Email Indemnity of Customer Does not Eliminate Bank’s Duty of Care
Order dated 11.8.2026 (30.7.2026) of the Adjudicating Officer & Secretary, Electronics, Information Technology .01 of 2019 of Bharat Jyoti Imand & Artificial Intelligence, Mantralaya, Mumbai, under the Information Technology Act, 2000, in Complaint Case No.01 of 2019 of Bharat Jyoti Impex Vs. IDFC Bank
the office of the Complainant remained closed on account of the Diwali holidays from 06.11.2018 to 11.11.2018. Upon resumption of business on 12.11.2018, the Complainant discovered that a series of unauthorized Real Time Gross Settlement (RTGS) transactions had been executed from its Current Account during the aforesaid period, without the knowledge, authorization or consent of the Complainant. 3. It is the specific case of the Complainant that during the period between 06.11.2018 and 12.11.2018, a total amount of Rs.1,26,00,000/- (Rupees One Crore Twenty-Six Lakhs Only) was fraudulently transferred from its account through twelve (12) RTGS transactions in favour of various third-party beneficiary accounts. According to the Complainant, these transactions were never initiated, authorized or approved by any of its partners or authorized signatories.
despite repeated opportunities granted during the course of the proceedings, the Respondent Bank failed to produce several material records before this Authority, including the original RTGS request forms allegedly received from the Complainant, the original emails forming the basis of the disputed transactions, complete email headers, server logs, authentication records, internal approval trail, cyber security verification records and other contemporaneous electronic evidence necessary to establish the genuineness of the disputed transactions. According to the Complainant, the withholding of these documents raises a serious doubt regarding the legitimacy of the transactions and the manner in which they were processed.
the existence of such an indemnity, by itself, cannot absolve a banking institution of its independent statutory and regulatory obligation to maintain reasonable security practices while processing high-value electronic fund transfers. A contractual arrangement between the parties cannot dilute the standard of care expected from a scheduled commercial bank while dealing with electronic banking transactions involving substantial public funds.
- The material placed on record further indicates that the disputed transactions involved transfer of an exceptionally large amount through multiple RTGS transactions to third-party beneficiary accounts within a short span of time. The Respondent has not produced any contemporaneous material demonstrating that additional verification procedures, enhanced authentication measures or internal risk assessment mechanisms were undertaken before processing such high-value transactions. In the absence of such material, the Respondent has failed to satisfactorily establish that adequate security measures were adopted while acting upon the disputed electronic instructions.
- The Respondent has further contended that the compromise, if any, occurred in the registered email account of the Complainant and not within the banking infrastructure of the Respondent. However, irrespective of the origin of the fraudulent communication, the responsibility of independently verifying unusual, high-value electronic fund transfer instructions before permitting irreversible movement of customer funds cannot be completely shifted upon the customer. The duty to exercise reasonable care while processing electronic payment instructions continues to rest upon the banking institution entrusted with safeguarding customer accounts.
In view of the findings recorded hereinabove, the Respondent IDFC Bank Ltd. is held liable for failure to maintain reasonable security practices and procedures while processing the impugned electronic transactions under Section 43A of the Information Technology Act, 2000. b) Accordingly, the Respondent IDFC Bank Ltd. is hereby directed to pay the Complainant, M/s. Bharat Jyoti Impex, a sum of Rs.57,06,000/- (Rupees Fifty Seven Lakhs Six Thousand Only) with interest at the rate of 12% per annum, calculated from the date of the unauthorized transactions until the date of actual realization.
