Bank Liable for Failure to Give OTP / SMS Alerts in Cyber Fraud Transactions
Judgment dated 4.8.2026 of TDSAT in Cyber Appeal No.10 of 2020 of Manvir Singh Vs. ICICI Bank
Cyber Appeal under Section 57 of the IT Act against the order of the Adjudicating Authority under Sections 43 and 46 for damages of Rs.15 lakhs and interest against the Bank in respect of 98 unauthorised transactions without OTP, SMS and two step verification process as required by Payment and Settlement Act.
First one was, whether the respondent bank has defaulted or compromised, in maintaining reasonable security practices, in any manner whatsoever, as per the mandate under section 43A of the Information Act? Second, whether the respondent bank is liable to compensate to the complainant, under section 43 of the Information Technology Act? Third, whether by not issuing alert messages to the customer / complainant by the Respondent bank, during online transactions, the Respondent has committed default, under the Information Technology Act and thus liable for compensation?
n exercise of powers conferred by Section 43A of the Information Technology Act, the Central Government made Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information), Rules 2011, for the protection of sensitive personal data of the consumer and reasonable securities practices to safeguard against unauthorized access.
RBI Circular 2012-2013 / 424 bearing DPSS(CO)PD1462/02.14.003/ 2012-2013, dated 28-02-2013, is issued under section 18 of Payment & Settlement System Act, 2007, to all Scheduled Commercial banks/ Urban Cooperative Banks/ State Cooperative Bank / District Central Cooperative Bank / Authorised Card 16 payment Works, directing guidelines on (a) security card payment transaction and (b) securing electronic payment transactions, with further direction to quickly Implement the same. Circular, dated 02.07.2012 of Reserve Bank of India, pertaining to Know Your Customer (KYC) norms / Anti-Money Laundering (AML) standards/ Combating of Financial Terrorism of (CRT) of obligation of banks under Public Money Laundry Act, 2002 is also there.
Hence, this negligence, as well as failure of bank, either through its employee, or officer or by its system, was with specific finding of non sending of SMS alert, as well as emails, for fraudulent transactions, and it was failure of due and expected security practices, imposed upon the bank by RBI, through its above circular, and for this loss has been suffered by complainant appellant, for which claim under section 43 A of IT Act 2000, was very well maintainable,
