BEFORE THE DISTRICT CONSUMER DISPUTES REDRESSAL COMMISSION AT BANGALORE (URBAN)

DATED 29^th DAY OF MAY 2024

ORDER

SMT. SUMA ANILKUMAR, MEMBER

The Complainant is a businessman, the OPs No.1& 2 are banks. The complainant has two accounts, one is a savings account bearing NO:142201528916, with the OP No.1 bank and another current account bearing NO.313105000109 with the OP No.2 bank. The copies of the passbooks are produced herewith. The OPs bank is a leading private sector bank in India and offers a wide range of banking products and financial services to corporate, small and medium enterprises (SME), and retain customers through extensive multi-channel touch points including branches, state-of-the-art internet banking, mobile banking, whatsapp banking and phone banking. The OPs NO.1 & 2 made a nationwide campaign through its associated ICICI establishments and virtually appeased the banking customers to go in for the cards for hassle-free transaction. Thus, the complainant as a businessman was tempted and obtained two credit cards bearing Nos: 374741124934008 and 5241932975146004, the photocopies of the credit cards are produced and from his bank for the maximum credit limit of Rs.3,00,000/-.

2. Thereafter, for about 3 years, the card was being used normally. However, on 16.01.2023 around 12:00 clock the complainant received whatsapp message from Mobile No.6383369919 stating that updating the KYC for complainants account in facts, the complainant was stunned to read the revelations of the message. Therefore, there was no question of misusing the said card at morning, that too when it is very much with him and as a businessman had not revealed any of its details to anyone. The card is still with the complainant and further, however, the complainant without any alternative opened the message accordingly. Later, surprisingly the complainant came to know that his card has been misused in Ghaziabad.

3. Thereafter the complainant immediately tried to block fraudulent transactions on the card No. 5241932975146004 through his mobile app but it went in vain, the hacker enabled made the unauthorized transaction of Rs.99,800/- and the complainant immediately within two minute called OPs banks customer care number 18001080 within span of time and requested them to block his cards linked to his account, but OPs failed to take immediate action to block the complainants card, due to negligence by the OPs another unauthorized transaction was made of Rs.99,800/- while the complainant was on a call with the OPs bank. After raising the complaint and receiving SR No.77883734 complainant was convinced that he had secured and all complainants cards were blocked, after 2 minutes another unauthorized transaction of Rs.1,47,980/- was made on his second card No.374741124934008 which was linked to the complainants account even after informing to OPs to block both cards, due to negligence from OPs occurred monitory loss to the complaint. It is submitted that the authority issuing such a card is supposed to ensure that is online operational use may not be hacked by any other person with an intent to extract money from a credit card account by hacking the confidential information of the cardholder or by hacking the E-mail ID on which OTP was sent, which has happened in this case.

4. Then again complainant called customer care and blocked the second card bearing NO.374741124934008 and the complainant raised SR No. 877890485 for the transaction on the second card. After blocking both cards complainant went within two hours to OPs bank and informed about the unauthorized transactions and raised the disputes and after raising disputes the complainant went to cyber-crime police station, south division, Bangalore city, and the complainant intimated to the fraudulent transaction and Cyber Crime Police have registered Crime No.62/2023 U/s. 66© & (d) of IT Act and U/s. 419 & 420 of IPC for the fraudulent transaction within 24 hours the copy of the FIR is produced, and further Cybercrime police intimated to the OPs bank branch manager through an E-mail on the same day that the above transactions are fraud and not process the payments.

5. It is also a fact proved on record that immediately after receiving information qua the alleged fraudulent transaction, the complainant lodged a complaint with the customer care of the OPs as well as Cyber-crime, which was duly registered and also took up the matter with the OPs vide his complaint dated 16.01.2023. In view of the RBI circular, since the deficiency lies neither with the bank nor with the complainant but lies elsewhere in the system, the complainant is definitely entitled to zero liability and the liability is that of the OPs to reverse the fraudulent transaction and once the bank fraud complaint are registered with the concerned bank and another unauthorized transaction takes place. Thereafter, the same has to be borne by the bank as per RBI guidelines for unauthorized transactions. Also, if financial fraud taken place due to contributory fraud or negligence of the bank, the complainant enjoys zero liability regardless of whether or not the unauthorized transaction complaint is lodged with the bank. The OPs bank assured that complainant about the refund of the fraudulent transaction and credited the fraudulent transaction amount to the complainants account and OP No.2 bank has credited said fraudulent amount to the complainants account.

6. The complainant later started receiving letters/demands from the OPs that he had to pay the amount which has been withdrawn fraudulently at Ghaziabad and Mumbai. In fact, the complainant being a permanent resident of Bengaluru neither can transship the card to the said destination nor can utilize it by going there. But still, the complainants card according to OPs was hacked/mis-used by the unknown. It is submitted that if fraud has taken place, it is only due to the lack of improper security measures of the issuer. Therefore, obviously, it is the OPs who is responsible for the lapses of improper services. Nevertheless, the OPs ignoring factual aspects started sending notices to the complainant demanding the payment of the said withdrawals in Ghaziabad and Mumbai. Further, the OPs is regularly calling the complainant to pay the disputed amount. The OPs were very much aware that the complainant has not withdrawn the amount alleged to have been withdrawn at Ghaziabad and Mumbai. However, without any justification, the OPs is forcing the complainant to pay the amount, Thus, the services of OPs are not only deficient in nature but also are pursuing Unfair Trade Practice as defined under sEc.2 (47) of C.P Act of 2019.

7. The complainant has a hirer of banking services is a consumer. The services of the OPs are deficient in nature. On the lapses of the OPs, the complainant has suffered a huge loss, harassment and mental torture. As a businessman, complainant has undergone embracement. Therefore, he is entitled to relief, compensation and in additional to cost proceedings. Further, for the non-payment (according to OPs) the name of the complainant has been arbitrarily entered in the CIBIL list, which is really detrimental to the complainant’s interest. That on 23.03.2023 without informing the complainant OPs bank deducted the sum of Rs.35,030/- for the minimum amount due for a fraudulent transaction, and again the OPs insist the complainant to pay the minimum amount due of the fraudulent transaction, that the said acts on the part of the OPs amounts to an Unfair Trade Practices as defined deficiency in their banking services as defined U/s. 2 (11) of C.P Act 2019, and their lapses equally amount to Unfair Trade Practice U/s. 2 (470 of the Act and was also deficient in service by claiming the unauthorized transaction of the credit card account which was consequently resulted in heavy monetary loss for the complainant and he has undergone severe mental strain, mental agony and torture etc.

8. The National Commission held in Punjab National Bank and Anr. V Leader Valves II (2020) CPJ 92 (NC) are both squarely applicable in the present matter. In Punjab National Bank and Anr. V leader Valves II (2020) CPJ 92 (NC), this commission while addressing the question to liability of a bank is case of unauthorized and fraudulent electronic banking transactions, has observed as under:

“11. The first fundamental question that arises in whether the bank is responsible for an unauthorized transfer occasioned by an act of malfeasance on the part of functionaries of the bank or by an act of malfeasance by any other person (except the complainant/account holder). The answer, straight away is in the affirmative. If an account is maintained by the bank, the bank itself is responsible for it safety and security. Any systemic failure, whether by malfeasance on the part of its functionaries or by any other person (except the consumer/account-holder), is its responsibility and not of the consumer.”

1. Reference is also drawn to circular bearing No. DBR No. Leg. B.C. 78/09.07.005/2017-18 dated 6^th July 2017, issued by the Reserve Bank of India to all commercial banks, wherein it is stated as under:-

“6. A customer entitlement to zero liability shall arise where the unauthorized transaction occurs in the following events:

2. Contrubutory fraud/negligence/deficiency on the part of the bank (irrespective of whether or not the transaction is reported by the customer).

3. Third party breach where the deficiency lies neither with the bank nor with the customer but lies elsewhere in the systems, and the customer notifies the bank within three working days of receiving the communication from the bank regarding the unauthorized transaction.”

4. Both the for a below have rightly held the bank liable for the unauthorized transactions.

9. That on 14.02.2018 the complainant filed the complaint before the Ombudsman and said the authority has not taken any decision and OPs bank harassed the complainant by calling more than 10 to 20 times per day, again the OPs insisted the complainant to pay the unauthorized transaction amount of Rs.3,05,038/-, if the complainant fails to pay the unauthorized transaction amount complainants SB account, and OD accounts will become frozen, and further home loan account also became a NPA, the complainant requested to the OPs that already I have filed the consumer complaint No.258/2023 its pending before the Hon’ble Principal District Commission Bengaluru, and please wait for final order, but the OPs without considered the complainants request, the OPs immediately freezed the complainants SB, and OD accounts. Further, the OPs said that whatever the court judgement will come bank will abide by and revert funds as per the court judgement.

10. The OPs being the nationalized banking establishment cannot evade its responsibility without assigning the exact reasons as to what has happened and how the withdrawal has taken place Ghaziabad and Mumbai on the same day? The OPs is unnecessarily insisting the complainant to pay the amount by putting him in CIBIL list which clearly amounts to deficiency in service coupled with unfair trade practice as defined under Secs. 2(11) & (47) of the COPRA-2019. Having been aggrieved by the non-response to his several correspondences, the complainant ultimately though of initiating legal proceedings. Hence this complaint by complainant.

11. On issue of notice to OPs, the OPs file their version.

12. In the version of OPs, OPs submit that the above amended complaint filed by the complainant is misconceived, false and frivolous in as much as the complainant has failed to set out any grounds for grant of any relief of whatsoever nature and suppressed material information and on this count along the said complaint deserves to be dismissed.

13. That the complainant failed to establish any “deficiency” within the meaning of the provisions Sec 2(11) of the Consumer Protection Act, 2019. Admittedly, complainants stated that the total sum of Rs.3,40,068/- has been marked freeze in the bank account which pertains to the disputed three transactions done in the two credit cards. The complaint has admittedly received whatsapp message to his mobile number for updating of KYC from unknown number i.e. 6383369913 and having confidence of the physical card is with him has opened the message at 12:00 clock on 16.01.2023. Further the complainant stated that then when he was trying to block the card, one transaction took place for Rs.99,800/- and during the call with customer care another transaction of Rs.99,800/- took place in credit card No.5241932975146004 and later within a span of time another transaction for Rs.1,47,980/- happened in another card No.374741124934008.

14. The said statement clearly establishes that the complainant has without validating the authenticity of the message has opened the unknown whatsapp message which would have resulted in hacking/compromise of his mobile through third party sharing app to fraudster whereby fraudster had access to the bank account/card details and one time password for the transaction (OTP). Therefore, the complainant failed to adhere to the terms of the credit card/bank account terms and has unauthorisedly allowed the access to fraudster, hence complainant cannot make the OPs bank liable for the loss. The complainant has registered a criminal complaint before the south CEN Cyber Crime Police station in respect of the said three transactions and the said cybercrime have registered the FIR vide Crime No.0062/2023 and the investigation is still pending, thus the present complaint filed against the OPs bank alleging negligence or deficiency of service is premature in nature.

15. Upon receipt of the complaint from the complainant on the disputed transactions, the OPs has acted swiftly and blocked the further transactions in the credit card and investigated the mode of transactions. It is submitted that during the internal investigation it is revealed that:

a) the three transactions are transactions wherein customer has visited the respective merchant website and executed the transactions. This requires complainant’s Credit card number, Card Verification Value (CVV), Expiry date on his Credit Card and OTP. These details are mandatory for effecting the said online transactions.

b) The three transactions were effected on the Credit Card which had undergone a Secure Authentication, which is a second level authentication specifically built in for online transactions done through Merchant Websites.

As per the records of the OPs, the SMS alerts towards the three transactions and OTP were sent on the registered mobile number of the complainant, the details are as follows:-

16. It is submitted that the One Time Password (OTP) is purely personal and privy to the customer/complainant only and would not be known to anybody, unless compromised otherwise. The card holder/complainant is solely responsible for the security of his credit card along with CVV and should therefore take all possible steps towards ensuring the safe keeping thereof. In the event of any disclosure or compromise of the above details to third parties then, bank does not incur any financial liability arising out of the misuse thereof by unauthorized persons. In the present complaint, admittedly complainant has compromised his mobile by opening the known message which resulted in fraudster to access to his mobile which enabled the fraudster to do transaction and have access to the OTP for the transactions.

17. It is submitted that the disputed three transactions in the credit cards were allowed by the system as CVV, expiry date and OTP specific and not person specific. Further, as the transactions were qualified by information strictly personal to the complainant, the OPs bank is therefore precluded as per industry guidelines to repudiate the transactions with the merchant on the basis of complainant’s dispute. It is submitted that the admittedly the complainant has filed a criminal complaint against the fraudster who have sent a message in his whatsapp and the Cyber crime police have registered the said complaint as Crime No.62/2023 wherein the investigation is pending. It is significant to note here that in the said criminal complaint the complainant has stated that he has received message from two number i.e. 6383369913 and 9883683551, and also stated that he has clicked the link and updated the details of credit card and also shared the OTP for the transactions. It is submitted that the present consumer complaint and the complainant has deliberately concealed the fact that he has updated the credit card details and OTP to the fraudster instead pleaded innocent and conveniently shifted the burden on the bank alleging deficiency of service. The complainant has approached this forum with unclean hands with a misleading statement and to gain false sympathies have filed this complaint on a illusionary cause of action.

18. The OP bank as a law-abiding person has provided required support to the Cyber crime police to investigate the matter and to trace the beneficiaries of the three transactions. That in the dispute three transactions the beneficiaries/ merchant are third parties and the OPs bank has no control over them. It is submitted that the transaction money is in the hands of third parties/merchants, hence the remedy to the complainant is to pursue the criminal complaint and with the support of cyber-crime police to nab the fraudsters and recovers the transaction amount from them. The OPs being prudent banker has informed and notified all the transactions details to the complainant and also provided required support to the cyber crime police to investigate the matter and also responded to the complaint. It humbly submitted that the relief sought in the complaint is in the nature of recovery of the money which was lost by the complainant due to his negligent act is not maintaining the confidentially of the credit card number, CVV and OTP (payment credentials) and the compensation is also in the nature of damages against the OPs who is a banker offered credit card and banking services.

19. In terms of the RBI guidelines dated 06.07.2017, on customer protection -  limiting liability of customers in unauthorized electronic banking transactions, customer is accountable in cases where the loss is due to negligence by a customer. The extract from the circular is mentioned below for ready reference:

7. A customer shall be liable for the loss occurring due to unauthorized transactions in the following cases:

In cases where the loss is due to negligence by a customer, such as where he has shared the payment credentials, the customer will bear the entire loss until he reports the unauthorized transaction to the bank. Any loss occurring after the reporting of the unauthorized transaction shall be borne by the bank.

20. In terms of the RBI guidelines shadow credit for the disputed transaction amount was provided to the credit card of the complainant upon receipt of the complaint, and in view of the above investigations completed, the temporary credit was debited/reversed from aforementioned credit cards. The complainant has agreed to maintain confidentially of cared details, transactions and OTP and also unconditionally agreed that he will be responsible in the event of failure to maintain confidentiality of the credit card/OTP/credentials. Hence, under the credit card terms bank is not liable for any loss caused to the complainant. Despite concluding the investigation and holding the complainant is liable for the transactions, the complainant failed to regularize the credit card outstanding payments. It is stated that in terms of the credit card terms and under the provisions of the Indian Contract Act, 1872 in specific section 171 OP has right to exercise lien and recovery the amount by marking lien on the amount held by the customer/complainant with the bank towards the outstanding payments. It is submitted that the outstanding dues in the credit card of the complainant are legally recoverable. Hence, any exercise of lien by the OPs bank and adjusting the same are valid and any such exercise of such right of lien does not amount to deficiency of services and the complaint is not entitled for any refund of such amount with damages.

21. OP bank has time and again educated the customer and a detailed terms of credit was made available in each monthly statement of account to maintain the confidentiality of card details and to regularly pay the outstanding amount. In the present matter also, the OPs has acted prudently and provided required support to the complainant and responded suitably to the complainants grievances including to the legal notice with reasonable justification. The allegations contentions of the complaint against the OPs are vehemently denied in TOTO as being false, baseless and vexatious. It was the complainant who had committed breach of the contract and failed to comply with the terms of the credit card in maintaining the confidentiality of the credit card details and OPT, and also failed to repay the outstanding amount in the credit card. There is no deficiency in service on the part of OPs No.1 to 3 nor there is any negligence or unfair trade practice on the part of the bank, hence the OPs is not to be held liable for the illegal claims made by the complainant. Hence the complaint to be dismissed.

22. The complainant has filed affidavit evidence along with 9 documents marked as Ex.P.1 to Ex.P.9. The OPs No.1 to 3 have filed affidavit evidence along with 4 document marked as Ex.R.1 to Ex.R.4. The OPs No.1 to 3 have filed their evidence together, as the OPs are one and the same. The OPs and complainant filed written arguments.

23. On the basis of above pleadings for our consideration are as follows:-

i) Whether the complainant proves the deficiency of service on the part of OPs?

ii) Whether complainant is entitled for the relief?

iii) What order?

24.  Our answers to the above points are as follows:-

Point No.1:-Negative.

Point No.2:-Negative.

Point No.3:- As per the final order.

REASONS

25. Point No.1&2:-These points are inter-connected to each other and for the sake of convenience, to avoid repetition of facts, these points are taken up together for common discussion.

26. In support of his complaint the complainant has filed affidavit evidence with 8 documents marked as Ex.P.1 to Ex.P.8.

27. On perusal of the documents Ex.P.1 is the photo copy of the credit cards issued by OPs holding card No’s. 374741124934008 and 5241932975146004. Ex.P.2 is a copy of the credit card statement of the complainant in which we observe that there is a transaction made in which an amount of Rs.1,47,980/- is paid towards pay www.croma.com Mumbai city in the credit card No.3747xxxxxxxx4008 dated 16.01.2023 and two other transactions are made in which an amount of Rs.99,800/- and Rs.99,900/- is paid towards CASREALIIFANTASYSPO Ghaziabad through credit cardNo.5241xxxxxxxx6004 dated 16.01.2023. Ex.P.3 is the copy of the statement of account of the complainant. Ex.P.4 and Ex.P.5 are the copy of the dispute forms of the complainant to OPs dated 16.01.2023. Ex.P.6 is copy of the complaint of the complainant regarding the credit card KYC fraud to the Police Inspector, South Division, Bangalore City dated 17.01.2023. Ex.P.7 is a copy of FIR regarding the same dated 17.01.2023. Ex.P.8 is a copy of the transaction update of A/C No.313101501744 dated from 01.08.2023 to 30.08.2023.

28. On perusal of the documents submitted by the complainant it is true that the complainant has availed credit card holding Nos. 374741124934008 and 5241932975146004 from OPs, agreeing to the terms and conditions of the credit card and to maintain confidentiality of details and its credentials including OTP of specific transactions. On receipt of the complaint from the complainant the OPs has blocked the credit card and there was another transaction from another card of the complainant while he was still on phone conversation with the bank.

29. The disputed transaction were carried out on entering the valid credit card NO. CVV, expiry date and OTP. The OTP is purely personal and privacy to the consumer/complainant only and would not be known to anybody. The cardholder is solely responsible for the security of his credit card along with his CVV. The OPs bank will not have control on the transactions. The complainant has pursued with the civil complaint and cybercrime police have registered the said complaint as crime NO.62/2023, with support of the cybercrime police to nab the fraudster through tracking the fraudulent transaction and to recover the amount from them, wherein the case is pending. The complaint is a pre-mature case.

28. In support of the said complaint, the OPs have by way of affidavit evidence filed 4 documents marked as Ex.R.1 to Ex.R.4. Ex.R.1 is a copy of power of attorney. Ex.R.2 is a copy of FIR and Ex.R.3 is a copy of RBI guidelines and Ex.R.4 is a copy of OP bank response to the complainant.

30. As per the guidelines of the RBI submitted by OPs the customer is liable for the loss is due to unauthorized transactions in case where the loss is due to negligence by the customer, as the complainant has stated that he has received message from two number i.e. 6383369913 and 9883683551 and also stated that he has clicked the link and updated the details of credit card and also shared the OTP transaction in his complaint copy dated 17.01.2023. This shows that the complainant admits to the fact that he had revealed the confidential details of his card, later realized and called to the OP to block his card.

31. Any loss occurring after reporting the unauthorized transaction shall be borne by the bank, but the complainant in his complaint admits that there was unauthorized transaction already done on  which the complainant had called OPs to report the same, and request to block his cards but there was another transaction while the complainant still on call with OPs. Therefore, it is contended that there is no deficiency in service on the part of OPs and the complainant has utterly failed to prove the alleged deficiency in service on the part of OPs. Hence, we answer Point No.1&2 in negative.

32. Point No.3:-In view of the discussion referred above, we proceed to pass the following:-

ORDER

1. Complaint filed by the complainant U/S 35 of Consumer Protection Act, is hereby dismissed, no order as to cost.
2. Furnish the copies of the order and return the extra copies of pleadings and documents to the parties, with no cost.

(Dictated to the Stenographer, got it transcribed and corrected, pronounced in the Open Commission on this 29th day of May 2024)

Documents produced by the Complainant-P.W.1 are as follows:

Documents produced by the representative of opposite party – R.W.1-3;