NCDRC orders SBI to pay Rs 97 lakh as compensation for fraud
Sep 23, 2024
Synopsis
State Bank of India (SBI): A driver managed to change SBI's net-banking access from 'view-only' to 'transaction' and prematurely broke the fixed deposits (FD) kept by a senior citizen couple. This incident which happened in Hyderabad was ultimately solved by National Consumer Disputes Redressal Commission. NCDRC's investigation revealed that it was SBI's fault and hence they are liable to pay Rs 97 lakh.
Driver stole Rs 63 lakh from senior citizen's SBI a/cGetty ImagesDriver stole Rs 63 lakh from senior citizen's State Bank of India a/c using YONO and net-banking; NCDRC orders SBI to give Rs 97 lakh to the senior citizen
After retiring, many seniors choose to open a fixed deposit account in a reputable bank, hoping that the interest income will cover their future expenses. Unfortunately, a senior couple from Hyderabad had their savings, held in State Bank of India (SBI) savings account and fixed deposits (FDs), completely wiped out when their driver gained unauthorized access to their bank accounts.
The elderly couple had over Rs 60 lakh in their SBI savings account and FDs. They had granted 'view-only' access in SBI's internet banking system. Unfortunately, their driver stole their net-banking credentials and used his mobile phone to activate 'transaction facility' in their internet banking account. With this access, the driver prematurely broke the FDs and transferred the money to their account before fleeing from the elderly couple's home.
Once the elderly couple noticed the missing funds, they raised the issue with the SBI branch manager and then subsequently lodged a police complaint. After this, the elderly couple lodged a complaint in the RBI Ombudsman. Failing to get a satisfactory response, the elderly couple filed a case against SBI in the Telangana State Consumer Commission. The fight subsequently escalated to the National Consumer Disputes Redressal Commission (NCDRC) and went on for six years in total.
In the end, both NCDRC and the state consumer commission ruled that SBI provided a deficient service by allowing a 'view-only' access to a net-banking account to be converted to a 'transaction facility' access without proper verification, which led to this fraud.
Read on to find out why NCDRC made this statement about SBI and gain insight into the experience of this elderly couple. This will help you know what steps to take if you encounter a similar situation.
Brief background of the case
According to the order of NCDRC, here are the brief facts of the case:
Elderly couple opened a joint savings account and opened three FDs worth Rs 40 lakh in total on August 9, 2017.
On April 4, 2019, when the couple went to get their passbook updated, found out that only Rs 3 lakh remained in the bank account. The remaining balance (Rs 63 lakh including the Rs 40 lakh FD) was withdrawn.
The elderly couple brought this to the notice of the branch manager and on April 9, 2019, a FIR was lodged at the police station.
How the fraud transactions happened in the elderly couple's SBI savings account
The elderly couple who did not have any smartphones consciously opted for 'view-only' access to Internet banking in their SBI savings account. However, SBI allegedly honoured the access change request in internet banking from 'view-only' to 'transaction facility' made by the elderly couple's driver. The driver using his own phone perpetrated this heist and used the SBI YONO app and internet banking facility to prematurely break all the FDs and transferred the cash to his own bank account and fled.
"He noticed that all unauthorised withdrawals were made through internet banking, although the account had "View Only" facility and did not have internet banking facility for transactions…. The bank's negligence in changing the transaction access without even verification left the vulnerable senior customer exposed…," said lawyers representing the elderly couple at one of the hearings of the case in NCDRC.
The 'unauthorised transactions' passed all necessary security protocols, says SBI
Lawyers representing SBI said that 37 transactions worth Rs 63,74,536 occurred in the elderly couple's bank account, which the couple says is' unauthorised'.
The bank's lawyers said that the 'transaction rights' were enabled by logging into https://www.onlinesbi.com on August 5, 2018, at 11:20 AM. "The bank sent an OTP to the registered mobile number to complete this request on the same day. Thus, the claim that she did not have transaction rights did not hold……All transactions were initiated and completed upon proper validation of customer credentials. Further, each fund transfer was authenticated via an OTP sent to the registered mobile number of the customer. Notifications of deposits/ credits in the savings account were also sent via SMS, indicating that the respondents were aware of the transactions," said the bank's lawyers.
Lawyers representing SBI said, "It is the customer's obligation to prevent unauthorised use of their mobile device and to avoid sharing the mobile banking password/PIN with unauthorised persons. They shared their mobile, PIN number and other details with their associates, and that all disputed transactions were conducted by these associates either in connivance with them or due to their negligence."
Telangana State Consumer Commission hold SBI liable for allowing the 'unauthorised transactions'
The elderly couple directly filed a case against SBI without approaching the district consumer commission. The Telangana State Consumer Commission investigated the case and came to the following conclusion:
It is unfortunate that the biggest Government owned Bank in the Country had resorted to defamatory statements against an old, vulnerable and long-standing customer of theirs'. From the above discussions, we seek to emphasise that it is the fault of the opposite party bank to have linked the complainants' account with internet banking facility without any request from them, which caused the fraud.
They have also failed singularly in not concluding their investigation and finding out from where the initial request was generated to make the complainants' account transactional.
The underlying issue, namely: how did internet banking transaction take place in the first instance when there was no specific permission or authority to do so-shows the possibility of co illusion of one or more members/employees of the opposite party bank.
Telangana State Consumer Commission orders SBI to pay
After reviewing the case details the State Consumer Commission ordered SBI to pay Rs 63,74,527 lakh plus 9% interest from June 11, 2019, and Rs 3 lakh as compensation and Rs 20,000 as costs.
SBI was ordered to pay= Rs 63,74,527+9%*6374,527*5 years 3 months (till September 10, 2024)+Rs 3,20,000 lakh= Rs 97,06,491.
"In the result, the Complaint is partly allowed, and the opposite parties are directed jointly and severally to reimburse the sum of Rs 63,74,527/- along with interest @9% p.a. from the date of the complaint (11.6.2019) till realisation thereafter. We further award a sum of Rs 3 lakhs towards compensation along with Rs 20,000/- towards costs," read the Telangana State Consumer Commission's order.
The Telangana State Consumer Commission relied on precedent set by the Supreme Court in DAV Public School vs. The Senior Manager, Indian Bank case on December 18, 2019.
NCDRC concluded SBI is at fault for allowing internet banking facility without verification
The matter was further escalated by SBI to NCDRC, however, not much changed. AVM J. Rajendra, presiding member, NCDRC came to the following conclusion:
"Internet banking facility is provided as an additional facility to facilitate efficiency. Notwithstanding the same, unfortunately this Internet Banking platform adversely impacted the elderly couple in the present case who are the valued customers of the OP Bank (SBI) wherein, their driver, by being familiar with Account No. details and merely accessing the mobile phone easily misappropriated such high value funds.
This happened even when the Complainants had sought "view only" and internet banking facility was not requested. Change to Internet banking facility was also obtained by the fraudster over the phone itself and perpetrated the offences.
In the present case, the Complainant himself was unaware of the transactions happened in his account due to his old age and presumed absence of scope to check the same over his mobile phone. Evidently, he was not expecting account details over phone and that, most likely, even if certain messages conveying the nature of transactions, transfer of funds and the leftover balance in the Bank Account were received, there is a good possibility that the fraudster had deleted those messages thereby denying any scope for the Complainant to discover the unauthorised transactions.
This included even transfers of physical FD instruments into cash that was deposited in the SB Account of the Complainant which was also misappropriated. Thus, the Internet Banking system which is aimed at efficacy and convenience in banking transactions to the customers, unfortunately entailed severe adverse impact on the Complainants who are elderly people and exposed them to risk of such frauds, even when they had sought "view only" facility.
NCDRC held SBI liable and said, "Change of the banking facility from "view only" to full transactions was allowed in the present case without informed consent of the Complainants."
The order of NCDRC dated July 30, 2024, read, "In view of the discussion above, I am of the considered view that the detailed and well-reasoned Order of the learned State Commission dated 04.08.2022 does not suffer from any illegality or impropriety and no interference is considered warranted." If SBI decides to pay, then the elderly couple stand to get about Rs 97 lakh.
ET Wealth Online's emails to SBI on September 17, 2024, went unanswered as of the time this story was published.
NCDRC points out how SBI could have saved the elderly couple from fraud
AVM J. Rajendra, presiding member of NCDRC, in the detailed order, said how the fraud could have been avoided if the bank followed a new security protocol. The summarised version is as follows:
Change in security protocol could have prevented the fraud: Subsequent this incident and apparently after requisite banking feedback, the Bank changed the Internet Banking system to require such customers to be physically present at the Bank to provide for Internet Banking facility. Clearly this is for ensuring necessary protection of interest of such customers who are not technically savvy and are highly vulnerable for exploitation…..Had such protection been available to the Complainants as well, these unauthorised transactions were unlikely to occasion. By the time the OP Bank (SBI) introduced the correction to the process of changing the option to the Internet Banking system, the consequent exploitation and loss was already suffered by the Complainants.
Different mobile phone was used to conduct the fraud: The transactions were conducted not through the registered mobile number of the Complainants, who did not possess a smartphone, but through another device, as admitted in the fraudster's confession to the police brought before the State Commission (police remand report).
Key legal lessons to learn from the case
Siddhi Doshi, Associate Partner, ALMT Legal, shares some lessons you can learn from this case:
Banks have a duty of care to safeguard customer accounts and information, especially for senior citizens and vulnerable customers.
Customers may approach the consumer forum/commission in addition to the Banking Ombudsman with no risk of double jeopardy, even if criminal proceedings are ongoing.
The consumer forum can legally award damages against banks for deficiency in service and violating consumer rights.
You can file a complaint against a bank even if RBI Ombudsman already passed its order in the same case
"The Respondents also filed a complaint before the Banking Ombudsman, to which the Bank had responded on 11.06.2019. Thus, having invoked the jurisdiction of the Banking Ombudsman, for the same cause of action, a consumer dispute cannot be raised, as it amounts to double jeopardy," said SBI's lawyers before NCDRC.
"Yes, a consumer may approach the consumer forum if they are not satisfied with the resolution of the Banking Ombudsman. This would not amount to double jeopardy," says Doshi.
"Submission of a grievance by a customer to a banking ombudsman is an independent remedy, which has been formulated by the RBI. Submission of grievance before a banking ombudsman and subsequently approaching the consumer would not be tantamount to double jeopardy. The principle of double jeopardy typically prevents an individual from being subjected to multiple trials for the same offence," says Akshat Pande, Managing Partner, Alpha Partners.
Doshi explains why 'double jeopardy' does not apply if a bank customer files a complaint both in the RBI Ombudsman and a consumer forum/commission.
"It has been established that remedies provided under the Consumer Protection Act, 2019 are supplementary to existing laws, therefore pursuing a civil remedy does not infringe upon the rights granted under criminal law. Civil and criminal proceedings are distinct and serve different purposes. Hence, the consumer may seek redress through both civil and criminal avenues simultaneously without facing double jeopardy," says Doshi.
[The Economic Times]
