I. Introduction

The Hon’ble High Court of Kerala (“Court”) recently ruled that customers of banks who are victims of unauthorised transactions cannot be made liable to such banks if transactions have an element of fraud in them. It impressed the burden on banks to enforce their claims on the borrowers in such cases observing that the banks have a fiduciary duty to undertake measures to protect customers from occurrences of fraud in online transactions.

II. The case

1. The Court was adjudicating upon a couple of writ petitions filed by victims of identity theft and fraudulent transactions by which unauthorised debits were made from their loan accounts maintained in their respective banks. The Court noted that the Securitisation and Reconstruction of Financial Assets and Enforcement of Security Interest Act, 2002 (“SARFAESI Act”) provides power to the bank to determine liability in case of banking transactions from a loan account where a security interest is created in their favour. According to the SARFAESI Act, the onus then lies on the customer to challenge the bank’s determination of liability, but the Court affirmed the exclusion of applicability of the act in cases involving allegations of fraud i.e. disputed transactions (explained in section III).
2. The Petitioners brought to the Court’s notice a circular by the Reserve Bank of India (“RBI”) bearing DBR.No.Leg.BC.78/09.07.005/2017-18 dated 6^th July 2017 (“RBI Circular”) which entitles customers to zero liability if they are not to blame for fraudulent transactions. The RBI Circular details two instances where customers are entitled to zero liability: (a) when the transaction is due to contributory fraud/negligence/deficiency from the bank’ end; and (b) when neither the customer nor the bank is to blame for an unauthorised transaction done by a third party provided that the customer notifies the bank of the same within three days.
3. The Court considered the investigation report submitted by the police and concluded that since the customers had no role to play, liability cannot be placed on them by the bank. It reaffirmed the applicability of the RBI Circular excluding the customer from any liability. It clarified that the bank can independently pursue a claim against the fraudsters for the recovery of funds.

III. Question of ‘disputed transaction’

1. While excluding the applicability of the SARFAESI Act in cases of disputed transactions, the Court considered what such transactions may entail. It observed that the examples provided in the RBI Circular merely illustrate a non-exhaustive list of disputed transactions. Disputed transactions are ones, which are prima facie tainted by fraud, where the validity of the transaction itself is under question. To classify transactions as disputed, reliance is placed on independent adjudication rather than the bank’s determination of liability and on the nature of allegations.
2. The Court observed that the responsibility of a bank towards its customers is not merely contractual but also fiduciary in protecting them from the vulnerability of online transactions. It noted that the onus is on banks to use counter technologies to ensure the security of online transactions and avoid the occurrence of such disputed transactions.

IV. Comments

The increasing push on financial inclusion and digitisation in the banking industry has naturally seen more and more transactions happening in the online space. This has also given rise to an increasing number of illegal transactions putting customers’ financial assets held in banks at risk. Banks, in turn, have imposed numerous security measures but these never seem to be enough. Nevertheless, constantly evolving challenges to secure banking should not make the unwitting victim i.e. the customer pay the price. In this light, the judgment of the Court is a welcome move affirming the policy of zero liability on customers by the RBI. Banks, in turn, must scale up security measures and be on alert for any suspicious activity in their accounts. Not undertaking sufficient measures would also come at the expense of further costs spent in pursuing recovery claims by these banks against those responsible.

For any comments or queries, do reach out to us