Know The Law | Banks' Liability When Customers Lose Money Due To Unauthorised Transactions

While upholding State Bank of India's liability for a fraudulent and unauthorized transaction reported in a customer's bank account, the Supreme Court recently observed that banks cannot shy away from the responsibility to safeguard their customers from unauthorized transactions reported from their accounts.The order was passed in the case of a customer who indulged in online shopping and later tried to return the item. He downloaded an app following a call from a fraudster posing as customer care for the retailer, which led to unauthorized transactions totaling Rs.94,204.80. His bank (SBI) denied liability on the ground that the transactions was authorized as the customer shared OTP (One Time Password) and M-PIN. But, the customer maintained that he did not share OTP or MPIN and the fraud occurred due to a data breach on the retailer's website, over which he had no control.Noting that the customer brought the fraudulent transaction to the notice of the Bank within 24 hours, the Supreme Court rejected SBI's argument that it did not owe liability towards the customer. While cautioning bank account holders against sharing of OTPs with third-parties, the Court however said that in some circumstances, even account holders can be held responsible for negligence.In the backdrop of this order, let's see some of the other instances where judicial/quasi judicial authorities propounded on customers' and banks' liability in cases of unauthorized and fraudulent transactions. We shall also briefly look at RBI's circular dated July 6, 2017 which extensively dealt with the issue and is relied upon by authorities to decide cases of fraudulent/unauthorized banking transactions.RBI Circular On Customers' And Banks' LiabilityOn July 6, 2017, RBI issued a circular to banks across the country regarding unauthorized electronic banking transactions. This circular was the result of a review of criteria for customer liability in cases of unauthorized transactions, given increased emphasis on consumer protection and a surge in grievances pertaining to unauthorized debits from consumer accounts.Among other things, the circular called on banks to put in place fraud detection and prevention mechanism, a mechanism to assess and mitigate risks, as well as a system of continually advising customers on how to safeguard themselves against banking and payments related fraud. As regards reporting of unauthorized transactions, it necessitated that banks intimate customers about the importance of prompt reporting, as longer the delay, higher the risk (to the bank/customer).In terms of the circular, banks are to provide customers with 24x7 access through multiple channels via website, phone banking, SMS, e-mail, IVR, a dedicated toll-free helpline, reporting to home branch, etc.) for reporting unauthorized transactions. The fraud reporting system of banks is also to ensure that customers' complaint is immediately responded to with a registered complaint number. In case a report is made regarding unauthorized transaction in an account, it is for the banks to ensure that no further unauthorized transaction takes place in the account.Adverting to customers' liability in case of unauthorized transactions, the circular provided for two scenarios : one, where customer would have ZERO liability, and two, where customer would have LIMITED liability.A customer is to have zero liability if unauthorized transaction takes place in the event of:(i) Contributory fraud/negligence/deficiency on the part of the bank (in this scenario, whether the transaction is reported by the customer or not is irrelevant);(ii) Third-party breach, where deficiency lies in the banking system (not with a bank/customer) and the customer notifies the bank within 3 working days of receiving the communication from the bank regarding the unauthorized transaction.A customer would share liability for an unauthorized transaction if:(i) Loss occurs due to his negligence: For instance, if customer shares payment credentials, he will bear entire loss until he reports the unauthorized transaction to the bank. If loss occurs after the customer reports, it shall be borne by the bank.(ii) There is a third-party breach and delay (of >3 working days) in reporting: If responsibility for the transaction lies in the banking system (not with a bank/customer) and there is a delay in reporting of the same by the customer to the bank. If the delay is of 4-7 working days since receipt of communication from the bank, per transaction liability of the customer shall be limited to the transaction amount or as stipulated in Table 1 of the circular (whichever is lower). If delay is of over 7 working days, the customer's liability shall be as per bank's Board approved policy.Therefore, unless there is contributory fraud/negligence/deficiency on the part of a bank, the customer's liability depends on the time taken by him to report a fraudulent transaction. When computing the delay, number of working days...

Know The Law | Banks' Liability When Customers Lose Money Due To Unauthorised Transactions

Debby Jain

Tags