Bombay High Court Directs HDFC Bank to Refund Rs 38 Lakh to Cyber Fraud Victim
In a significant ruling, the Bombay High Court has invoked a 2017 Reserve Bank of India (RBI) circular to order HDFC Bank to remit Rs 38 lakh to a customer who lost the amount in a cyber fraud incident in 2021. The court emphasized that the customer was not at fault and should benefit from the 'zero liability' protection under RBI guidelines.
Court Cites RBI Circular for Customer Protection
Justices Bharati Dangre and Manjusha Deshpande, in their April 6 ruling, highlighted that the purpose of the RBI's July 6, 2017 circular is to provide a safety net for diligent customers who are not negligent or do not contribute to fraud by sharing OTPs. The court stated, "The whole purpose of the RBI circular is to provide a buffer to a customer who is diligent and is not responsible for negligence or contributes to the fraud by sharing OTP."
Details of the Cyber Fraud Case
The petitioner, Pune-based consultant Subodh Korde, reported that on July 14, 2021, within just 41 minutes, Rs 38 lakh was illegally withdrawn through online transactions from two of his HDFC Bank accounts in Pune. Korde had sought a new SIM card due to issues, but the service provider informed him of four SIM changes within two days. The High Court identified this as a case of 'SIM swapping,' a sophisticated form of identity theft, where OTPs from the bank likely went to the cloned SIM.
Key Points from the Petition:
- Korde immediately informed the bank upon noticing the unauthorized debits.
- Senior counsel Sharan Jagtiani argued that without any OTP received from the bank, three unknown beneficiaries were added to his account, and his banking limit was increased from Rs 4 lakh to Rs 40 lakh.
- The petition alleged that HDFC Bank manually approved the addition of these beneficiaries.
Court's Findings on Customer Negligence
The High Court did not find Korde to be careless, noting that he promptly reported the fraud to the bank. It held that HDFC Bank failed to establish any negligence on the part of the customer. The court remarked, "Surprisingly, the bank never took any serious steps, and its stand was of having discharged its obligation by sending OTPs."
The court further stated that Korde was entitled to the 'zero liability' benefit under RBI guidelines, but HDFC Bank denied him this despite clear directions. The ruling directed the bank to remit the amount to his account within eight weeks, along with interest.
HDFC Bank's Defense and Court's Rebuttal
HDFC Bank, represented by senior counsel Prateek Seksaria and advocate Ishwar Nankani, raised a preliminary objection regarding the petition's maintainability against a private entity. However, the High Court countered that as a scheduled bank under RBI control, HDFC Bank is subject to public guidelines aimed at protecting customers from fraud, thus involving a public element.
The court elaborated, "A public authority is not necessarily an authority established under the statute, but if it is the authority which performs duties and carries out transactions for the benefit of the public, it would fall within the purview of 'public authority.' The facts of each case determine whether an authority is public."
Background on Regulatory Framework
Initially, the Banking Ombudsman, whom Korde first approached, found no deficiency in service by HDFC Bank. However, the High Court pointed out that the RBI circular significantly shifts the burden of proving customer liability in illegal electronic transactions onto the bank. This ruling underscores the importance of banks adhering to RBI's customer protection measures in the digital age.
The case highlights the growing challenges of cyber fraud and the legal recourse available to victims, reinforcing the role of regulatory frameworks in safeguarding consumer interests.
