Bank Liable for Facilitating Fraudulent Transactions by Flouting Internal Pecuniary Thresholds and RBI Mandated Safety Norms

The Respondent (complainant) operated a Net Banking facility with the Appellant Bank via a BSNL mobile number

On August 9, 2018, the SIM card was deactivated after a fraudster obtained a duplicate SIM from BSNL using forged documents

Consequently, Rs. 2,92,000 was fraudulently transferred from the complainant's account through two IMPS transactions

The complainant approached the Adjudicating Officer (AO) under the IT Act, 2000, alleging negligence by both the Bank and BSNL

The AO held the Bank and BSNL equally liable, directing them to refund the amount in equal shares with 5% compounding interest

The Bank appealed, contending that the customer compromised their password and the Bank had no means to detect the fraud

1. Whether the Appellant Bank was negligent in its duties by failing to adhere to prescribed pecuniary limits for third-party transfers and regulatory guidelines.

2. Whether the Bank was mandated to conduct a "Root Cause Analysis" following the report of a fraudulent transaction under the relevant IT Rules and RBI guidelines.

Section 43, 43A, and 85 of the Information Technology Act, 2000, which govern liability for failure to protect data and unauthorized access to computer systems

Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (Rule 2011), which mandate specific security standards for corporate bodies

Mandatory Reserve Bank of India (RBI) guidelines regarding "Root Cause Analysis" for electronic frauds and internal banking policies established under the Right to Information Act regarding transaction limits

The Tribunal rejected the Bank's contention that the fraud was solely due to the subscriber's negligence or the Telecom Service Provider's fault.

The Tribunal noted that the Bank’s own internal guidelines, as disclosed under RTI, restricted new beneficiary transfers to Rs. 25,000 per instance and Rs. 2,00,000 per day; the Bank permitted a transfer of Rs. 2,92,000 in a single day, which constituted a direct breach of its own security protocols.

The Bank failed to initiate a "Root Cause Analysis," a mandatory procedure under Rule 2011 and RBI guidelines to investigate the breach.

The Tribunal observed that the Bank's failure to monitor the Nigerian IP address used by the fraudster, coupled with the violation of pecuniary limits, established clear liability.

It held that the violation of daily transaction limits and the failure to conduct a mandatory Root Cause Analysis were sufficient grounds for liability.

The appeal was dismissed with costs.