Banks are legally obligated to compensate customers for money lost in cyber fraud if they are promptly notified. Failure to do so is considered serious negligence.
The Navsari Consumer Disputes Redressal Commission (CDRC) made these strong statements while ordering the State Bank of India (SBI) to pay a UPI cyber fraud victim Rs 39,578.
The victim had personally visited the branch on the same day she lost the money. The commission noted that the bank could have acted promptly, as it has all the technical resources to track where the stolen money was deposited.
In this case, Vidhi Suhagiya, a Navsari resident with an account at the SBI’s Fuvara branch, lost Rs 59,078 in cyber fraud on December 22, 2021. The money was debited from her account without her knowledge.
She immediately visited the branch and reported the fraud. After she filed a complaint with the cyber crime helpline, police were able to freeze Rs 19,500 that had been deposited into a Federal Bank account.
Following a court order, the money was transferred to Suhagiya’s account. However, the bank was slow to respond to the remaining Rs 39,578. On December 14, 2022, Suhagiya sent a legal notice to SBI. When the bank did not respond, she filed a complaint with the consumer commission.
Suhagiya’s lawyer argued, “The bank informed us that Rs 39,578 had been transferred to an ICICI Bank account. However, they took no steps to recover it. The amount was debited through UPI without the customer sharing her OTP or password with anyone.”
The bank’s lawyer argued that Suhagiya had been defrauded due to her own carelessness and that the bank was not liable to compensate her. The lawyer also stated that it was only because of the bank’s SMS system that Suhagiya had become aware of the debit.
The bank also argued that it had acted promptly on the complaint and followed banking guidelines. The bank claimed that it had sent an email to the UPI authority, which had replied that the amount had been deposited in ICICI Bank and that steps had been taken to freeze the amount.
However, the CDRC rejected the bank’s arguments, stating that the mistake was the bank’s, not the customer’s, and that the bank was therefore liable to compensate Suhagiya. The commission observed that the complainant had informed the bank on the same day as the fraud, “but there is no evidence on record that the bank had acted on the complaint”.
The commission also noted that when any amount is debited from an account, the bank has online details about the account it has been deposited in. Therefore, if the bank wants, it can inform the other bank to stop payment or freeze the amount. In this case, the bank failed to do so, which resulted in financial loss to the complainant.
The bank also failed to provide any evidence that it had tried to recover the amount. The commission concluded that “the bank did not act promptly on the complaint and committed serious carelessness and a mistake in service.”