Debit Card Breach: What Recourse Do Cardholders Have?
If you’ve lost money in the recent debit card breach, do you have a recourse?
32 lakh debit cards compromised. 19 banks impacted. Fraudulent transactions worth Rs 1.3 crore made. 641 customer complaints filed. These numbers revealed by National Payments Corporation of India Ltd (NPCIL) are both staggering and worrying. Banks say their systems are robust, card network companies say their infrastructure is watertight, the payment switch provider has assured that its system isn’t the one that has been compromised and the government has promised prompt action. But words and assurances are unlikely to make up the losses, that consumers have suffered.
So, what recourse do consumers affected by debit card frauds have?
RBI Regulation
The Reserve Bank of India’s (RBI) 2015 Master Circular on debit card issuing banks makes the bank responsible for direct losses incurred by a cardholder due to a system malfunction directly within the bank’s control.
Tishampati Sen, an advocate who practices consumer law explains that banks cannot shift the blame to technology intermediaries such as payment switch providers.
Large number of ATMs, I think around 30 percent of them, are not managed and operated by the banks themselves but it is outsourced. In such cases also a bank cannot put its hands up. So, for instance, if Hitachi (a payment switch provider) is at fault, it doesn’t absolve the bank of its liability towards the aggrieved consumer.Tishampati Sen, Advocate, Consumer Law
The Vidyawanti Case
While in this case, the breach is large scale and banks cannot outrightly deny its existence, in cases where individual customers are affected, banks may deny foul play. For instance, last year, a certain Vidyawanti argued before the National Consumer Disputes Redressal Commission (NCDRC) that two fraudulent withdrawals had taken place from her State Bank of India (SBI) account. SBI shifted the blame on Vidyawanti and stated that the withdrawal could not have happened unless she had parted with her ATM card and disclosed the pin number to someone, or that she had herself operated the account. But the NCDRC concluded that SBI was liable for the breach as another complaint regarding the same ATM had been filed by another customer with the police.
To prevent debit card frauds, banks often warn customers to not share their ATM pins with anyone and change them from time to time.
Over the past few weeks, several banks have sent sterner messages to customers, suggesting they change their pin numbers immediately.
Tishampati says that he has also got similar messages but didn’t take them seriously. In such a situation, can the bank shift the liability on to the consumer? Tishampati says a nuanced argument of a general advisory versus a specific warning can be made in favour of a customer.
If it is a general advisory which a bank sends to all the customers, then that is just a matter of good house-keeping. And the bank will be liable in case a fraudulent transaction takes place.Tishampati Sen, Advocate, Consumer Law
But if a bank has specifically told a customer that a charge card may be in trouble and has advised the customer to change the pin and the advise goes unheeded, then it may work as a mitigating factor to establish that the bank is no longer responsible, he added.
None of the 19 banks in this case have issued any statement confirming or denying compensation to the aggrieved customers but experts say if they refuse to compensate, debit card holders who have suffered losses will have a good chance before the consumer court.