UPI PIN used in 11 unauthorised transactions; Punjab bank told to pay customer Rs 82,495

The Punjab State Consumer Disputes Redressal Commission rejected the bank's contention that the customer must have shared or compromised his mobile personal identification number (MPIN) because the disputed transactions were authenticated using it.

According to The Indian Express, the commission upheld a June 1, 2023, order of the District Consumer Disputes Redressal Commission, Bathinda, in favour of Vijay Kumar. The state commission's order was passed on October 1 by judicial member H P S Mahal and member Kiran Sibal.

"The contention of the appellant/OP (bank) that the transactions were authenticated through MPIN and, therefore, the MPIN must have been disclosed or compromised by the complainant, by itself, is not sufficient to fasten liability upon the complainant," The Indian Express quoted the commission as saying.

Multiple withdrawals reported within minutes

Kumar's complaint stated that he received transaction alerts on June 4, 2019, showing a series of withdrawals from his savings account.

The alerts showed Rs 4,999 withdrawn at 1.06 pm, another Rs 4,999 at 1.07 pm, Rs 10,000 at 1.08 pm and a further Rs 10,000 at 1.09 pm.

Kumar approached two bank officials and showed them the transaction messages. However, two more withdrawals of Rs 4,999 each were recorded at 1.10 pm and 1.11 pm while the officials were attempting to block his account, according to the complaint. Another Rs 3,500 and Rs 5,000 were also withdrawn that day.

The commission recorded that 11 transactions through the digital payment app on June 4 and 5, 2019, resulted in a total withdrawal of Rs 72,495.

Kumar approached the bank and the police on June 4, 2019, following the incident. The police recorded a daily diary report. He also pursued the matter with the bank's offices in Chandigarh, Mumbai and Bengaluru.

Bank claims customer's MPIN was compromised

It submitted that the MPIN had last been generated on April 9, 2019, and had not been reset thereafter. According to the bank, this indicated that the credentials might have been compromised or shared by the customer.

Challenging the district commission's decision, the bank argued that the transactions had been authenticated using Kumar's UPI PIN or MPIN.

The bank denied deficiency in service and also argued that another private bank, identified as the payment service provider, and the officials concerned had not been made parties to the complaint.

Kumar had sought an annual interest rate of 18% on the disputed amount, Rs 50,000 as compensation and Rs 5,000 towards litigation expenses.

The district commission partly allowed his complaint on June 1, 2023, directing the bank to refund Rs 72,495 with interest at the prevailing rate from June 4, 2019, until realisation. It also awarded Rs 5,000 as compensation and Rs 5,000 towards litigation costs.

Commission says MPIN authentication is not enough

The state commission found that the bank had failed to establish that Kumar had authorised the transactions or that negligence on his part had led to his MPIN being compromised.

It also took note of the bank's investigation report, which accused Kumar of "hiding actual facts" but did not specify what those facts were.

The commission held that evidence of MPIN authentication, by itself, could not establish that the customer had disclosed his credentials or was responsible for the disputed withdrawals. The bank needed to provide convincing evidence of customer authorisation or negligence, which it had failed to do, the commission found.

RBI circular on unauthorised electronic transactions

The commission relied on the Reserve Bank of India's July 6, 2017, circular on customer liability for unauthorised electronic banking transactions.

The circular provides for zero customer liability in specified circumstances, including certain third-party breaches where neither the bank nor the customer is at fault and the customer reports the unauthorised transaction within three working days of receiving communication about it.

The commission found that Kumar had reported the incident within the prescribed period and that the bank had not established negligence on his part. It therefore held the bank liable under the provision dealing with third-party breaches reported within three working days.

Takeaway

Customers who spot transactions they did not authorise should notify their bank immediately, report the disputed withdrawals in writing and preserve transaction alerts, bank statements and complaint acknowledgements.