83-yr-old woman loses Rs 2 lakh in 18 min of ‘fraudulent’ call, wins Rs 94,339 from bank

The case arose from a cyber fraud that took place on May 1, 2021, when Nagpal, an elderly resident of Dwarka in Delhi, received a phone call claiming that her Airtel mobile connection required immediate KYC verification or it would be blocked. Believing the caller, she downloaded an application and paid Rs 10 as a KYC charge. According to the complaint, the fraudsters then gained access to her phone, intercepted OTPs, registered her debit card for Mastercard SecureCode and carried out a series of online transactions that emptied her account.

Rs 2.31 lakh in minutes

The complainant told the commission that after the initial Rs 10 payment, fraudsters executed 17 online debit transactions worth Rs 2,31,484 within just 18 minutes and 17 seconds. The shortest gap between two transactions was merely five seconds, while the highest individual transaction amounted to Rs 95,000.

She argued that no human could have carried out such rapid transactions and alleged that the bank’s fraud detection systems should have automatically flagged or blocked the suspicious activity. She also claimed that the bank failed to alert her despite the unusual pattern of withdrawals from a newly registered debit card.

Although Santosh Nagpal lost Rs 2,31,484 in the cyber fraud, a substantial portion of the money had already been recovered before the consumer commission decided the case. IndusInd Bank recovered Rs 37,810 from merchants, the Banking Ombudsman directed IDFC Bank to pay Rs 50,000, and IndusInd Bank itself paid Rs 49,337 under the Ombudsman’s order, reducing the unrecovered loss to Rs 94,337.

Although the consumer commission case was against IndusInd Bank, IDFC Bank also featured in the matter because some of the allegedly fraudulent transactions were routed to accounts maintained with it. Before the consumer complaint was decided, the Banking Ombudsman had directed IDFC Bank to pay Rs 50,000 in relation to those disputed transactions. The commission mentioned this earlier recovery while calculating the amount that still remained payable to the complainant.

Nagpal then accepted responsibility for the first fraudulent transaction of Rs 9,998, arguing that the bank should have prevented the remaining transactions. She therefore sought only the balance Rs 84,339, which the commission ordered IndusInd Bank to refund with interest, along with Rs 10,000 as litigation costs.

Bank blamed customer

IndusInd Bank denied any deficiency in service and maintained that all disputed transactions were authenticated using OTPs and Mastercard SecureCode.

The bank argued that such transactions could not have taken place unless confidential information, including debit card details, PIN, CVV and OTP, had been shared with fraudsters. It also contended that the complainant herself admitted she had followed instructions given by the fraudster during the fake KYC process.

The bank further submitted that it had already recovered Rs 37,810 from merchants and credited another Rs 49,337 following directions issued by the Banking Ombudsman, leaving no further liability on its part.

No customer negligence

• The commission observed that while Nagpal admitted responsibility for the first Rs 9,998 transaction, the bank failed to explain why it permitted another 17 rapid transactions without any verification, particularly when they occurred within minutes of one another.
• “It is emphasised that technical approaches by the Banks should not be taken for granted to deny consumers their rights,” the commission said.
• It added, “The customers like the complainant who is a super senior citizen, have a right to know the modus operandi followed to withdraw clandestinely from her account to protect themselves against unfair trade practices in future.”
• Rejecting the bank’s defence, the commission noted that although IndusInd repeatedly claimed it had conducted an investigation holding the complainant responsible, it failed to place any investigation report on record.
• The commission also said that not sharing any such critical enquiry report with a consumer to prove its bona fide constitutes a deficiency in service and a violation of the ‘Right to be Informed’.
• The bench also recorded that despite repeated opportunities, the bank did not answer crucial questions regarding when the Mastercard SecureCode authorisation had allegedly been shared with the customer or what investigation established her negligence.

Relief

Allowing the complaint, the commission directed IndusInd Bank to refund Rs 84,339, representing the unrecovered amount of the fraud, along with interest at 6 per cent per annum from the date of filing of the complaint until realisation.

The bank was also directed to pay Rs 10,000 towards litigation expenses and comply with the order within 30 days, observing that the super senior citizen had been compelled to pursue litigation since 2023 because the bank failed to adequately safeguard her interests.

Significance

The ruling reinforces that banks cannot escape liability for suspicious cyber fraud transactions merely by citing technical authentication, and must proactively detect and prevent unusual transaction patterns to protect customers, especially vulnerable account holders.

For consumer-related grievances, individuals may contact the consumer helpline in their respective states (Delhi Consumer Commission Helpline: 1800-11-4000) or call the National Consumer Helpline at 1915 for assistance.