ICICI Bank liable for ₹7.81 lakh cyber-fraud loss after failing to send mandatory transaction alerts, TDSAT rules

The appellant, a seafarer, maintained an NRE savings account and debit card with ICICI Bank.

While he was onboard a vessel between July and October 2015, 98 online transactions aggregating to ₹12,85,381.67 were allegedly carried out without authorisation.

He stated that he had not disclosed his CVV, card details, or six-digit 3D Secure PIN, and that the Bank had failed to send SMS or email alerts for the disputed transactions despite his mobile number and email address being registered with it.

The Bank reversed ₹5,03,609.95 but declined liability for the remaining ₹7,81,771.72, contending that the transactions had undergone 3D Secure authentication and that the appellant was responsible for safeguarding his credentials.

The appellant filed a complaint under Sections 43 and 43A of the Information Technology Act, 2000, before the Adjudicating Officer, Delhi, claiming compensation, interest, damages for mental agony, and litigation costs.

The complaint was dismissed, principally because the Bank had produced a valid ISO/IEC 27001 certificate and the Adjudicating Officer found no violation of Sections 43 or 43A.

The appellant challenged that decision before the Tribunal.

1. Whether the Bank failed to maintain reasonable security practices and procedures for protecting the appellant’s sensitive personal and financial data, in violation of Section 43A of the Information Technology Act, 2000?

2. Whether the Bank was liable to compensate the appellant under Section 43 of the Information Technology Act for the unauthorised transactions and resulting loss?

3. Whether the Bank’s failure to send SMS and email alerts for the disputed online transactions constituted a breach of mandatory RBI security requirements and attracted liability under Section 43A?

4. Whether the appellant was entitled to recovery of the unreversed amount, interest, and compensation for mental agony and harassment?

The Tribunal applied Sections 43 and 43A of the Information Technology Act, 2000.

Section 43 imposes liability for unauthorised access to, interference with, or damage to a computer resource, while Section 43A requires a body corporate handling sensitive personal data to pay compensation where negligence in maintaining reasonable security practices causes wrongful loss or gain.

Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, passwords and financial information, including bank-account and debit-card details, constitute sensitive personal data; Rule 8 requires appropriate technical, operational, and physical security measures and permits reliance on ISO/IEC 27001 only subject to the statutory requirements.

The Tribunal further treated RBI directions requiring banks to send transaction alerts by SMS and email as mandatory components of reasonable banking-security practices.

It relied on ICICI Bank v. Umashankar Sivasubramanian, Cyber Appeal No. 1 of 2010, decided on 10 January 2019, concerning the Bank’s duty to maintain secure electronic records.

It relied on Bank of India v. Sandeep, Cyber Appeal Nos. 3 and 5 of 2018, along with State Bank of India v. Nakoda Chemicals Ltd., for the principle that transaction alerts are mandatory security measures.

The Tribunal held that the Bank’s ISO/IEC 27001 certification did not conclusively absolve it of liability where specific evidence demonstrated non-compliance with mandatory security obligations.

The appellant produced records showing that his mobile number and email address had been registered with the Bank and that alerts had previously been sent to him, contradicting the Bank’s assertion that he was not registered for such alerts.

The Bank could not produce contrary records, and its counsel acknowledged that alerts were mandatory if the details were registered.

The prolonged series of 98 suspicious transactions, the absence of SMS or email alerts, and the Bank’s failure to detect or interrupt the abnormal activity established negligence in maintaining reasonable security practices, regardless of whether a particular Bank employee or official was criminally implicated.

The Tribunal therefore found a sufficient causal connection between the Bank’s security failure and the appellant’s unrecovered loss, making the claim maintainable under Section 43A.

The Tribunal held ICICI Bank liable to pay the unreversed amount of ₹7,81,772 to the appellant, together with simple interest at 7% per annum from the date of complaint until actual payment, and ₹50,000 as compensation for mental agony, harassment, and suffering.

The amount was directed to be paid within two months of the judgment, with the formal order/decree to be prepared accordingly.