IDBI BANK vs MR SUDHIR S DHUPIA on 13 August 2019

**ORDER**

**A. K. Bhargava** - This Cyber Appeal no. 7 of 2013 has been preferred by the applicant bank IDBI Bank Ltd. on 5.7.2013. The respondent/complainant Mr. Sudhir S Dhupia was operating savings bank account no. 009104000098713 with the appellant since 8.12.2004. It appears that the respondent got an email alleged to have been sent in the name of applicant bank in which he was asked to provide the confidential and personal information including the net banking ID and password besides other information. The respondent provided the information by clicking another link provided in the said e-mail. From the routine weekly account statement being sent by the applicant bank on 20.12.2009, respondent came to know that some unauthorised transactions had taken place on 15.12.2009 amounting to total of Rs. 81,700/- through two transactions (one transaction of Rs. 50,000/- and another of Rs. 31,700/-). The amounts were transferred from the respondent's bank account to another account being maintained with applicant bank. The respondent made complaint to the applicant bank on 20.12.2009. Pursuant to this complaint, accounts bearing no. 125104000073051 (Mr. Kulbir Singh Chilotre) and 197102000002219 (M/s Mac Ley Enterprises) were frozen by the applicant bank on 21.12.2009. By this time the money had already been withdrawn by the respective account holders. The applicant bank conducted an internal enquiry about the said accounts and also lodged police complaint at Navrangpura Police Station on 4.1.2010. The concerned Police Station after investigation moved to the Court and the matter is pending in the Court. Not satisfied with the applicant bank, the respondent preferred complaint No. 3 of 2010 before the learned Adjudicating Officer of Gujarat on 27-1-2010.


2. Ld. AO passed an order on 28.3.2013, awarding a total compensation of Rs. 1,00,000 in favour of the respondent. Operating part of the order is reproduced below:

*"In view of the aforesaid submissions made by the parties, following points arise for consideration in this application.*

1. 1. *Whether the applicant has suffered a loss on account of the negligent practices by respondent?*

2. 2. *Relief*

*Point No. 1 : Considering all the factors listed above that combine to influence the conclusion that Respondent bank namely IDBI Bank Ltd. has failed to establish that due diligence was exercised to prevent the contravention of the nature of unauthorised access as laid out in section 43 of IC Act, 2000, Office of the Adjudicating Officer finds the petitioner justified in the instant case. The respondent bank has failed to put in place a fool-proof internet banking system with adequate level of authentication and validation which would have prevented the type of unauthorised access in the instant case that has led to a serious financial loss to the petitioner customer. The basic loophole in ensuring that a customer recognises an email as from the respondent bank was a glaring error on the respondent's part that would have prevented this severe incident. The Degree of Connivance or complicity may be debated upon but the neglect of the personnel of the respondent bank both immediately prior to and immediately after the loss in protecting the interests of the customer are clearly evident. Adequate checks and safeguards have not been planned together with the fact that the efforts to investigate and track the fraudster who was subject of its own procedures in being made a customer are seen to be poor. The know your customer norms have been violated in letter and in spirit. The petitioner has been made to run around in search of justice and retribution following the incident without any support from the bank. The respondent bank is found guilty of the offences made out in Section 85 read with relevant clauses of section 43 of Information Technology Act of 2000.*

A circular stamp or seal is located at the bottom right of the page. It contains some internal markings that are difficult to discern, possibly initials or a logo, but it appears to be an official mark or signature stamp.

Office of Adjudicating Officer of Gujarat also relies on the landmark judgment passed by Office of Adjudication Officer of Tamilnadu in the similar case of Shri Umashankar Sivasubramanian Vs. ICICI Bank specifically para numbers 15 to 26 highlighted by the petitioner.

Point No. 2 Relief : As regards, the quantum of compensation, attention is drawn to section 47(b) of IT Act 2000 and accordingly losses suffered as a result of default shall be considered. Petitioner has faced various losses. As stated in sub – point (g) of para -5 above. Accordingly, total amount is expected of respondent bank to pay the petitioner for all the losses suffered by him is more than Rs. 1,00,000/-. However, petitioner has made application for compensation claim of Rs. 1,00,000. Accordingly, respondent bank namely IDBI in instant case is directed to pay a total sum of Rs. 1,00,000/- (Rupees one lakh only) to the petitioner within 60 days from the date of issue of this judgment.

*The application is disposed with the above direction."*

3. Aggrieved by the order of Ld. AO, the appellant has preferred this appeal on 5-7-2013 with the following prayers:

"(a) Pass an order setting aside the order dated 28.3.2013 as passed by Ld. Adjudicating Officer and Additional Chief Secretary, Science and Technology Department, Government of Gujarat, Block No. 7, 5^th Floor, Sachivalaya, Gandhinagar, Gujarat in complaint bearing no. 3/2010, titled Sudhir S. Dhupia Vs. IDBI Bank Ltd.

(b) Pass any other order in favour of the appellant in view of the facts and circumstances of the present case."

4. The matter has proceeded ex-parte in view of continued absence from the respondent's side.

5. Main argument advanced by learned counsel for the petitioner is simple. According to him, leaned AO has failed to consider gross negligence of the respondent which led to the alleged fraud and consequent loss to the respondent. He also submits that the appellant bank had taken all possible steps to educate/alert the respondent and thus no responsibility could be attached to the appellant bank. Accordingly, he wants the award of compensation given to the respondent to be set aside on grounds of natural justice.

6. Alleged negligence of the respondent has arisen on account of the e-mail from email account secureaccounts@idbi.co.in to the email account sudhidhupia@rediffmail.com which is the registered email account of the complainant. This email asked the complainant to click on a given hyperlink <http://www.idbi.com/Security/AccountsConfirmation>. Complainant clicked on the hyperlink and filled up the information asked, thereby compromising his net banking ID and password. Appellant's case is that the petitioner ought to have been careful and vigilant and should not have disclosed vital and sensitive personal information to the third party. Appellant claims that it has sent emails/sms alerts to customers cautioning them not to reply to phishing emails/phone calls etc. Additionally, a pre-login caution page is also flashed every time a customer logs in. Appellant has annexed samples of such communication in Annexure 4 & 5. Appellant further mentions in the petition that the complainant has retrieved the alleged email from Trash box instead of inbox and did not call customer care of appellant bank or visit the nearest branch to verify the genuineness of such mails. Appellant claims that such actions/omissions amount to gross negligence on part of the complainant making him responsible for his loss.

7. Learned AO has not faulted the appellant for not educating the customers. Educating customers is a good practice and serves the purpose of reducing frauds. However, such efforts will not absolve the Bank if it is found wanting in its obligations under IT Act or if it is in violation of any provisions of the IT Act. From the perusal of the order dated 23-5-2013, it is apparent that learned AO has faulted the appellant Bank for not implementing good security practices and procedures resulting or assisting in the occurrence of the fraud.

8. Learned AO, in his conclusion, has relied upon section 43 read together with section 85 of the IT Act 2000. Section 85 refers to offences by companies and provides that in case of contravention of the Act, not only the company but other persons described in section 85 may also be held liable for such contravention. Section 43 provides for penalty and compensation in wide ranging situation and 43 (g) specifically invokes this provision in case any person "provides any assistance to any person to facilitate access to a computer, computer systems or computer network in contravention of the provisions of this Act, rules or regulations made thereunder". Section 43 A is more specific in regard to the obligations of the body corporate such as the appellant bank while dealing with sensitive personal data or information in a computer resource which it owns. Section 43 A is therefore particularly relevant and is reproduced below *"43A Compensation for failure to protect data - Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected.*

*Explanation: -For the purposes of this section -*

*(i) "body corporate" means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities;*

*(ii) "reasonable security practices and procedures" means security practices and procedures designed to protect such information from unauthorised access, damage, use, modification, disclosure or impairment, as may be specified in an*

*agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit;*

*(iii) 'sensitive personal data or information' means such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit."*

9. Appellant has dismissed the alleged e-mail as a case of phishing. We are aware that there are many ways in which phishing frauds are carried out and some of them may be beyond the control of the concerned Banks. In this case, it is not in dispute that the domain names *idbi.co.in* and *idbi.com* are the registered domain names of the appellant Bank. We further notice that the domain name in the alleged e-mail which led the respondent to divulge his details was *idbi.co.in* and the alleged leading URL link too had *idbi.com*. This could have only happened either through connivance or due to security lapse of the appellant's IT system including its mail server(s). Neither the appellant has offered any explanation for this in its pleading, nor the learned counsel for the appellant could provide any explanation despite being given opportunity to seek instruction in this regard. We are therefore in agreement with the conclusion of learned AO that appellant has failed to provide secure net banking system which would have averted occurrence of such e-mail and prevented the fraud.

**10.** While the appellant has failed to provide reasonable security to avert such communication bearing his domain name, he merely passes on the onus to respondent for being negligent. On careful perusal of section 43A, we find that the corporate entity owning the computer resources and dealing with personal sensitive information or data, has specific obligation cast upon it which has no provision for exception and thus cannot be disowned. The fact that such a lapse leads a customer to act(s) which may tantamount to negligence or contributory negligence, cannot absolve such corporate entity of the consequences of its own lapse as provided in the relevant section of the Act. We are therefore in agreement with the conclusion of learned AO that the appellant is guilty and liable for violation of section 43 read with section 85. We shall only add that the petitioner is also guilty of violation of section 43A since it is found to be negligent in implementing and maintaining reasonable security practices and procedures, thereby causing wrongful loss to the respondent.

11. Learned AO has also relied upon the orders in case of ***Shri Umashankar Sivasubramanian Vs. ICICI Bank*** wherein the learned AO had held the Bank guilty and awarded compensation to the complainant. This order was challenged by the Bank in Cyber Appeal 1/2019 in which this Tribunal vide judgment dated 10-1-2018 also held that the Bank was liable to pay compensation for violation of section 43 and 43A of the IT Act 2000.

12. In the facts of the case, we hold appellant Bank guilty of violation of section 43 and 43A of the IT Act 2000 and accordingly hold it liable to pay compensation to the respondent for causing wrongful loss.

13. Having held the appellant liable to pay compensation, only question that remains is the quantification of the compensation. Learned AO in this case has gone into all the details and circumstances while considering the compensation and then arrived at a reasoned amount. We find no reason to differ with the compensation amount of Rs. 1,00,000 awarded by the learned AO.


14. Accordingly, Cyber Appeal 7/2013 is disallowed with a direction to the appellant Bank to pay Rs. 1,00,000 (One Lakh only) to the petitioner within 30 days from today. No order as to costs.

A circular stamp containing a large, stylized letter 'R'. The stamp appears to be a seal or a mark, possibly from a court or official institution.

..... (S. K. Singh, J) Chairperson

..... (A.K. Bhargava) Member