1.       The present Revision Petition (RP) has been filed by the Petitioner against Respondent as detailed above, under section 21 of Consumer Protection Act 1986, against the order dated 04.09.2017 of the State Consumer Disputes Redressal Commission, Telangana (hereinafter referred to as the ‘State Commission’), in First Appeal (FA) No. 1223/2013 in which order dated 03.07.2013 of  District Consumer Disputes Redressal Forum-II, Hyderabad (hereinafter referred to as District Forum) in Consumer Complaint (CC) 15/2011 was challenged, inter alia praying for setting aside the order dated 04.09.2017 passed by the State Commission in FA/1223/2013.

2.       While the Revision Petitioner (hereinafter also referred to as OP(s) were Respondents before the State Commission and OPs before the District Forum and the Respondent (hereinafter also referred to as Complainant) was Appellant before the State Commission and Complainant before the District Forum.  

3.       Notice was issued to the Respondent(s) on 24.01.2018.  Petitioner filed Written Arguments/Synopsis on 29.07.2019.

4.       Brief facts of the case, as emerged from the RP, Order of the State Commission, Order of the District Forum and other case records are that: -

The complainant/Respondent herein opened bank account with the Petitioner/OP Bank on 16.01.2008.  On 15.10.2010, the complainant came to know that the amount of Rs.2,000/-, Rs.24,000/-, Rs.24,000/- and Rs.7400/-(Total -Rs.57,400/-) was transferred to third party account on 14.10.2010 and 15.10.2010.  The complainant immediately called the customer care office of OP, the customer care service people advised to approach the OP in person to make a complaint and also stated that the third party account who has withdrawn funds from complainant’s account belongs to one Ashok Saha and account is at Kolkata Branch of HDFC Bank.  The complainant tried to approach  the OP, they were closed on that day due to Durgastami.  On 16.10.2010, the complainant approached OP in person and submitted a written complaint on 16.10.2010.  After receipt of complaint, the OP blocked the account. On 26.10.2010, the complainant lodged FIR before the Sub-Inspector of Police, Hyderabad regarding transfer from the account of complainant to third party.  Bank and the Police did not take any action.  Hence the complainant filed complaint before the District Forum.

5.       Vide Order dated 03.07.2013 in the CC No.15/2011, the District Forum dismissed the complaint with the liberty to approach the civil Court of competent jurisdiction to claim the relief.

6.       Aggrieved by the said Order dated 03.07.2013 of District Forum, complainant appealed in State Commission and the State Commission vide order dated 04.09.2017 in FA No.1223/2023 allowed the Appeal and set aside the order passed by the District Forum.

7.       Petitioner(s) has challenged the said Order dated 04.09.2017 of the State Commission mainly on following grounds:

1. The observation of the State Commission with respect to the fact that the Respondent is educated and can never share her ID password with any person is factually incorrect.  The Respondent was availing the Net Banking Service for a period of  three years.  However, if the net banking is accessed by anyone instant message is sent to the Customer’s registered mobile number and also after a cooling period of 2 hours the beneficiary is added in the account and funds can be transferred, without ID, password and OTP a beneficiary cannot be added.  The Respondent did not raise any objection despite the fact that the Respondent can view the same through her net banking. 

2. The State Commission failed to appreciate that the customer ID and the IPIN are kept absolutely confidential and should not be revealed to any person in writing or through electronic mails or subjecting the confidential details of ID and IPIN within the access of a stranger/third party. 

3. The State Commission has wrongly held that the Respondent has not added any beneficiary and transferred the amount through Net Banking Service from the Petitioner Bank.  The State Commission failed to appreciate that the Respondent had added a third party on 13.10.2010, in this respect after a cooling period of 24 hrs  the beneficiary was activated, despite alerts were sent to the registered mobile number, therefore, the State Commission erred in holding that the Petitioner has connived with the third party, who is also a customer of the Petitioner.

4. The State Commission failed to appreciate that at the time of opening the Account on 08.02.2008, the Respondent was provided an Instant Kit wherein the Respondent acknowledges receipt of Customer ID and IPIN from the Petitioner, which were highly confidential and was not supposed to be compromised with anyone. The State Commission failed to appreciate that for the four transactions in question, the Respondent either had transferred the amount or compromised it with someone else. The State Commission erred in holding that the terms and conditions agreed between the parties are binding and the ID and password are confidential and not to be shared with anyone.  Therefore, the terms of the contract cannot be interpreted. In this regard the Petitioner has relied upon judgment  in “Bharathi Knitting Co. Vs. DHL Worldwide Express Courier” (1996) 4SCC 704, wherein it has been held that the Forums and Commission are not entitled to modify the terms of the agreement, which had been arrived at between the parties and when there is an acute dispute relating to facts, the Forum and Commission ought not have gone behind the terms of the Agreement and should have instead referred the parties to the Civil Court.  The Petitioner has also relied on the judgment in Patel Roadways Ltd. Vs. Birla Yamaha Ltd. Appeal (Civil) 9071 of 1996 and in the case titled Citicorp Maruti Finance Ltd. Vs. S. Vijayalakshmi  Civil Appeal No. 9711 of 2011 passed by Hon’ble Supreme Court.  The Petitioner also relied upon the judgment of this Commission in  HDFC Bank Ltd. Vs. Kanwar Ohri & Ors. (RP No. 2001 of 2012) decided on 12.08.2014. 

5. The State Commission failed to appreciate that the Respondent has availed third party transfer through Net Banking facility and she the said account was operated regularly by the Respondent continuously for three years.  The Respondent failed to bring on record the evidence to show that the alleged transactions were effected on account of Bank’s deficient service or negligent act.  The State Commission failed to appreciate that for the operation of banking services through Net Banking Facility there remains no direct or indirect involvement at the end of the Bank. All such transactions initiated through Net Banking can only be done by the customer by using the customer ID provided to him/her and the confidential IPIN.  The State Commission erred in not waiting for the outcome of the Police Investigation, which would reveal  who is responsible for the transfer of the amount from the account of the Respondent, the complaint was filed by the complainant on 26.10.2010 with Central Crime Station, Hyderabad.  FIR is already lodged in respect of the present case, which is still pending, which suggest that the present case involved complicated question of facts and law which cannot be decided summarily as in the present proceedings.  Reliance is placed on Bright Transport Co. Vs. Sangli Sahakari Bank Ltd. Reported in II (2012) CPJ 151 (NC).  The Fora below failed to appreciate the well settled proposition of law as held by the Apex Court in Synco Industries v. State Bank of Bikaner & Jaipur & Ors. Reported in (2002) 2 SCC 1.   The decision of Apex Court was followed by this Commission in CC 217/2006 titled as Bhagwati D. Patel Vs. The Chairman & Managing Director, Indian Bank, III (2011) CPJ 175 NC. 

6. The State Commission was not justified in directing the OPs to deposit the entire transaction in question back in the account of Respondent even without considering the entire facts on merits. The order of the District Forum was reasoned and there was no reason for the State Commission to interfere and set aside the order.

8.       Heard counsel for the Petitioner.  Respondent was proceeded ex-parte on account of his absence despite service. Contentions/pleas of the Petitioner, on various issues raised in the RP, Written Arguments filed by the Petitioner and Oral Arguments advanced by the Petitioner’s counsel during the hearing, are summed up below.

8.1  In addition to the averments made under the grounds (para 7), the petitioner contends that while opening the saving account and applying for internet banking, the Respondent got her contact No. i.e. +91-9885034170 and E-mail ID with Petitioner for INSTAQUERY and INSTAALERT.  Since then the Respondent was using the Internet Banking for a continuous period of three years i.e. 2008-2010. On 13.10.2010, an account of Mr. Ashok Saha was added as the beneficiary for Third Party Transfer in her account which was followed by four separate transactions from Respondent’s Account for a total sum of Rs.57,400/- .   Following the transaction SMS alerts and e-mail alerts were sent to the registered mobile number as well as to the Registered Mail ID of the Respondent.  Once a beneficiary is added to the account a cooling period 24 hours is given to the customer before that a transaction cannot take place. As per the complaint filed by the Respondent, she only got to know about the four transactions on 16.10.2010, which she claimed to be unauthorized transactions.  The complainant lodged FIR and also filed complaint before the Central Crime Station, Hyderabad.  After detailed examination of documents and pleadings placed on record, the District Forum dismissed the complaint of the Respondent.  The State Commission wrongly held that the Respondent has not added any beneficiary and transferred the amount through Net Banking Service from the Petitioner Bank. The State Commission has wrongly held that the Petitioner Bank had knowledge of the fraud that had occurred, wherein some amount was transferred fraudulently to the account of third party.  The Bank was merely providing the services and must not be responsible as a party to the transaction.

8.2  Respondent was proceeded ex parte vide order dated 08.09.2021. No reply or written submissions were filed by the Respondent at any stage during the pendency of Revision Petition before this Commission.

9.       We have carefully gone through the order of the State Commission, District Forum and other relevant records.  A perusal of the order of  the District Forum shows that it had gone at length into the various security measures given by the HDFC Bank with respect to internet banking system, in particular relating to Login Security System, IPIN Security, Session Security, Insta Alert etc. and duly considered the rival contentions of the parties before coming to a finding that the Petitioner HDFC Bank was not at fault.  The District Forum observed that there is no evidence to show whether complainant received any SMS from the OP after adding third party, the OP immediately after receiving the complaint, blocked the account of the third party, but the third party had already withdrawn the amount through ATM.  The District Forum observed that the complainant did not take sufficient care for maintaining user ID and Password and therefore, observed that complainant can approach Civil Court for the recovery of the amount. 

10.     In Appeal, the State Commission set aside the order of the District Forum, allowed the Complaint and directed the Petitioner Bank to deposit an amount of Rs.57,400/- in the account of the complainant with interest @9% p.a. from 16.10.2010 till the date of deposit along with Rs.10,000/- towards compensation and Rs.5,000/- as litigation costs.  A careful perusal of the order of the State Commission sows that it has not given valid reasons for reversing a well-reasoned order of the District Forum.  We are in agreement with the contentions of the Petitioner Bank that the complainant, who was availing internet banking services for the last three years, was fully aware of the internet banking system and in the given facts and circumstances of the case, it was not possible for any third party to get the amount transferred from her account without the complainant sharing her login ID/password credentials.  We are not in agreement with the observations of the State Commission that “Nobody discloses customer ID and password to third parties and give a chance to commit fraud to withdraw amount from one’s Account, that too, to a person who is at a far of place without his identity.  Further, she is educated and working as Software Engineer and hence we can expect that she is well aware of it.  For the sake of arguments, if we assume that she revealed her customer ID and password to Mr. Ashok Saha, she would not dare to give complaint to the policy by involving herself into the fraud.”  Just because the complainant is an educated lady working as Software Engineer does not mean that she can do no mistake with regard to usage of her internet banking accounts.  There are sufficient security checks for transfer of funds to the third party’s account, for which third party has to be added before-hand by login with user ID and Password and subsequently, at the time of transfer of funds one time password comes on the registered mobile number of the customer.  The Respondent herein has not placed any cogent and reliable evidence to show that bank was deficient in service or that the wrongful transactions/transfer of money happened due to any fault on the part of the Bank.  The State Commission has misinterpreted the action of the Petitioner  Bank in immediately blocking the account  of Mr. Ashok Saha on receipt of the complaint  by observing that “In this connection, it is to be observed that the respondents’ bank already held their responsibility, but, to some extent, i.e., by blocking the account of Mr. Ashok Saha in Kolkata on the complaint of the appellant/complainant.  If they have no responsibility how could they block his account and on what right they have acted upon it by blocking the account of Mr. Ashok Saha.”

11.     In this regard, we have also carefully gone through the circular No. RBI/2017-18/15 DBR.No.Leg.BC.78/09.07.005/2017-18 dated  July 6, 2017 issued by RBI on the subject of Consumer Protection Act –limited liability of customers in unauthorized Electronic Banking Transactions as well as earlier Circular No.  DBOD LEG.BC.86/09.07.007/2001-02 dated April 8, 2002.  Relevant extract of these circulars is given below:

 “Limited Liability of a Customer

(a) Zero Liability of a Customer

6. A customer’s entitlement to zero liability shall arise where the unauthorised transaction occurs in the following events:

(i) Contributory fraud/ negligence/ deficiency on the part of the bank (irrespective of whether or not the transaction is reported by the customer).

(ii)  Third party breach where the deficiency lies neither with the bank nor with the customer but lies elsewhere in the system, and the customer notifies the bank within three working days of receiving the communication from the bank regarding the unauthorised transaction.

(b) Limited Liability of a Customer

7. A customer shall be liable for the loss occurring due to unauthorised transactions in the following cases:

In cases where the loss is due to negligence by a customer, such as where he has shared the payment credentials, the customer will bear the entire loss until he reports the unauthorised transaction to the bank. Any loss occurring after the reporting of the unauthorised transaction shall be borne by the bank.

In cases where the responsibility for the unauthorised electronic banking transaction lies neither with the bank nor with the customer, but lies elsewhere in the system and when there is a delay (of four to seven working days after receiving the communication from the bank) on the part of the customer in notifying the bank of such a transaction, the per transaction liability of the customer shall be limited to the transaction value or the amount mentioned in Table 1, whichever is lower.

                       xxxx

 Further, if the delay in reporting is beyond seven working days, the customer liability shall be determined as per the bank’s Board approved policy. Banks shall provide the details of their policy in regard to customers’ liability formulated in pursuance of these directions at the time of opening the accounts. Banks shall also display their approved policy in public domain for wider dissemination. The existing customers must also be individually informed about the bank’s policy.”

From the above circular, it is clear that in cases where the loss is due to negligence by a customer, such as where he has shared the payment credentials, the customer will bear the entire loss until he reports the unauthorised transaction to the bank. Any loss occurring after the reporting of the unauthorised transaction shall be borne by the bank. In this case, as the loss occurred to the customer till the date/time of reporting i.e. with respect of transfer of Rs.57,400/- under four transactions, it has to be borne by the Respondent/complainant.  Immediately on receipt of the complaint, the Bank blocked the account of third party Ashok Saha.  No loss has happened after the date of reporting.  Hence, Bank is not liable. 

12.     In view of the foregoing, we are of the considered view that in the instant case, the Bank was not at fault and State Commission went wrong in reversing a well-reasoned order of the District Forum.  Hence, the order of the State Commission cannot be sustained.  Accordingly, we hereby set aside the order of the State Commission and restore the order of the District Forum.  Accordingly, the Revision Petition stands disposed of. 

13.     The pending IAs in the case, if any, also stand disposed off.