be a consumer.  But in this regard we have gathered from the written version of the Punjab National Bank where it is found that there is a contract in between Punjab National Bank and Axis Bank for operating the machine of the Axis Bank by any ATM card holder of Punjab National Bank.  Then it is clear that Punjab National Bank and Axis Bank have their permanent contract for using the ATM Machine of Axis Bank by ATM Card holders of Punjab National Bank and for which directly complainant is a consumer under both the banks and when in this case the laches on the part of the Axis Bank is well proved then invariably it is the liability of the Axis Bank and Punjab National Bank jointly and for their laches and deficiency in service practically a sum of Rs.10,020/- was deducted from the account of the complainant from Punjab National Bank account and it was no doubt adjusted by the Axis Bank from the Punjab National Bank Account of the complainant then both the OPs are directly and indirectly service provider to the complainant and complainant is a consumer to both of them and for which the complaint is maintainable and when the deficiency and negligence has been proved on the part of the OP Banks then invariably complainant is entitled to get such relief.

          At the same time considering the entire materials on record and above discussions we are convinced to hold that both the bank administrations have failed to prove that in their ATM system anti fraud technologies were applied for skimming resistance i.e. job cards or FLS and regarding safety and security of the ATM card holders there is no such protection and for which no such certificate has been submitted by the Bank Authorities that they are using the same.

          In the light of the above observations we are convinced to hold that both the Bank Authorities are negligent to give protection in respect of the ATM machine and also to the card holders in their Pin card and for which we are inclined to hold that complainant is entitled to get the entire amount of Rs.10,020/- with 8% interest from both the banks jointly and severally when negligence and deficiency on the part of the OPs are well proved.

          In this regard we are of opinion that both the Bank Authorities shall be more careful in future and to train their staff and administration, who are controlling the entire ATM machine all over the India, so that they may apply the present technologies to defend the fraud technology from the ATM Fleet otherwise the Bank shall be always committed in their defence by producing two or three judgment of all the Commissions but fact remains since technology is progressing well in respect of the computer field hacker, rampant which cannot be controlled if anti-fraud technologies are not applied in each and every ATM machine.  

In the result, the case succeeds.

Hence,

Ordered

That the case be and the same is allowed on contest with cost of Rs.5,000/- (Rupees Five thousand only) against each OPs.

          OPs are jointly and severally to pay the entire amount of Rs.10,000/- (Rupees Ten thousand only) with 8% (eight per cent) interest from the date of stolen of money by the hackers or unauthorized person from the ATM Machine and same shall be refunded to the complainant against his present bank account with the OP1 within 15 (fifteen) days from the date of this order failing which OPs jointly and severally shall have to pay punitive damages of Rs.10,000/- to this Forum for adopting an unfair practice not to decide the complainant’s claim by applying scientific methods but even then if it is found that complainant is reluctant to comply this order in that case penal proceeding shall be started against then for which they may be imposed further penalty u/s.27 of the C.P. Act.