ICICI BANK LIIMITED vs MR RAMDAS PAWAR on 10 October 2019

**ORDER**

**A. K. Bhargava** - This appeal has been filed by ICICI Bank Ltd. (ICICI) challenging the order dated 23.11.2011 passed by Learned Adjudicating Officer (AO) in respect of a complaint filed by complainant/respondent Shri Ramdas Pawar. The complainant/respondent had a savings bank account with ICICI Bank and suffered alleged net banking fraud between 27.9.2010 to 1.10.2010 during which Rs.


3,39,950/- had been fraudulently transferred from his savings account to two other accounts held by the alleged fraudsters / beneficiaries with the appellant. Complainant had lodged a complaint with the Customer Care Centre of ICICI on 1.10.2010. Complainant had also filed a police complaint on 4.10.2010 against unknown persons and the ICICI Bank and the police filed its report in the present case on 05.03.2012. According to the police report, the amount was transferred to two ICICI bank accounts and these two account holders could not be traced as the addresses available with the bank were incomplete.

2. While explaining the above chain of events briefly, learned counsel for the appellant submits that ICICI has a robust and advance IT system that powers their net-banking system and millions of e-transactions. On the other hand, he submits that the respondent has compromised his password by responding to a phishing email whereby he provided his user-id and password to the fraudster. He submits that the respondent has admitted it during investigation but concedes that no evidence has been submitted to substantiate this contention. He, however, brings to our attention the observation of Ld. AO in this regard in para 4 of the impugned order, which is briefly captured below :

*"In the present case, no proof has been submitted before me by the ICCI Bank to corroborate their contention that the complainant responded to the phishing mail and that in that mail the complainant disclosed his id and password to the fraudster. However, during the hearing before*

A circular logo with a stylized, serif letter 'R' inside. The logo is centered at the bottom of the page, above a dark, textured horizontal band.

me, the complainant has neither accepted nor denied this allegation. Hence I would concede to their allegation and assume that there was phishing mail to which the complainant responded."

3. Learned counsel for the respondent counters that it is the respondent who has helped in compromise of password through negligence or connivance or both, but concedes that no evidence has been submitted to substantiate this. However, in her support, she draws our attention to learned AO's observation which is produced below *"If one looks at the chain of events in the present case, the fraudster not only knew the email of the complainant registered with the ICICI Bank, but also had opened 2 accounts or had access to 2 accounts with ICICI Bank from where the fraudulent transactions were accomplished. It is not very difficult to understand the link between the phishing mail and the fraudulent transfers and withdrawals. There is clearly a nexus between the phishing mail and fraudulent transfers. It cannot be said that the phishing mail sent by someone who ultimately did not want to be the beneficiary of the funds that are involved in this case."*

4. Considering the above, we find that both parties are relying upon conjectures in blaming negligence on other's part. We shall not venture into making conjectures to ascertain contributory negligence as far as the password is concerned. However, it is not under dispute that under section 43A of the IT Act, appellant bank is required to have secure system and processes. Such secure system and processes would enable it to at least produce logs of the transaction bearing necessary information in case of a reported fraud. Appellant has failed to produce such logs, despite having many opportunities. We have therefore no A circular logo containing a large, bold, serif letter 'R'. The logo is centered at the bottom of the page, above a dark, textured horizontal band.

difficulty in saying that on this count, appellant is deficient in terms of its obligations under section 43A of IT Act.

5. Appellant is also aggrieved that learned AO has put the entire burden of loss due to fraud on him, while the fraud took place due to respondent's contributory negligence in compromising his password. Learned AO has rightly asked the question whether the complainant could be asked to bear all the financial losses that are suffered by him because he responded to a phishing mail. In this case, he answers this question in negative on various grounds. In para 5 and 6 of the impugned order, he alludes to involvement or at least negligence of someone from the ICICI bank. In para 12 and 13 of the impugned order, learned AO also points to various acts of omission and commission, absence of fraud containment practices and laxity in following KYC norms on part of the appellant. Learned counsel for the appellant submits that some of the observations and grounds used by learned AO do not strictly fall under the purview of IT Act or are simply based on assumptions. Without commenting on the merit of all observations, we shall confine only to the basic obligations cast upon the appellant in terms of section 43A of IT Act and prevalent regulations.

6. As per RBI guidelines, banks are required to maintain two layers of security for e-transactions through net banking. First layer of security is password owned A circular logo containing a large, stylized letter 'R'.

by the account holder. We have discussed this part in para 4 above. Second layer of security is generally an OTP (one time password) that is transmitted to the registered mobile number of the account holder. We find no mention in the pleadings that a second layer security of any kind operated in case of these particular transactions. Appellant has also not provided any logs to substantiate that the transactions were completed only after a second layer of security requirement was complied with. Learned counsel for the appellant submits that it is the declared policy of the appellant bank that it strictly follows RBI security guidelines as experienced by thousands of customers and therefore poor quality of pleading or evidence may not be held against it. In our view, mere professing to the commitment to IT security requirements is no enough. Adherence to IT security should be demonstrable, traceable, verifiable and consistent. In this context, pleadings and evidence (or lack of it) only reflect the laxity in meeting the obligations cast upon the appellant bank under section 43A of the IT Act.

7. In facts of the case, we thus agree with the conclusion of learned AO that the appellant bank was lax and deficient in meeting the obligations under section 43A of the IT Act. Having done so, we find no good reason to differ with the award of compensation to the tune of Rs. three lacs granted by learned AO to the respondent. Accordingly, appeal is disallowed.

A circular logo containing a large, stylized letter 'R'.

8. We are informed that the respondent has already received this amount. Hence no further orders are required to be passed for payment of the awarded amount. No order as to costs.

A circular stamp containing the letter 'R' in a serif font.

..... **(S. K. Singh, J)** **Chairperson**

..... **(A.K. Bhargava)** **Member**