Man loses Rs 1.39 lakh in cyber fraud, banks to pay Rs 1.74 lakh over ‘delayed’ action

The order added that as far as the complainant’s bank is concerned, the fraudster’s bank filed details of five transactions wherein they received communications regarding notices in respect of cyber frauds. Herein, after going through these details, there is no communication from SBI.

“As SBI did not send an email immediately upon receiving the complaint, the suspicious account could not be frozen immediately, and time was gained by the fraudster to withdraw the money,” it noted.

Banks failed to freeze funds

The complainant became a victim of cyber fraud on October 13, 2023, when Rs 2.02 lakh was illegally transferred from his bank account to an account held in the name of Mastufa Ali. He reported the fraudulent transactions to SBI within 24 hours and also approached the police and the National Cyber Crime Reporting Portal.

During the investigation, Rs 62,131 was frozen in the fraudster’s bank account and was subsequently released to the complainant pursuant to a Judicial Magistrate’s order. However, Rs 1.39 lakh could not be recovered. The complainant alleged that his bank failed to promptly inform the fraudster’s bank to freeze the recipient account, while the fraudster’s bank had failed to properly verify and maintain the fraudster’s KYC records.

Both banks denied liability. The complainant’s public sector bank claimed it had acted according to its standard procedure, while the private bank argued that the complainant was not its customer and that liability arose only in cases of system failure or bank negligence.

Victim reported fraud within 24 hours: Order

The commission observed that the complainant reported the unauthorised transactions to his bank within 24 hours, well within the 72 hours prescribed under the RBI’s July 6, 2017 circular. Therefore, the complainant could not be held liable for the fraudulent transactions.

It held that the complainant’s bank failed to promptly communicate with another bank to freeze the fraudster’s account. SBI’s failure to produce the email correspondence led the commission to presume that it had not acted promptly, allowing the fraudster time to withdraw the money.

The commission found the private bank deficient in service for failing to produce the PAN, address proof and complete KYC records of the account holder, Mastufa Ali. It observed that the account appeared to have been maintained without proper KYC verification and treated it as a “mule account.”

It rejected the private bank’s contention that the complainant was not its consumer, holding that he was a beneficiary of the bank’s banking services because the fraudulently siphoned money had been transferred into that account.

The commission observed that social-engineering and remote-access-app frauds, such as those involving Zoho or AnyDesk, do not by themselves amount to voluntary or intentional sharing of banking credentials. Once the customer promptly reports the fraud, the banks are required to take immediate steps to prevent further loss.

Takeaway

The judgment reinforces banks’ responsibility to act swiftly after cyber-fraud complaints and maintain proper KYC records. It also affirms RBI’s zero-liability framework for customers who promptly report unauthorised transactions, while holding both the remitting and beneficiary banks accountable for negligence that contributes to unrecovered losses.

Consumers facing similar grievances may contact the consumer helpline in their respective states (Himachal Pradesh: 1800-180-8087) or dial the National Consumer Helpline at 1915 for assistance.