Man shares OTP with fraudsters; consumer court says can't blame bank for losing money

Mumbai: A consumer commission has dismissed a complaint filed by a Mumbai resident who lost over Rs 1.25 lakh to an online scam, noting that he himself had shared a One-Time Password (OTP) with fraudsters and the bank can not be blamed in such a situation.

District Consumer Disputes Redressal Commission (Suburban) comprising president Pradeep Kadu and member Gauri M Kapse, in the order last month, accepted that the complainant had fallen prey to a fraud.

But, "RBI clearly specifies that if the loss is due to negligence by the customer, the entire loss is to be borne by the customer himself," said the commission.

As per the complainant, while trying to renew his Netflix subscription in January 2022, he clicked on a link received in his email. Not realising that the email had not come from Netflix, he clicked on it, and filled in his card details and an OTP received from HDFC Bank. Seconds later, he received an SMS from the bank confirming a transaction of Rs 1,25,665.

The subscription amount was only Rs 799. He realised that he had been the victim of a cyber scam, and immediately contacted the bank as well as the cyber cell of police.

The bank closed his complaint, with comments '"we observe that the aforesaid transaction was incurred on a secure mode post validating OTP which is confidential and known only to the card holder".

Not satisfied with the HDFC Bank's response, the complainant approached the consumer commission, arguing that the illegal withdrawal of money was due to the bank's negligence and there was a deficiency in its service.

The bank argued that the complainant himself had clicked on a fraudulent link, and an OTP was generated as all details matched his credentials.

There was no reason for the bank to decline the transaction, it said.

The commission in its order acknowledged that a fraud had taken place, but pointed out that the complainant had himself shared "confidential credentials" (OTP) with fraudsters.

Reserve Bank's guidelines in this regard clearly specify that if a loss is due to negligence of the customer, "the entire loss is to be borne by customer himself," it added.

Hence, there was no "deficiency in service" on the bank's part, the consumer commission said.