INDUSIND BANK LTD Vs AMOS CORPORATION & ORS

For Appellant : Mr. Manish Sharma & Mr Aaron Simon – for Indusind Bank For Respondents : Dr. Mahendra B Limaye for Amos Corporation Ms Vasuddha Arora for HDFC Bank Ms. Nitya Prabhakar & Mr Malak Bhatt For R-4 in CA No. 26 of 2019

JUDGMENT

1. This Cyber Appeal no. 26/2019, under Section 57(1) of Information Technology Act, 2000, has been filed by appellant, M/S Amos Corporation (A division of Amos Enterprises), 403@637 Gulbai Tekra, Panchvati Second Line, Ellisbridge, Ahmedabad, Gujarat, against Union Bank of India, and Nine others, respondents, against order, dated 15.11.2018, passed by Adjudicating Officer, Gujarat/Secretary, Department of Science and Technology, in a Special Civil Complaint No. 56, which was filed before Adjudicator, for compensation of Rs.4,26,000/-, plus 24% per annum interest, for failure to protect sensitive personal information, provisioned under Section 43A of IT Act, out of which only Rs. 2,34,771/-, was granted in favour of appellant. Being aggrieved by this order of awarding less/inadequate/inappropriate compensation by Adjudicating Officer, Gujarat, present appeal, within the jurisdiction of this Tribunal, under Section 57 (1) of Information Technology Act, 2000, (hereinafter referred to as IT Act) has been filed, within stipulated period of limitation. (The delay in filing the appeal was condoned by this Tribunal, vide its order dated 31.1.2020.)

2. In brief, the memo of appeal contends that the complainant, M/s Amos Corporation, a Division of Amos Enterprises Ltd, a public limited company, was operating it’s current account no.393301010011121, with Union Bank of India, in its branch Vastrapur, Ahmadabad, respondent no.1, for its engaged business of trading in chemicals, inks and technical grade fertilizers. Complainant, appellant had availed net banking facilities on its current account, and being a public limited company, it was used by complainant-Chairman, as well as some Directors of the company. Mobile no. 9824032110, of service provider Idea Cellular, subsequently, Vodafone Idea Limited, respondent no.4, was registered mobile number, in above banking facility of complainant, appellant. In the morning of January 13, 2014, at around 10:30 AM, complainant’s above mobile phone went out of service, and it was not able to make or receive any calls. As a routine practice in the company, when the accountant was reviewing the said bank account at about 2.15 PM, in afternoon on 13 January 2014, he observed that 8 debit transactions, amounting Rs.14,26,000/-, have occurred, for which beneficiaries were not known to him.

Accountant sought clarification about the said 8 transactions, with the complainant - Chairman, and it was also not in the knowledge of Chairman-Complainant about the beneficiaries of those 8 transactions. 3. Instantly, matter was reported to bank to debit/freeze/stop the account, to avoid further fraudulent transactions. As a result of vigilance of complainant, as well as of bank officers, only Rs. 5 lakhs could be retrieved on the same day, followed by retrieval of Rs 5 lakhs in a couple of days, subsequently. The total amount, without any authority, was transferred in many accounts, including Account of Mr Arvind Verma online, holding account no. 100026081914, with Indusind Bank, Chhindwara Branch. Respondent nos. 3 and 5, Rs. 4 lakhs transferred to Mr Manoj Kumar, respondent no.10, holding account no. 250008080808, with Indusind Bank, Vashi Branch. Respondent no.3 and 6, Rs 1 lakh to Mr Sameer Singh respondent no.8, holding account no. 50100014354557, with HDFC Bank, Chhindwara, Respondent nos. 2 and 7. Amount Rs.1,26,000/-. Out of total amount of Rs 14,26,000/-, only Rs 10 lakhs could be withhold.

Balance Rs.4,26,000/-, could not be reverted back from the account of above said respondents. After preliminary investigation, it was revealed that mobile services of the complainant, provided by service provider, respondent no.4, were stopped on fateful day at around

10:30 AM, without complainant’s application to the respondent no.4. Rather one of his dealer received an application by name of Mr Sanjay Sindhi, so called HR Head of company, and got verified copy of Pan Card of Mr Sanjay Sindhi, a duplicate SIM card was got issued from respondent no.4, by blocking the SIM card of Mr Samir Patel, Chairman, Amos Corporation. By way of getting this changed SIM card on the basis of fraudulent documents, fraudster got this money siphoned and transferred to above beneficiaries. The adding of those new beneficiaries were without observing the cooling period required of addition of new beneficiary to the account of company, and it was not only by way of lack of due diligence on part of respondent no.1 bank. Rather under connivance and fraud. Even no communication by E-mail, with regard to adding of new beneficiaries, was made by them. It was an apparent lack of reasonable security practices, to be observed by bank. 4. A police complaint was got lodged and this complaint for compensation, was filed before learned Adjudicator, Gujarat on 10.1.2017. Adjudicator heard and passed impugned order that amount lying the account of Sameer Singh Rs.34,771/-, be transferred to complainant’s account.

A reimbursement of Rs.1,50,000/- to complainant, along with penalty of Rs.50,000/-, in one month is to made by Indusind Bank, for failure of adhering to its policies, as well as its security practices. The Idea Cellular was directed to pay the amount of Rs.50,000/- to complainant, within one month for the failure of being diligent with KYC requirements. Hence, this Appeal by complainant with this assail that responsibility for damages was also on respondent nos. 2, 3, 5, 6 and 7. There was no application of mind, while assessing the evaluation of complainant. The compensation granted against respondent no.1, was also with no appreciation of facts placed by appellant. There was no compensation with regard to loss of business suffered by complainant. The cognizance of negligence played by respondent no.4, in issuing of duplicate SIM card, which was the main cause of siphoning, was also not taken into consideration. The compensation for failure in data protection was not properly evaluated, and was not just as per provisions of Section 43A of IT Act. 5. The responsibility of Indusind Bank, held by Adjudicator, for not following due diligence in imparting banking services, was with an order of penalty, in the tune of Rs. 2,00,000/- (Rupees Two Lakhs).

But, this Rs. 2,00,000/- (Rupees Two Lakhs), were not in consonance with the loss suffered by Appellant. The proper KYC verification of accounts were not carried out by the Respondent, Indusind Bank, in opening those accounts, by use of which, siphoning was there. Appellant has not only suffered Rs. 4,26,000/- (Rupees Four Lakhs Two Six Thousand only), through his bank account, but he has in reality, suffered huge business loss, due to non attention towards his business activities, by activities of Respondent. Hence, Adjudicating Officer failed to quantify these business losses. Hence, this appeal with above prayers. 6. Learned Counsel for Indusind Bank, who is Appellant in the CA No. 10/2019 and Respondent No. 1 in present appeal, had argued its case. Rest of the Respondents, have not availed opportunity of arguing for them. The argument advanced by Learned Counsel for Indusind Bank was the same, which was for Appellant of CA No. 10/2019, and as this Tribunal had decided for disposal of above CA No. 10/2019, and present Cyber Appeal No. 26/2019, being a cross appeal for the same, against the same impugned order of Adjudicating Officer, though the CA No. 10/2019, was dismissed in default, and there was a direction for moving appropriate application for its restoration, but on a subsequent date, this Tribunal vide order dated 29.03.2023, held for disposal of Miscellaneous Application, along with CA No. 26/2019 and on the next date, held that C.A No. 10/2019, could be got heard, along with CA.

No. 26/2019. 7. Under above pretext, both of these appeals were heard together and are being decided together. 8. CA No. 10/2019, was filed by Indusind Bank Ltd., against M/s Amos Corporation and two to eight other Respondents, under Section 14, read Section 14A of TRAI Act, 1997, read with Section 57 of Information Technology Act, 2000, against the Judgment/Order dated 15.11.2018, passed by the Adjudicating Officer, Gujarat, Secretary, Information Technology, State of Gujarat, impugned assailed order in CA No. 26/2019, whereby Learned Adjudicating Officer passed an order directing the Appellant Indusind Bank Ltd., to pay and amount of Rs. 1,50,000/- (Rupees One Lakh Fifty Thousand only), along with a penalty, amount of Rs. 50,000/- (Rupees Fifty Thousand only), in one month’s time, to complainant Respondent No. 1. 9. Appellant was Respondent Nos. 3, 5 and 6, before Adjudicating Officer in above Civil Complaint. Whereas, present Respondent No. 1 was the Complainant-Petitioner with a contention of being a Public Limited Company, incorporated under the provisions of the Companies Act

1956, being M/s Amos Corporation, a division of Amos Enterprise Ltd., having its current Account No. *****11121, with Union Bank of India, Respondent No. 2, with its branch office, located at Vastrapur, Ahmedabad. A Net banking facility of its service was being provided by Union Bank of India to above complainant. This account, being a current account, was used on daily basis by Respondent No. 1, in relation to the commercial transactions, being carried out by complainant, who was engaged in trading business in chemicals, inks and technical grade fertilizers. The user name and its password, was kept secret by bank and the complainant. The Respondent No. 1 i.e., M/s Amos Corporation with Accountant, Mr Alpesh Kumar Shah, were under knowledge of their username and password for use of said Net banking facility. These alleged 8 (Eight) transactions and thereby transfer of Rs. 14,26,000/- (Rupees Fourteen Lakhs Twenty Six Thousand only), from the account of complainant, with no alert or messages on mobile number, registered with bank was there. The details were given in the memo of Appeal, and upon information, instant action, by bank, was taken, whereby Rs. 10,000,00 (Rupees Ten Lakhs only), could be retrieved, and Rs. 4,26,000/- (Rupees Four Lakhs Twenty Six Thousand only) could not be retrieved.

10. The mobile service, which was non-effective in above period of transaction, could be retrieved, about late evening of 13.01.2014, pursuant to representative of Respondent No. 1, and it was an Act of Telecom Service provider, being Idea Cellular Pvt. Ltd., Respondent No. 4, which revealed that some unauthorized person, had made forged application, for the change of SIM card, in the morning of 13.01.2014, for the registered mobile number, resulting above number being out of service, on that day. For the purpose of such insurance claim to succeed, the Bank’s Insurance Company had sought for the copy of account statement and KYC document of said Mr. Arvind Verma, Mr Manoj Kumar and Mr Sameer Singh, with a copy of FIR, to enable the said Insurance Company to process the claim. The bank informed Respondent No. 1, that the bank had requested the HDFC Bank Ltd., Chhindwara, as well as Appellant Bank, Indusind Bank Ltd., Chhindwara, to share with them the aforesaid documents, so as to enable the bank to process the said insurance claim, and it was said by the bank, Union Bank of India, that both of HDFC Bank, as well as Indusind Bank, have not shared such documents, resulting non processing of insurance.

11. A complaint was filed under, Section 43A, of Information Technology Act, 2000, to the office of Adjudicating Officer/ Secretary, Information Technology, Government of Gujarat, wherein, a prayer was for ordering the Union Bank of India, Respondent No. 2, HDFC Bank, Respondent No. 3, Indusind Bank Respondent No. 3, before the Adjudicating Officer, appellant before present forum, as well as Idea Cellular Ltd., Respondent No. 4, hereinafter, jointly or severely, paying damages of Rs. 4,26,000/- (Rupees Four Lakhs Twenty Six Thousand only), along with interest at the rate of 24% per annum, to the Petitioner. During the proceeding before Adjudicating Officer, evidences were led by way of affidavit. Appellant bank had denied the allegations levelled against it. After hearing both side, the impugned order, dated 15.11.2018, was passed. 12. This was without application of judicial mind, and Principle of Natural Justice. It’s an order based on mechanical interpretation. The guidelines, laid down by the Reserve Bank of India, were also not got observed. There was a mandate of NBFC, that account holder shall not share his or her internet banking password, with anyone in any manner whatsoever.

Whereas, in the present matter in hand, Respondent No. 1 had shared his password with his Accountant and the same is admitted by him in his complaint, which is against the guidelines of RBI. This fact was ignored by Adjudicating Officer. There was no Privity of Contract, in between, Appellant bank and Complainant or its bank Union Bank of India. Even then, responsibility has been fastened. Hence, this appeal with above prayer. 13. The arguments advanced by Learned Counsel for both side were the same, as were written in Memo of Appeal, and the reply of both of this appeals, are with the same contention, which are the contention of Memo of Appeal, by respective Appellants. Hence, not to repeat the same, is in the favour of brevity of judgment. 14. The Adjudicating Officer, in Civil Complaint No. 56/2018, had narrated the facts, which are undisputed in the memo, the evidences led before the Adjudicating Officer, and the analysis made by Adjudicating Officer, with a conclusion of passing of impugned order, whereby HDFC Bank, Chhidwara Branch Manager, was directed to return Rs. 34,771/- (Rupees Thirty Four Thousand Seven Hundred Seventy One only), in account of Mr Sameer Sudesh Singh to the Petitioner in 15 days, and for failure in adhering to their own policy in relation to daily withdrawals, Indusind Bank allowed excess withdrawal beyond the set limit of Rs. 50,000/- (Rupees Fifty Thousand only) and Rs.1,000,00/- (Rupees One lakhs only), i.e., a total of Rs.1,50,000 (Rupees One Lakhs Fifty Thousand only), which could have been saved to the Petitioner, if Indusind Bank had followed its policy.

Accordingly, there was a direction for reimbursement to the Petitioner, of an amount of Rs.1,50,000 (Rupees One Lakhs Fifty Thousand only), along with penalty amount of Rs.50,000/- (Rupees Fifty Thousand only), in one month’s time. 15. The service provider, Idea Cellular, failed in its diligence, required with KYC requirements, in issuing the duplicate SIM, and that’s why it was directed to make payment of Rs. 50,000/- (Rupees Fifty Thousand only) to the Petitioner in one month’s time, and this appeal is there. The Cross Appeal by service provider, M/s Idea Cellular is not there. The appeal is by only Indusind Bank, wherein, Learned Counsel appearing for bank, categorically admitted that there was a limit of making payment in one stroke, for not more than Rs. 50,000/- (Rupees Fifty Thousand only) whereas, this payment of Rs. 50,000/- (Rupees Fifty Thousand only) and Rs.1,000,00/- (Rupees One lakhs only) were permitted to be made. That’s why the provision specifying the limit for withdrawal in one stroke and it’s non-obeying by bank and its officer, being not disputed, is very well there.

Hence, that much amount, which could have been saved, but could not be saved, because of this failure to due diligence by bank officer of Indusind Bank, was directed to be paid with a penalty of Rs. 50,000/- (Rupees Fifty Thousand only) more. Meaning thereby, the Adjudicating Officer had based its order, on the basis of evidence placed before it, as well as the facts categorically admitted before it. 16. The other aspect is there that the keeping user name and password profile saved and not disclosed to anyone, is the duty of person, enjoying Internet banking facility, and when asked for, Learned Counsel for Appellant of CA No. 26/2019, categorically admitted that this was not there by complainant. Hence, for it, complainant was not awarded complete Rs. 4,26,000/- (Rupees Four Lakhs Twenty Six Thousand only). Rather only that much amount was directed to be paid, which was direct loss by indiligence of bank, Indusind Bank, as well as penalty of Rs. 50,000/- (Rupees Fifty Thousand only), by service provider, Idea Cellular, who is not appellant or had not assailed the Impugned order. Hence, this Tribunal is with this limited point in the appeal filed by Indusind Bank only.

Hence, for Indusind Bank, there is very well, evidence of defiance made by it, and the penalty awarded is in consonance with the loss suffered for this negligence of bank officer of Indusind Bank. Hence, there is no illegality or irregularity, in impugned order, requiring this Tribunal’s intervention. Cyber Appeal No. 10/2019 merits its dismissal. 17. So far as Appeal No.26/2019 is concerned, Amos Corporation was vigilant in instantly reporting the matter to its bank. After coming to know the alleged fraudulent transaction, and upon its vigilance, its bank, Union Bank of India, took instant action, whereby, Rs. 10,000,00/- (Rupees Ten Lakhs only), could be retrieved. The only amount, Rs. 4,26,000/- (Rupees Four Lakhs Twenty Six Thousand only), could not be retrieved, because of the disbursement made by Indusind Bank. Hence, the siphoned money was instantly recovered by the bank concerned, by its legitimate and instant action. 18. The disclosing of password and username to an Accountant, by the Officer of Company was there. The KYC submitted for getting second SIM, was held to be with irregularity, for which service provider was directed to make payment as a penalty.

But, the default, on the part of complainant, was also held by Adjudicating Officer, and when asked from the Learned Counsel for Appellant, before this Tribunal, he fairly admitted this fact that those details were neither pleaded with regard to business loss, nor were proved before Adjudicating Officer. Hence, it was fairly admitted by Learned Shri Mahendra B. Limaye, before the Tribunal, that he foregoes his claim in this subsequent Appeal. 19. Under above pretext and admission made by Learned Counsel for Appellant, this appeal CA. No. 26/2019 also merits its dismissal. 20. In both of these Appeals, the perusal of record reveals that ordered amount has already been deposited at the time of filing of this appeal. Hence, nothing remains to be deposited in these appeals, except with liberty to complainant to get those amount refunded, if already not refunded back. 21. With above observations, both of these appeals, CA No. 10/2019 and CA. No.26/2019, are being dismissed. No order for costs. 22. Let a copy of this judgment and order, be kept in both Cyber Appeals separately.

…...…………….. (Justice Ram Krishna Gautam) Member 7.2.2025 /NC/