High Court asks bank to refund Rs 76 lakhs fraudulently debited from company’s account
A customer has zero liability in a third-party unauthorised transaction where the deficiency lies not with the bank or customer but elsewhere in the system, the Bombay High Court said on Thursday while directing Bank of Baroda (BoB) to refund Rs 76 lakhs debited fraudulently from a company’s bank account.
The bench of Justices Girish Kulkarni and Firdosh Pooniwalla was hearing a petition filed by Jaiprakash Kulkarni and his family-held company Pharma Search Ayurveda Private Limited, challenging an order by the Banking Ombudsman, refusing to direct BoB to refund the Rs 76 lakhs allegedly defrauded from their account via cyber fraud.
According to the plea, on October 1, 2022, certain entities/individuals were added as beneficiaries to the petitioner company’s bank account without any OTP sent to the registered mobile number.
On October 2, 2022, Rs 76 lakhs was transferred from the petitioner’s bank account to various unknown individuals via online transactions.
The petitioners immediately lodged a complaint with the Cyber Cell of the Mumbai Police and informed the bank manager of the alleged fraud.
They also sought to know from the bank the steps taken to refund the amount per the Reserve Bank of India’s ‘Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions’ circular of July 2017.
When the petitioners did not receive their refund, they filed a complaint with the Banking Ombudsman.
In January 2023, the Ombudsman rejected their complaint, noting that the transactions were done post-addition of beneficiaries and input of valid credentials known only to the bank account holders, and therefore, there was no deficiency/lapse on the part of the bank.
The bench referred to three reports submitted by the cyber cell police, which said that the beneficiaries were added to the bank account without any message or OTP received on the registered mobile number and email account.
“Thus, there was no intimation to the petitioners about the addition of beneficiaries and the petitioners only received messages on the registered mobile number when the amount from the bank account was actually debited,” the bench said.
The bank submitted to the court that beneficiaries could be added to a bank account only by those with access to the bank account holders’ confidential credentials. The bank argued that the petitioners’ credentials were compromised at the petitioners’ end, hence it could not be held liable.
The court, however, said it was satisfied with the cyber cell reports that the petitioners were not negligent and there was no collusion with the fraudsters.
The court said it is clear that both the bank and the petitioners were victims of fraud by third-party fraudsters.
As per the RBI circular, the petitioner was entitled to a refund of the amount from the bank, and the court directed BoB to refund the Rs 76 lakhs to the petitioner’s bank account within six weeks.
The bench also noted that the Banking Ombudsman did not conduct a proper inquiry and merely stated that the transactions were done post-addition of beneficiaries.
The court highlighted that even BoB has a Consumer Protection Policy (Unauthorised Electronic Banking Transactions) that reiterates the same stance as the RBI circular.
“Both as per the RBI Circular and the bank’s policy, a customer has zero liability when unauthorised transactions occur due to a third-party breach where the deficiency lies neither with the bank nor with the customer but elsewhere in the system, and the customer notifies the bank within a certain timeframe,” said the bench.
Hence, the liability of the petitioners regarding the unauthorised transactions would be zero as the transactions occurred due to a third-party breach where the deficiency lies neither with the bank nor with the petitioners, the court said.
