A consumer court in Tamil Nadu has ordered a bank to pay Rs 1.10 lakh to a customer after failing to take action on her prompt report of a Rs 50,000 phishing scam. The Thanjavur District Consumer Disputes Redressal Commission ruled that the financial institution committed a deficiency in service by remaining passive after receiving immediate notification of the unauthorized debit.
Breakdown of Compensation Order
Under the order issued on July 28, a bench comprising Commission President T Sekar and member K Velumani directed the bank to refund the stolen sum of Rs 50,000 to the account holder. The panel also awarded Rs 50,000 as compensation for mental distress, financial hardship, and inconvenience, along with Rs 10,000 to cover legal costs.
Sequence of the Cyber Attack
The fraudulent transaction occurred after the complainant received a text message advertising a reward of Rs 12,980. After clicking the embedded link and logging in with her online banking details, she received a one-time password message. Shortly after, she discovered that Rs 50,000 had been transferred out of her account through an unauthorized beneficiary addition.
Immediately after noticing the debit, the customer contacted the bank’s customer support line, lodged an online complaint, and reported the matter to cybercrime officials. She later approached the consumer commission seeking a full refund and Rs 1 lakh in damages.
Defense Arguments and Ruling Rationale
The bank contested the petition, stating that the transaction occurred because the account holder voluntarily disclosed her login credentials, password, and security codes on a malicious link. Asserting compliance with Reserve Bank of India security guidelines, the bank contended that the loss resulted from individual negligence rather than service failure.
However, the commission highlighted that the bank failed to submit any records proving what measures were taken once alerted to the incident. Citing Section 2(11) of the Consumer Protection Act, 2019, the panel held that financial institutions cannot evade statutory responsibilities or reflexively blame customer oversight when an account holder acts swiftly upon discovering cyber fraud.
The panel concluded that while banks are not liable as insurers for every cyber crime, they remain obligated to act upon fraud reports made by their customers.
