Banks Must Investigate And Refund Unauthorized Transactions, Additional Bangalore District Commission Holds HDFC Bank And Kotak Mahindra Bank Liable

Brief Facts of the Case:

On August 27, 2018, while Mr Satish TN (“Complainant”) was in Ahmedabad, he received SMS notifications on his cellophane indicating that Rs. 50,000 had been transferred from his HDFC bank account in three separate transactions. Alarmed by this unauthorized activity, Mr Satish TN promptly returned to Bengaluru and took immediate action to block his account with the Jayanagar bank branch. Further investigation revealed that the money had been transferred to another account opened in Mr Satish TN's name at a branch in Parel, Mumbai, belonging to Kotak Mahindra Bank.

Within three working days of discovering the fraudulent transactions, Mr. Satish TN filed a formal complaint with the bank authorities, as required by RBI guidelines. He also reported the incident to the police, which led to the identification of an individual in Manipur who had created the Mumbai bank account in his name and transferred the Rs 50,000.

In October 2020, dissatisfied with the lack of action taken by both HDFC and Kotak Mahindra banks to resolve the issue and recover his lost funds, Mr Satish TN approached the District Consumer Disputes Redressal Commission, Shantinagar (“District Commission”) to seek redressal.

Mr Satish TN contended that the unauthorized transactions were a result of hacking into his account, and he had not shared any confidential information with anyone. He argued that both banks were obligated, as per RBI guidelines, to investigate the matter and refund the sum involved in the online breach of his account, given that he had filed a formal complaint within three days. He sought the recovery of the Rs. 50,000 that had been siphoned off from his account, along with compensation for the inconvenience he had endured due to the incident and legal expenses.

The banks argued that the complaint was not maintainable and should be dismissed. They contended that all three transactions were carried out legally using the customer's registered mobile number, with the generation of OTPs, and therefore, should not be considered illegal.

Observations by the Commission:

The District Commission took into account the fact that, within three working days of discovering the fraudulent transactions, Mr. Satish TN had filed a formal complaint with the bank authorities. According to RBI guidelines, a bank is legally obligated to investigate and refund the sum involved in an online breach of an account if a formal complaint is lodged within three days. Despite this obligation, both banks involved in the case had failed to take prompt and necessary action to address Mr. Satish TN's complaint.

Further, the District Commission considered the RBI's guidelines on customer protection, which limit the liability of customers in cases of unauthorized electronic banking transactions. These guidelines specify that a bank is liable to probe and refund the victimized customer the sum involved in an online breach of an account if a formal complaint is lodged within the stipulated time frame. The District Commission emphasized that the burden of proving customer liability in such cases lies with the bank, as per the circular issued by the RBI.

Consequently, the District Commission issued a joint order, compelling both HDFC Bank and Kotak Mahindra Bank to refund the siphoned Rs 50,000 to Mr Satish TN. Additionally, the commission ruled that Mr. Satish TN was entitled to compensation for the inconvenience and hardship he had experienced as a result of the incident, thereby, awarding him Rs 25,000 as compensation and Rs 5,000 towards his court expenses.

Case: Sri. Satish T.N vs HDFC Bank

Case No.: CC/741/2020

Advocate for the Complainant: Venkatesh Prasad

Advocate for the Respondent: Shilpasharad Shrikhande

Click Here To Read/Download Order