Punjab National Bank Vs POONA AUTO ANCILLARIES PVT LTD

1. It is an Appeal, under Section 57 of Information Technology Act, 2000, against Order, dated, 25.02.2013 of Learned Adjudicating Officer, Maharashtra, passed in Complaint No. 4 of 2011, by Punjab National Bank (PNB), through its Chief Manager, against M/s Poona Auto Ancillaries Private Limited, Respondent No.1, Complainant of the complaint before Learned Adjudicating Officer, a company registered under the Companies Act 1956, having its registered Office, at Plot No. 79, T- Block, MIDC, Bhosari, Pune, maintaining an Account No. 0278008700000318, with the PNB Branch Office, Kirkee, Pune, which is a Branch Office of Appellant Bank.

2. In brief, the contention of memo of Appeal is that the Learned Adjudicating Officer was with no territorial jurisdiction, or subject matter jurisdiction, but had passed impugned order, under Appeal. Complainant, Respondent No.1, is alleged to be a victim of phishing attack, and had filed its complaint on 09.11.2011, before Learned Adjudicating Officer, Maharashtra, impleading various branches of PNB, namely Head Office, New Delhi, Kirkee (Pune), Kathua (Jammu & Kashmir), Mulund (Mumbai), Bhavnagar (Gujarat) and Vyara (Gujarat), alleging contravention of Section 43, 43A & 46 of the Information Technology Act, 2000. This complaint was got investigated by Respondent No. 2, i.e., Cyber Crime Cell, Crime Division, Khadki Police Station, Pune wherein, after receiving notice from investigation wing, the Appellant extended its full cooperation, in above investigation.

3. The Complainant had claimed damages in the tune of Rs. 80,10,000/- (Rupees Eighty Lakhs Ten Thousand Only), on account of alleged fraudulent net banking transactions, from the appellant’s Bank branches. A summon, as per Section 58(2)(a) of Information Technology Act, 2000, issued by Learned Adjudicating Officer, on 24.11.2011, was received by Appellant, wherein, reply was filed with specific denial of the infringement of Section 43 and 43A, of Information Technology Act, 2000. During the course of internal investigation by PNB, a trace of the fraudulent transaction was held. An amount in the tune of Rs. 35 Lakhs were got frozen and credited into the complainant’s account, which in fact was Rs. 35,71,356/- (Rupees Thirty Five Lakhs Seventy One Thousand Three Hundred and Fifty Six Only). The details of the Statements were furnished before Learned Adjudicating Officer. But, on 25.2.2013, Learned Adjudicating Officer, Maharashtra, passed impugned order, directing PNB to pay damages, to the tune of Rs. 45 Lakhs, by way of compensation to the Complainant, to partially cover his loss and costs. Whereas, Learned Adjudicating Officer had held the Complainant herein, Respondent No.1, negligent of being careless in sharing his password and admitting responding to a phishing email. A stricture against Cyber Crime Cell, Crime Division, Pune i.e., Respondent No.2, was also there in the order.

4. Hence, as the impugned order had been passed without taking into consideration, the terms and conditions of Internet Banking Service, accepted by the Complainant/Respondent No.1, wherein, it is clearly stated in clause 23 “Governing laws and jurisdiction” that both parties irrevocably submit to the jurisdiction of courts, tribunals and forums at New Delhi. Hence, territorial jurisdiction was lacking with Learned Adjudicating Officer.

5. Rule 4 of the Information Technology (Qualification and Experience of Adjudicating Officers and Manner of Holding Enquiry), Rules 2003, has also been defianced. Computer Network servers of PNB are lying at Delhi and on the basis of this location at Delhi, the jurisdiction are to be of Courts of Delhi. Complainant itself had responded phishing mail. Thereby, had shared its password and account details, with the accountant of the Complainant Company and with his son. It again was against the terms and conditions entered, in between. It has been written in judgment itself, that the stricter and more effective security services, available with Punjab National Bank, were not availed by Complainant itself, and the investigation by Police was not made properly as well as of legitimate expectation. This appeal is with a prayer for setting aside the impugned judgment.

6. Reply of this memo was got filed by Complainant, Respondent No.1, that Appellant Bank failed to implement and maintained reasonable security practices and procedures, resulting consequential failure to prevent and adequately respond to a wrongful loss of Rs. 80,10,000/- (Rupees Eighty Lakhs Ten Thousand Only), caused to Complainant Respondent No.1, through a criminal breach of Respondent No.1’s bank account, with the appellant Bank at Kirkee, Pune, in a crime involving, multiple security lapses, spread over various branches, and officials of the Appellant Bank across the country. There was defiance of the provision of Section 43A of the IT Act, 2000. There was failure of the Appellant Bank, to maintain reasonable security practices and procedures to avoid the said wrongful loss, and even there was failure to provide post-breach accountability and mechanism to help the investigating wing. Learned Adjudicating Officer was with territorial and subject jurisdiction and has rightly decided the matter. There is reiteration of contention of Complainant and denial of contention of memo of Appeal.

7. This was again replied by way of rejoinder of Appellant Bank, with the reiteration of contention of memo of Appeal, which was the contention of reply, before Learned Adjudicating Officer, with a denial of contention of Complainant.

8. Heard Learned Counsels for both side and gone through the facts on record.

9. The complaint, under Section 43, 43A and 46 of Information Technology Act, 2000, was got filed by Poona Auto Ancillaries Private Ltd., through its authorized representative, Mr Manmohan Singh Matharu, Managing Director, against Punjab National Bank(PNB), Head Office, New Delhi and its branches through Branch Manager, qua the Respondent Nos. 1 to 6 of the Complaint, before Learned Adjudicating Officer at Mumbai.

10. Complainant had claimed damages amounting to Rs. 80,10,000/- (Rupees Eighty Lakhs Ten Thousand only), with interest @ 14.5%, from the date of complaint, till actual payment, including pendente lite and future interest, over above amount, from the Respondent Bank. The Complainant, a Private Limited Company, having its registered Office and factory at given address, manufactures auto components. Whereas, Respondent No.1, is a prominent Nationalized Bank in India, which apart from offering banking products, has also entered the credit and debit card, bullion business, asset management business, etc. Respondent No. 2 to 6, are it’s Branch Offices, for the purpose of its banking businesses. A computer resource is owned, controlled and used to operate by it, in performance of its business activities.

11. Complainant was in relation of its banking activities with Respondent No.2, for last 33 years and was holding a Cash Credit account, in its branch at Kirkee, Pune, bearing account No. 0278008700000318, availing its cash credit facility, with terms of 14.5% per annum interest rate. Upon the request of complainant, Respondent No.2 activated online banking facility, in above account in favour of complainant. The requisite precaution with regard to password, login password, transaction password with due diligence and security was to be observed by complainant. The login password and transaction password with regard to online transaction were never compromised, but all security measures were taken by complainant, by using licensed version of antivirus operating system and all such other security measures which are required for online transactions. That on 23.08.2011, some unknown persons had an unauthorised access to the Respondent’s Computer system and penetrated into complainant’s above account with Respondent No.2. Whereby, got transferred an amount of Rs. 80,10,000/- (Rupees Eighty Lakhs Ten Thousand Only), unauthorizedly.

12. It came to notice of complainant on 24.08.2011, which was immediately informed to Respondent No.2, with lodging of a compliant with the Police of Khadki Police Station, Pune, on 25.08.2011. In pursuance of which, an offence has been registered, as Crime No. 103/2011, for offences punishable, under Section 420 of Indian Penal Code, read with Section 66C, 66D of the IT Act 2000, against unknown persons, wherein, investigation was got made. During the course of investigation, it was revealed that the amount, which was illegally siphoned off from the Complainant’s account was transferred to one account 744002100016515 of Sutlej Textile Ltd., Kathua, in the Respondent’s Bank at Kathua, Jammu and Kashmir Branch, i.e., Respondent No.3, from where the amount was withdrawn, by someone in the tune of Rs. 2,00,000/- (Rupees Two Lakhs Only), in one transaction, and in all, 40 such transactions, with one another transaction, of Rs. 10,000/- (Rupees Ten Thousand Only), in quick succession. But, it was not taken notice by Bank branch. The money siphoned in the tune of Rs. 80,10,000/- (Rupees Eighty Lakhs Ten Thousand Only), from Complainant’s account, was distributed to various accounts of Punjab National Bank only. Then the amount was transferred to Punjab National Bank, Mulund Branch, Mumbai, Respondent No.4, in Account No.1277002100020819, an amount of Rs. 40,00,000/- (Rupees Forty Lakhs Only), Punjab National Bank, Bhavnagar, Gujarat, Respondent No.5, an amount of Rs. 20,00,000/- (Rupees Twenty Lakhs Only), Punjab National Bank, Vyara, Gujarat, Respondent No.6, Rs. 20,00,000/- (Rupees Twenty Lakhs Only). From those branches, money was further transacted, with other accounts given in the complaint, including Rs. 4,91,000/- (Rupees Four Lakhs Ninety One Thousand Only), withdrawn as cash. Complainant had never made the aforesaid transactions. But, the Respondent had failed at their instance to intimate the Complainant, or never made any attempt to contact the complainant, regarding the aforesaid transactions, which were unusual. Unauthorised access by a third party to the Computer network of Punjab National Bank, is apparently, a failure on the part of bank, in exercise of its reasonable security practices and protection of data of their customers.

13. The Respondents were holding and handling sensitive data/ information of Complainant in Respondent’s Computer system or Computer Network/resource, which were in control and operating the Computer system and Computer network. But, due diligence regarding security of same was not taken by it, and as a result of negligence, in implementing and maintaining, reasonable security measures and practices, according to Internet Banking in India

Guidelines, laid by RBI, in DBOD. COMP. BC No. 130/07.03.23/2000-01 on June 2001, and thereby, had caused wrongful loss to the Complainant, to the tune of Rs. 80,10,000/- (Rupees Eighty Lakhs Ten Thousand only). The adherence with KYC in the Master Circular on KYC, was also not made by Bank in opening of those accounts, from which siphoned money was transacted.

14. Hence, a prayer was there for payment of damages, by way of compensation of an amount in the tune of Rs. 80,10,000/- (Rupees Eighty Lakhs Ten Thousand Only), for wrongful loss, caused to the Complainant, with a further prayer of interest @ 14.5% per annum, pendente lite and future, and providing cost for this litigation.

15. A reply to it, was filed by Punjab National Bank mentioning the non-maintainability of this complaint, under Section 43 of Information Technology Act, because of having no territorial, or subject matter jurisdiction in the matter, because the Complainant itself had signed an agreement with a provision of jurisdiction, if any, of the Court and Tribunal at New Delhi. Complainant itself fell prey to an email sent by some unknown source, whereas, PNB have all policies and checks in place and that periodic penetration testing has been done by KPMG. RBI guidelines on KYC have been properly complied with. Complainant itself had not taken the facilities, for corporate account, like monitoring and management of account, workflow and authorization levels, user profiles etc., and was using only Single User ID.

16. Punjab National Bank had responded actively and helped the customer to freeze money in account of three (3) Banks, total in the tune of Rs. 34,04,000/- (Rupees Thirty Four Lakhs Four Thousand Only). Vide Interim order, dated 09.12.2011, the Office had asked PNB to transfer this frozen amount of Rs. 34.04 Lakhs to the Complainant, which was subsequently done by the Bank. In fact, the investigation report submitted by Chief Manager, Cyber Crime Monitoring Cell, IT Division, Head Office of PNB says that the Bank has reversed funds to the tune of Rs. 37,64,675/- (Rupees Thirty Seven Lakhs Sixty Four Thousand, Six Hundred Seventy Five Only) to the customer. Hence, the pro-consumer step taken by Bank is to be appreciated.

17. Learned Adjudicating Officer, after hearing both sides, had passed Impugned Order, whereby, Punjab National Bank had been directed to pay damages to the Complainant in the tune of Rs. 45,00,000/- (Rupees Forty Five Lakhs Only), by way of compensation, for partially covering the loss and cost of the Complaint. For rest of the amount,

Complainant was to bear, because of his own negligence in keeping secret login password and password etc.

18. Learned Counsel for the Complainant had not filed any appeal, for its compensation, in view of the Complaint made before Learned Adjudicating Officer or the finding of Learned Adjudicating Officer, wherein the negligence of the Complainant itself was held to be there. Rather, this Appeal is by Bank only, who were the opposite parties in the Complaint, because of being the Head Office of Punjab National Bank and its six (6) branches out of which, Respondent No.2 was Punjab National Bank, Kirkee, Pune, where the account was being maintained, and the other Respondent Nos.3 to 6, are the branches of Punjab National Bank, wherein the amount siphoned was transferred, from where it were transacted and withdrawn. Hence, the appeal is only by Punjab National Bank, and the same is against the award of a partial amount, in the tune of Rs. 45,00,000/- (Rupees Forty Five Lakhs Only). There is no award of interest, either pendente lite or future. Rather, it was said to be borne by Complainant itself. Hence, to pin point the dispute before this Appellate forum, is the lack of jurisdiction, territorial as well as subject matter and adherence of KYC norms and RBI Guidelines regarding Net Banking by Punjab National Bank, but failure by Complainant itself.

19. The jurisdiction was raised before Learned Adjudicating Officer. But the categorical finding by Learned Adjudicating Officer, is of this fact that by opening account with Punjab National Bank at its branch Kirkee at Pune, standard form of contract, prescribing jurisdiction of New Delhi territory, was written in it. Whereas, Punjab National Bank is PAN India Bank, a nationalized Bank, and having its branches across India, wherein the account was being run, maintained and controlled at Kirkee branch, Pune. Hence, whatever transaction occurred, what were the grievances, were regarding this branch itself. The other branches were the branches, from where money was transacted and siphoned. Hence, it can never be held, that leaving behind jurisdiction of territory of all those branches, only Delhi is having the jurisdiction. Learned Adjudicating Officer had rightly held that there was territorial jurisdiction of its Adjudicating Authority, at Government of State of Maharashtra. There is nothing on record, establishing against this finding.

20. So, far as subject matter dispute is concerned, the undisputed facts are of opening and operation of current account of Complainant’s firm in branch of Punjab National Bank at Kirkee, Pune, and withdrawal as well as siphoning of money by a fraudster from that branch by use of Computer resource and Computer network unauthorizedly by fraudster is there. The Computer, its resource, its network, being owned, controlled and operated by Bank concerned, is not under question or dispute. Hence, in view of many Judgments delivered by this Tribunal, by exercising this jurisdiction of Cyber Appellate Tribunal, have held the subject matter to be under jurisdiction of Learned Adjudicating Authority. Nothing against it, could be shown by Learned Counsel for Appellant. Hence, the finding of Learned Adjudicating Officer, with regard to jurisdiction, territorial, as well as subject matter is well accordance with law and precedent.

21. Learned Adjudicating Officer has observed the pro-consumer help steps, taken by Punjab National Bank and the recovery and then revert back of a substantial portion of money, illegally siphoned is there, and this was because of the pro-consumer step taken by Bank.

22. The argument advanced by Learned Counsel for Appellant, was taken into account by Learned Adjudicating Officer by not awarding interest or holding Complainant itself liable, for not maintaining and keeping secret of login and transaction password, resulting illegal transaction. Hence, Learned Adjudicating Officer has rightly appreciated facts and law, placed before it. There is nothing on record to make any reasonable ground to interfere with the finding of impugned judgment of Learned Adjudicating Officer, except one aspect that Learned Adjudicating Officer in its finding had casted stricture against investigation by Cyber Crime Cell of Police and there is a specific direction to Head of the Cyber Cell to make follow up of investigation in this case in following words :

“As per powers vested in Adjudicating Officer, under Rule 12 of the Information Technology (Qualification and Experience of Adjudicating Officers and Manner of Holding Enquiry) Rules, 2003, notified by Central Government on 17.03.2003, I hereby ask Police Commissioner Pune to immediately review this crime at his level and put a DCP rank Officer in charge of this investigation. Director General of Police, Maharashtra should organise special training process for all the personnel posted in Cyber Crime Cell across the State, and to ensure that sufficient manpower is available to investigate Cyber Crimes.”

Meaning thereby, the investigation has yet not ended. Rather, Learned Adjudicating Officer has directed Commissioner of Police, Pune to look at his personal level and got the matter investigated by an Officer of DCP rank in-charge. Hence, if the matter is being investigated, the persons who have been put behind the bars, in its previous investigation, against whom charge-sheet is said to have been filed, criminal proceedings are still pending, and in further investigation, if any, other are being apprehended, or some recovery in particular crime case happens, then the Punjab National Bank will be entitled to have that amount got received back from this crime sequence. Meaning thereby, Punjab National Bank is to make the payment in the tune of Rs. 45,00,000/- (Rupees Forty Five Lakhs Only), ordered by Learned Adjudicating Officer, for above offence of unauthorized siphoning of amount, from the Bank account of Complainant, and in case of recovery of that one, by Cyber Crime Police Cell, or in view of judgment of Tribunal or Court, in the case time of the present matter, the money, to be recovered, is to be paid back to Punjab National Bank, who had made the payment to Complainant.

23. With above specific observation, this Appeal merits its dismissal.

ORDER

Appeal is being dismissed with above written observations to be obeyed in the eventuality of above circumstances.

….......……………… (Justice Ram Krishna Gautam) Member 19.11.2025 /NC/