Shiva Kirti Singh, Chairperson:— Heard learned counsel for the appellants and learned counsel for the respondent.
2. Learned counsel for the appellants has also filed written notes of arguments and in reply a further written note of arguments has been filed by learned counsel for the respondent. The respondent, as an account holder in the State Bank of India (SBI), suffered a loss of Rs. 18.35 lakh through 20 internet transactions and the money was transferred to 20 accounts, all with the SBI. The account holder/complainant filed Petition No. 1 of 2013 before the learned A.O./Secretary to Government, Information Technology, Electronics and Communications Department, Government of Andhra Pradesh. After hearing the parties in detail and taking into consideration the defence of the Bank, which is the appellants herein, and all the relevant documents, learned A.O. by the impugned order dated 12.3.2014 has allowed claim of the complainant who is respondent herein and directed SBI to pay the entire amount of Rs. 18.35 lakh with interest from the date of loss i.e. 13.5.2012 till the date of payment along with the costs of Rs. 39,750.00. The rate of interest is 18% per annum. Admittedly, nothing has been paid by SBI so far.
3. Learned counsel for the appellants has referred to paragraphs 60-70 of the impugned order and to relevant documents referred therein including the terms and conditions on which the facility of Internet Banking is provided by SBI. He emphasizes that admittedly the complainant had answered a phishing mail sent by fraudster and had disclosed its internet User ID and Password. According to learned counsel, since Password was one of the security measures and it was compromised by the complainant, the Bank should not have been saddled with the liability to compensate the loss and in any case not the entire loss because the complainant had contributed to the loss by its own negligence.
4. In reply, learned counsel for the complainant/respondent has relied upon provisions under sections 43 and 43A of Information Technology Act,2000 to highlight that the Bank, as a body corporate having sensitive personal data relating to its customers, had to implement and maintain reasonable security practices and procedures. He referred to discussions made in paragraph-72 of the impugned order in which the Guidelines of Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds issued by the Reserve Bank of India(RBI) on 29.4.2011 (Exhibit P-8) have been discussed. The discussion highlights that the Bank is required to implement at least two factor authentications through User ID/Password combination and second factor like a digital signature or OTP/Dynamic Access Code through various modes like SMS over mobile phone or hardware token. Even additional security measures such as alerts through, telephone, SMS, e-mail etc. have been advised for transactions for above pre set values. A cooling period for beneficiary addition and SMS and e-mail alerts when internet beneficiaries are added, has also been indicated in the Guidelines. After discussing the features and facts of the case in the background of provisions in the RBI Guidelines, from paragraphs-77 till 83 different features and issues have been discussed and decided, all the findings being against SBI. In paragrapgh-84, it has been concluded that the features like OTP/SMS/e-mail were not provided to the complainant. It has further been discussed that as per Exhibit P-16, the complainant had provided to the Bank all the necessary informations in the prescribed format including its e-mail ID and telephone number.
5. The defence of SBI has been reiterated in this Tribunal that the complainant had not opted for OTP/SMS alert by registering its mobile no. has rightly not been accepted by the A.O. It was the statutory duty of SBI to put in place all the reasonable and effective security measures. It could not be left at the option of account holders and more so when the particulars had already been sought as per format and furnished in 2010 when request was made for Online Corporate Internet Banking.
6. Had the Bank shown that it had complied with the RBI Guidelines and provided additional security measures and even then the money was fraudulently withdrawn due to negligence of the complainant, question of reconsidering the order of A.O. on the basis of contributory negligence could have arisen. However, since the SBI has failed to discharge its statutory burden of providing reasonable security measures, it has it has rightly been directed to pay the entire loss suffered by the complainant. The findings of the A.O. do not require any interference and they are accordingly confirmed.
7. The only issue which requires reconsideration is the issue of rate of interest. Even in March 2014 when the impugned order was passed, 18% per annum was clearly on the higher side. Money could have been borrowed even at that time at a lesser rate of interest, say 12% per annum although the rate of interest has subsequently come down further. Hence, at this juncture, it is deemed just and proper to allow interest for the entire period as directed by the A.O. but only @ 12% per annum. With this modification in the impugned order of the learned A.O. the Appeal is disposed of.
8. The appellants must pay the amount awarded along with interest at the rate indicated above within two months from today, failing which the rate of interest shall revert back to 18% per annum as directed by the learned A.O.
9. The cost of the present proceeding before this Tribunal is estimated at Rs. 50,000.00 and the same shall also be payable to the respondent within the time indicated above. If the payments are not made within two months, the complainant/respondent shall approach the A.O. and seek execution of the judgement and order passed in its favour. Such application, if filed, shall be disposed of expeditiously and in accordance with law.
10. The appeal is disposed of in the aforesaid terms.