Who bears the loss when someone is tricked into transferring money to cybercriminals, the customer or the bank? Most people believe that if they voluntarily transfer money to a scammer or share an OTP, the loss is theirs alone. But a recent consumer commission ruling suggests that may not always be the case.
In a significant order, the Nagpur District Consumer Disputes Redressal Commission directed ICICI Bank to refund over Rs 5.18 lakh, along with interest and compensation, to a woman. According to a report in Live Law, she lost nearly Rs 6.93 lakh in a FedEx parcel scam.
The case has raised fresh questions about a bank's responsibility to detect and respond to suspicious transactions, even when they are authorised by the customer.
What happened in the FedEx parcel scam
The incident reportedly took place on January 8, 2023, when a woman living in Gurugram received a call from someone posing as a FedEx executive. The caller claimed that an international parcel booked in her name contained two passports, five ATM cards, 300 grams of cannabis and a laptop.
ALSO READ: Zomato Wins Reprieve As Bengaluru Restaurants Push Order Halting Deadline To Sept. 1
When she denied sending the parcel, she was told her identity had been misused and was threatened with police action. Fearing legal consequences, she transferred around ₹6.93 lakh in four separate transactions to an ICICI Bank account controlled by the scammer.
“By creating fear and intimidation, she was induced to transfer amounts of Rs 95,499, Rs 3,07,939.50, Rs 1,90,000, and Rs 99,999, aggregating to Rs 6,93,437.50, into an ICICI Bank account,” she said in her complaint, as per The Economic Times.
What happened after she reported the fraud?
After realising she had been cheated, the woman immediately contacted ICICI Bank and was advised to report the incident on the National Cyber Crime Portal. She also filed a police complaint.
The bank initially provided a temporary (shadow) credit, but reversed it later, stating that all the transactions had been authorised through OTP authentication.
She then approached the Banking Ombudsman, which directed the bank to credit approximately 25% of the disputed amount. Unsatisfied with the relief, she moved the consumer commission to seek recovery of the remaining Rs 5,18,437.
ALSO READ: Who Bears The Cost Of UPI Payments? The MDR Debate Explained
What was ICICI Bank's argument?
The bank opposed the complaint, arguing that the case stemmed from a criminal investigation and was therefore not maintainable. It said the customer had voluntarily transferred the money after authenticating each transaction through OTPs.
The bank also pointed out that the Banking Ombudsman had not found it at fault and had directed the beneficiary bank, not ICICI Bank, to credit around 25% of the disputed amount.
Why did the commission hold the bank liable?
The Commission rejected ICICI Bank's argument that the matter was purely a criminal case, saying that while the cyber fraud itself was a criminal offence, the question of whether the bank had fulfilled its regulatory responsibilities fell within the Consumer Commission's jurisdiction.
It noted that under the RBI's KYC Directions, banks are required to continuously monitor customer accounts and flag unusual or suspicious transactions. The Commission found that the bank failed to monitor the transactions or act quickly after the fraud was reported, and held it guilty of deficiency in service and negligence.
What relief did the complainant receive?
The Commission directed ICICI Bank to pay the complainant Rs 5,18,437, along with 9% annual interest from the date the complaint was filed until the amount is realised. It also awarded Rs 25,000 as compensation for mental agony and Rs 10,000 towards litigation costs, directing the bank to comply with the order within 45 days.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.
