Bank Liable for Facilitating Fraudulent Transactions by Flouting Internal Pecuniary Thresholds and RBI Mandated Safety Norms

In brief

The question

1. Whether the Appellant Bank was negligent in its duties by failing to adhere to prescribed pecuniary limits for third-party transfers and regulatory guidelines.

The court held

The Tribunal dismissed the appeal, affirming the Adjudicating Officer's judgment that the Bank was liable for the loss.

It also directed

It held that the violation of daily transaction limits and the failure to conduct a mandatory Root Cause Analysis were sufficient grounds for liability.

The appeal was dismissed with costs.

01Facts

The Respondent (complainant) operated a Net Banking facility with the Appellant Bank via a BSNL mobile number

pp. 3-4

On August 9, 2018, the SIM card was deactivated after a fraudster obtained a duplicate SIM from BSNL using forged documents

pp. 4-5

Consequently, Rs. 2,92,000 was fraudulently transferred from the complainant's account through two IMPS transactions

p. 4

The complainant approached the Adjudicating Officer (AO) under the IT Act, 2000, alleging negligence by both the Bank and BSNL

p. 3

The AO held the Bank and BSNL equally liable, directing them to refund the amount in equal shares with 5% compounding interest

p. 3

The Bank appealed, contending that the customer compromised their password and the Bank had no means to detect the fraud

pp. 7-8

02Issues

i.1. Whether the Appellant Bank was negligent in its duties by failing to adhere to prescribed pecuniary limits for third-party transfers and regulatory guidelines.

pp. 9-10

ii.2. Whether the Bank was mandated to conduct a "Root Cause Analysis" following the report of a fraudulent transaction under the relevant IT Rules and RBI guidelines.

pp. 8-10

03Law Applied

Section 43, 43A, and 85 of the Information Technology Act, 2000, which govern liability for failure to protect data and unauthorized access to computer systems

p. 3

Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (Rule 2011), which mandate specific security standards for corporate bodies

p. 6, 8, 10

Mandatory Reserve Bank of India (RBI) guidelines regarding "Root Cause Analysis" for electronic frauds and internal banking policies established under the Right to Information Act regarding transaction limits

pp. 8-9

Provisions in the judgment · 3 · Linked ones open on LawLens

Information Technology Act, 2000 Section 57 Section 43 Section 85

04Reasoning

The Tribunal rejected the Bank's contention that the fraud was solely due to the subscriber's negligence or the Telecom Service Provider's fault.

p. 9

The Tribunal noted that the Bank’s own internal guidelines, as disclosed under RTI, restricted new beneficiary transfers to Rs. 25,000 per instance and Rs. 2,00,000 per day; the Bank permitted a transfer of Rs. 2,92,000 in a single day, which constituted a direct breach of its own security protocols.

p. 9

The Bank failed to initiate a "Root Cause Analysis," a mandatory procedure under Rule 2011 and RBI guidelines to investigate the breach.

pp. 9-10

The Tribunal observed that the Bank's failure to monitor the Nigerian IP address used by the fraudster, coupled with the violation of pecuniary limits, established clear liability.

p. 8, 10

05Holding

The Tribunal dismissed the appeal, affirming the Adjudicating Officer's judgment that the Bank was liable for the loss.

p. 10, 12

It held that the violation of daily transaction limits and the failure to conduct a mandatory Root Cause Analysis were sufficient grounds for liability.

p. 10

The appeal was dismissed with costs.

p. 12

LawLens.Telecom Disputes Settlement and Appellate Tribunal

Original Court PDF