Bharatkumar Pandya, Member

The present Revision Petition has been filed by the Petitioner/opposite party against the order dated 21.10.2021 passed by the State Commission, Karnataka, in First Appeal No. 825 of 2020, whereby while confirming the order of the District Forum, appeal of the OP bank was dismissed.

2. Brief facts of the case are that respondent/complainant approached petitioner bank on 01.08.2014 for opening of a saving account. The same was opened and the mobile number and email of the respondent got registered with the petitioner bank. Between 23.04.2019 to 27.04.2019, SMSs were sent to the mobile number of the respondent about logins of the saving account over the Net Banking but respondent did not gave any response to the SMSs. However, on 11.05.2019, respondent lodged an FIR with the police for fraudulent transfer of an amount of Rs.1,42,933/- from his bank account. On 13.05.2019 Respondent filed a written complaint with the petitioner stating that there was unauthorized online transaction in her account and someone credited Rs.8,11,203.84 and debited 9,54,137.09 and the respondent further informed that she has only lost about Rs. 1,42,933.25/-. After thorough examination and investigation on the complaint of the respondent, petitioner Bank vide letter dated 07.08.2019 apprised the Respondent that login can be done only with the login id and password which are confidential details and are known to the customer only and the confidential details might have been shared by the respondent to someone knowingly or unknowingly. On 12.09.2019, the Respondent sent legal notice to the petitioner but when bank did not respond to her legal notice, she was compelled to file a consumer complaint bearing CC-1697/2019 before the Bangalore Urban II additional District consumer dispute Redressal Bangalore. As per the petitioner bank, District Forum, without giving them the opportunity of being heard, passed an impugned order dated 22.06.2020 in favour of the respondent/complainant which is reproduced as under:

                   12. POINT NO.3: Having regard to the discussion made in the preceding paragraphs and after considering the evidence and material available on the record, the opposite party is liable to pay Rs.9,52,000/- with interest at 8% p.a. from the date of complaint till realization and pay compensation of Rs.30,000/- and Rs.5,000/- towards cost, of litigation to the complainant. We proceed to pass the following final;

                   ORDER

                   The complaint is allowed in part.

                   The opposite party bank is directed to pay Rs.9,52,000/- (Rupees Nine Lakhs Fifty Two Thousand only) with interest at the rate of 8% per annum from the date of complaint till realization to the complainant.

                   The opposite party is also directed to pay Rs. 30,000/- (Rupees Thirty Thousand only) towards compensation and Rs. 5,000/- (Rupees Five Thousand only) towards cost of litigation to the Complainant."

3. Being aggrieved by the order dated 22.06.2020 passed by the District Forum, petitioner bank preferred an appeal, before the State Commission. State Commission, after appreciating the facts and evidences on record, dismissed the appeal of the petitioner bank and passed an order on 21.10.2021 which is reproduced as under:

                   8. The complainant submits that, as per circular bearing No.DBR.No.Leg.BC.78/09.07.005/2017-18 dated 6th July 2017 of Reserve Bank of India, OP-Bank is bound to credit (shadow reversal) the amount involved in the unauthorized electronic transaction to the customer's account within 10 working days from the date of notify by the customer. Under such situation, we do not find any. reasons to set aside or remand back the case to the Commission below. Because, we feel that, whatever the OP-Bank intends to submit before the District Commission by filing its written version in respect of its case, has submitted before this Commission by filing its written arguments before this Commission and hence, we do not find any solid reasons to interfere with the order passed by the Commission below, as we do not find any prompt attempt of OP-Bank towards its customer in redressing the grievance, which of course amounts to deficiency in service on the part of OP-Bank. Hence, the Commission below has rightly passed impugned order in favour of complainant, does not call for any interference. Accordingly, Appeal No.825/2020 is hereby dismissed with no order as to costs.

                   Amount in deposit is directed to be transferred to the concerned D.F. for needful."

4. We have heard learned counsels for the both the parties and have carefully gone through the entire material on record. It is the contention of the petitioner bank that how can the bank be held liable for the fraudulent transactions in the respondent's bank, when such transactions can only occur if the customer knowingly or unknowingly shared confidential login details. The transaction in the instant case has been done through IMPS and for utilizing the net banking, personal credentials of the respondent i.e. the Login id and the password are must and no transaction can take place without login id and password of the customer/respondent. It is further averred by the petitioner bank that when saving account of the respondent was logged in over the net banking, triggered SMSs were sent on the respondent's registered number but respondent took no note of the same. The respondent was aware of the fact that the SMS trigger of the account login was duly sent to her and the transactions could not take place without the login id and the password which are known only to her. The RBI has issued guidelines which clearly stipulates that in cases where the loss is due to negligence of the customer such as where he has shared the payment/log in credentials, the customer will bear the entire loss till the time he reports the unauthorized transaction to the bank and only the loss occurring after the reporting of the unauthorized transaction shall be borne by the bank. As per RBI circular dated 06.07.2017, bank is bound to credit the amount involved in the unauthorized transaction to the customer's account within 10 working days from the date of intimation and to the contrary the RBI circular clearly stipulates that in case where the loss is because of the negligence of the customer such as wherein he has shared the payment credentials, in such cases the customer shall be liable for the loss.

5. It is further contented by the petitioner bank that in the FIR lodged by the respondent, she has mentioned the loss only to the tune of Rs.1,42,933.25/-whereas in her consumer complaint she claimed an amount of Rs.9,52,000/-. As per petitioner bank, both the fora below have erred in passing the orders without going into the merits of the case and without providing an opportunity of being heard to the petitioner bank. District Forum has failed to consider the major averments of the petitioner and the State Commission also confirmed the order of the District Forum without giving reasons in support of their decision and that too in violation of the limited liability clause of RBI circular no. DBR No. LEG.BC.78/09.07.005/2017-18 dated 06.07.2017. As per petitioner bank, both the fora below have erred in passing the orders in as much as the orders were passed without respondent establishing that her registered mobile number was either tempered or duplicate SIM was issued. The burden to prove that SIM of the respondent was swapped was on the respondent and not on the petitioner and the same was missing in the orders of the State Commission as well as District Forum.

6. Per contra, it is the submission of the respondent-complainant that she is an old customer of the petitioner bank and is having an SB account and she also opened an FD account with them in the month of January, 2019 for a period of 14 months from 28.01.2019 to 28.03.2020 and the maturity amount was Rs.8,77,333.45/-. On 10.05.2019 some stranger operated her SB and FD account and her entire money from both the accounts consisting of Rs.9,54,137.09/- was fraudulently transferred to some unknown account. She informed the petitioner bank about the same and requested the branch manager to redeposit her money back to her account but bank instead of taking any steps, told her to address here grievance through customer care centre. Respondent immediately lodged complaint before the customer care centre but on not receiving any reply either from the bank or from customer care centre, respondent had no other option but to approach the consumer fora. It is contended that the petitioner Bank had not appeared or filed written version before the District Forum and therefore the allegations of negligence or the receipt of and overlooking of alleged SMSs have remained wholly unsubstantiated on record and that the fora below have rightly found deficiency in service of the petitioner and granted due compensation.

7. After hearing the counsels and after perusal of the complete record, we firstly note that the complainant immediately intimated the bank on the next working day about the unauthorized liquidation of her fixed deposit receipts and also about the unauthorized withdrawals of a total amount of Rs.9,52,000/- from the said SB account. The bank statement clearly indicates that serialized withdrawals through unauthorized logins happened at odd hours, for which, as per the petitioner bank, the complainant received the SMSs, which were ignored and therefore it is the complainant's negligence which has caused or contributed to the loss suffered by the complainant and there is no accountability of the petitioner bank. It must be noted however, that before the District Forum, there was no valid defence filed by the petitioner bank within time and hence the right to file such defence was closed. The State Commission has noted that practically a chance of filing the written version was afforded by the State Commission itself when all the submissions of the petitioner bank were taken on record and considered. However, after hearing the parties and after considering the RBI circular of 06.07.2017, the State Commission still concurred with the decision of the District Forum by holding in para 8 of the order that the OP bank is bound to credit the amount of unauthorized debits to the customer's account. The State Commission, in concurrence with the findings of the District Forum, held the petitioner bank liable for deficiency in service and accountable for loss suffered due to unauthorized transactions. The petitioner bank has relied on the circular of the RBI DBR No. Leg.BC.78/09.07.005/2017-18 dated 06.07.2017, to contend that there is no liability of the bank when the customer/account holder has been negligent. The same is reproduced as under:

                   "Limited Liability of a Customer

                   (a ) Zero Liability of a Customer

                   6. A customer's entitlement to zero liability shall arise where the unauthorised transaction occurs in the following events:

                   (i) Contributory fraud/ negligence/ deficiency on the part of the bank (irrespective of whether or not the transaction is reported by the customer).

                   (ii) Third party breach where the deficiency lies neither with the bank nor with the customer but lies elsewhere in the system, and the customer notifies the bank within three working days of receiving the communication from the bank regarding the unauthorised transaction.

                   (b) Limited Liability of a Customer

                   7. A customer shall be liable for the loss occurring due to unauthorised transactions in the following cases:

                   (i) In cases where the loss is due to negligence by a customer, such as where he has shared the payment credentials, the customer will bear the entire loss until he reports the unauthorised transaction to the bank. Any loss occurring after the reporting of the unauthorised transaction shall be borne by the bank.

                   (ii) In cases where the responsibility, for the unauthorised electronic banking transaction lies neither with the bank nor with the customer, but lies elsewhere in the system and when there is a delay (of four to seven working days after receiving the communication from the bank) on the part of the customer in notifying the bank of such a transaction, the per transaction liability of the customer shall be limited to the transaction value or the amount mentioned in Table 1, whichever is lower.

                   Table 1

                   Maximum Liability of a Customer under paragraph 7 (ii)



                   Further, if the delay in reporting is beyond seven working days, the customer liability shall be determined as per the bank's Board approved policy. Banks shall provide the details of their policy in regard to customers' liability formulated in pursuance of these directions at the time of opening the accounts. Banks shall also display their approved policy in public domain for wider dissemination. The existing customers must also be individually informed about the bank's policy. "

8. Mr. Lakshit Raj Gaur for the petitioner bank before us also has tried to find support from clause 7(i) of the RBI circular by alleging that the SMSs for relevant transactions were sent on the registered mobile number, that there is two factors security authentication and hence transactions could not have taken place unless the OTP received on the registered mobile number was fed into the system, or login id and password had been shared by the complainant herself. The remote access to the customer's account were attempted even much prior to the date of incident of loss, i.e. on 23, 25, 26, and 27 April and 8th of May, 2019, though no successful withdrawal could be achieved by the miscreants, for which also the SMSs must have been received by the complainant. The complainant in ignoring such SMSs herself has been negligent in not intimating in time to the petitioner bank. Thus, as per the circular clause 7(i), the liability entirely is on the customer and there is no deficiency in service of the bank. The learned counsel relied on the decision of Kerala High Court in Vinayakumar K. Vs. State Bank of India & Ors. 2025 SCC Online Ker 4139 (para 5 and 8) to contend that when the customer has been negligent in sharing the login details, the case would be governed by para 7(i) of the RBI circular dated 06.07.2017.

9. Responding to the same, Mr. Badrinath, on behalf of the respondent submitted that the RBI circular is being misread by the petitioner bank and that there is absolutely no negligence on the part of the complainant. In the absence of written reply and requisite evidence filed before the District Forum, it is not a valid contention that the complainant has ignored the SMSs for the attempted logins prior to the date of loss or that the complainant has been otherwise negligent. The very fact that the system of the petitioner bank allowed the transactions of transfer from FD account to SB account and thereafter to three different accounts on the same day at odd times would positively show that not only there is no negligence of the respondent but also that the system of the petitioner bank itself has malfunctioned and has wrongly allowed the transfers without lapse of 24 hours after the transferee bank account details were added by the miscreants in the system. The complainant on the first working after the incident of loss intimated to the bank but the amount has neither been retrieved nor necessary further steps taken by the petitioner bank. Thus, on facts, both the fora below have rightly concurrently found deficiency in service on the part of the petitioner bank. No interference is, therefore, within the limited revisional jurisdiction, is called for by this Commission.

10. We having carefully gone through the material on record, are not inclined to interfere with the concurrent findings of fact arrived at by the fora below. First, the averments in the complaint and the evidence before the District Forum, in the absence of valid defence, are unable together to even remotely suggest that there is any negligence on the part of the complainant. The nature and frequency of the transactions and the time of such transactions (i.e. 7 PM and 12 to 1 midnight) leave no doubt in our mind also that this is either a system glitch or some kind of hacking of which the complainant has been the victim. Immediate intimation was given by the complainant. Therefore, in not acting in terms of RBI circular of 06.07.2017, and otherwise having failed in being an efficient custodian of the complainant's funds, the petitioner bank has rightly been found to be deficient in service by the fora below. In our considered opinion also, even in the best case scenario for the petitioner bank and even assuming some contributory negligence of the complainant, the present case is squarely covered by clause 6(a) of the RBI circular (supra) specifying "zero liability" of the customer. It is the duty of the bank in terms of para 9 of the circular to redeposit the lost funds in the customer's bank account within 10 working days wherein the petitioner bank has failed. The decision relied upon by the petitioner bank has no application to the facts of the case because there is no credible evidence of any negligence or of any voluntary sharing of the login credentials by the complainant.

11. The revision petition, being without any merits, is dismissed.