Applying the above rules to the facts, the Court scrutinized the actions and responses of both the petitioners and the bank:
1. Failure in Two-Factor Authentication: On October 1, 2022, unauthorized beneficiaries were added to the petitioner’s account without any One-Time Password (OTP) or notification sent to his registered mobile or email. The next day, ₹76,90,017 was fraudulently debited through multiple transactions. The Cyber Cell’s investigation confirmed that no OTPs or transaction alerts were received by the petitioners, directly contradicting the bank’s claim that the transactions were authenticated through valid credentials and 2FA.
2. Petitioners’ Prompt Action: Upon discovering the fraudulent transactions, the petitioners promptly reported the incident to both the Cyber Crime Police and the bank on October 3, 2022. They lodged a First Information Report (FIR) and persistently sought redress from the bank, adhering to the RBI’s guidelines for reporting unauthorized transactions. This quick reporting played a critical role in establishing their non-negligence and ensuring their claim for compensation.
3. Inadequate Inquiry by the Banking Ombudsman: The Court highlighted the lackluster approach of the banking ombudsman in investigating the fraud. The ombudsman concluded there was no deficiency in the bank’s service without thoroughly examining whether the transactions were truly authorized by the petitioners. The ombudsman’s reliance on the bank’s assurance of 2FA being used, despite contrary evidence from the Cyber Cell, was deemed insufficient and negligent.
4. RBI’s Support on Zero Liability: The RBI’s affidavit supported the stance that in cases of unauthorized transactions due to third-party fraud, customers should have zero liability, provided they report the incidents promptly and have not contributed to the breach through their actions. The Court found that the petitioners had acted diligently and there was no evidence of negligence or collusion with the fraudsters.
Source: Barandbench
