Electronics, Information Technology and Artificial Intelligence Department, Mumbai: In a complaint preferred under Section 46, Information Technology Act, 2000 (IT Act), regarding cyber fraud where complainant’s email account associated with his Foreign Currency Non-Resident (FCNR) account was hacked siphoning USD 92,420 through an international wire transfer to an overseas account in Singapore, the Adjudicating Officer Virendra Singh held the respondent Bank liable for proceeding with transaction without due diligence imposing compensation of USD 58,092.07 along with 12 per cent interest, stating that it fell short of the standard of care expected and that the banks are under a continuing obligation to maintain and periodically update KYC records ensuring a comprehensive customer profile including updated contact details, alternative communication channels, risk profiling of the customer, etc. and if the respondent had exercised due diligence the fraudulent transaction could have been prevented.
The Court held that:
“Any contributory negligence on the part of the Complainant is minimal and does not dilute the higher standard of care imposed upon banks.”
Background
The complainant, a senior citizen and non-resident Indian, had not availed internet or phone banking facilities on his joint FCNR account with Punjab National Bank and relied exclusively on formal written correspondence. He was operating this account since 2005. In January 2013, his email account was hacked inducing a transfer of USD 92,420 through an international wire transfer to an overseas account in Singapore, effected by Bank solely upon email instructions, without proper verification or authentication.
The complainant contended that the respondent failed to implement reasonable security practices and procedures as mandated under the IT Act, which makes them liable for compensation.
The bank was intimated, and a police complaint was lodged with the Singapore Police on 8 January 2013, followed by a complaint with cyber-crime authorities in Mumbai on 11 January 2013.The Bank assured that the funds would be recovered if no fault was found on the complainant’s part but only a partial recovery of USD 34,327.93 was made.
The respondent Bank informed the complainant that the matter stood concluded and denied liability for the remaining loss. Aggrieved by the respondent’s refusal to compensate and alleging gross negligence in handling sensitive financial instructions, this complaint was filed under the IT Act.
Analysis
The Court noted that there were several material discrepancies and suspicious indicators present prior to execution of the impugned transaction such as incorrect spelling of the joint account holder’s name, signature mismatch with Bank records, sudden and urgent request for transfer of substantial funds, sole reliance on email communication without corroboration, lack of prior pattern of such transactions by the complainant, etc.
The Court observed that despite the presence of multiple discrepancies, the respondent proceeded with the transaction without undertaking enhanced due diligence which reflects recklessness and lack of prudence, which falls short of the standard of care expected from a banking institution.
The Court stated that the respondent’s contention of lack of updated contact details and inability to reach the complainant is untenable as banks are under a continuing obligation to maintain and periodically update KYC records, ensuring a comprehensive customer profile, including updated contact details, alternative communication channels, risk profiling of the customer, etc.
The Court noted that the respondent Bank had failed to demonstrate that any periodic KYC updating or verification exercise was undertaken.
The Court held that a bank cannot absolve itself of liability by pleading absence of contact details when such absence is itself a consequence of its own failure to maintain updated records. There exists a direct correlation between the respondent’s failure to act upon evident discrepancies and the resultant financial loss and if the respondent had exercised due diligence, the fraudulent transaction could have been prevented.
The Court further stated that customers are expected to exercise reasonable caution in safeguarding their email accounts and digital credentials but it does not dilute or override the higher standard of care imposed upon banks, particularly where systemic safeguards could have prevented the fraud. The customers not only deposit their funds and valuables with the banks for safe-keep but they repose a trust that their funds and valuables will remain safe.
The Court held that any contributory negligence on the part of the complainant was minimal and did not dilute the higher standard of care imposed upon banks and by failing to honour the trust reposed, the Bank had caused the complainant financial and mental trauma. Therefore, the Bank had failed in its primary duty of keeping the funds of the complainant immune from any fraudulent activity despite several discrepancies.
Decision
The Court directed the Bank to refund the remaining amount of the defrauded funds, i.e., USD 58,092.07 along with 12 per cent interest to the complainant within a period of 4 weeks from the date of the order.
[Jetho Sakhrani v. Chief Manager, Punjab National Bank, Complaint Case No. 1 of 2015, decided on 4-5-2026]
Advocates who appeared in this case:
Complainant: Tejal Patel
Respondent: Puneet Bhasin
