Online banking has revolutionized banking transactions whereby money could be transferred at a single click. It has been a time saver and has been an extremely convenient method to undertake commercial transactions. However, it has led to litigations against banks as well, as with online banking also come phishing emails.
Phishing emails in these cases are those which purport to have been sent by the bank with the look and feel of a legitimate email. They ask the user to enter their username and password to reconfirm their accounts, with invariabe threats that if the confirmation is not made, the account would be frozen immediately. In many cases these emails are spoofed also whereby a third party sends an email using the email id of the bank, but that can be easily identified by reading the complete header of the email.
Many users panic on receiving such emails and immediately give out their personal sensitive data like banking passwords to third parties purporting to be representing the bank. They realize that they have been duped only when money is withdrawn by such third parties from their bank accounts.
There has been a slew of litigation against banks whereby the victims of phishing scams file complaints against the banks under the Information Technology Act, 2000. The grounds on which such complaints are filed attracts Section 43, Section 43A and Section 72A of the Information Technology Act.
Section 43 deals with unauthorised access, and the complainant in most of the cases alleges violation of Section 43A which is for accessing or securing access to a computer, computer system or computer network without permission of the owner or the person in charge. However, banks have a very strong legal defence to this cause because the unauthorised access is done by a third party and not by the bank. The banks on receipt of any information from an online banking services user that his account has been wrongfully debited, must ask him if he responded to any email asking for his password, and also asks him to submit documentary proof of that email to the bank. If the user admits that he has replied to such phishing email, the bank requires him to submit a letter to the bank to that effect in order to enable the bank to freeze his account, whereby further unauthorised money transfer from his account could be stopped. The bank should intimate the user by an official letter to file a complaint with the cyber crime cell, and the bank should also file an FIR against the beneficiary account holders in whose accounts the money has been unauthorisedly credited. This is important to prove the proactive efforts of the bank in a litigation by a victim against the bank under the Information Technology Act.
Section 72A of the Information Technology Act for punishment for disclosure of information in breach of lawful contract reads as under:
Save as otherwise provided in this Act or any other law for the time being in force, any person including an intermediary who, while providing services under the terms of lawful contract, has secured access to any material containing personal information about another person, with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain discloses, without the consent of the person concerned, or in breach of a lawful contract, such material to any other person shall be punished with imprisonment for a term which may extend to three years, or with a fine which may extend to five lakh rupees, or with both.”
The main contention of the complainant would be that the bank has access to his password and misused it. However, as per RBI norms all banks have 128 bit encryption of passwords and the bank does not have any access to the same.
The complainants in most cases attempt to bring the bank within the definition of an ‘Intermediary’ under the Information Technology Act; however, the exceptions to intermediary liability under Section 79 of the Information Technology Act, 2000, apply to a bank in this case because of the following reasons:
- The function of the bank is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored.
- The bank does not-
i) initiate the transmission,
ii) select the receiver of the transmission, and
iii) select or modify the information contained in the transmission
- The bank observes due diligence while discharging his duties under this Act and also observes such other guidelines as the Central Government may prescribe in this behalf.
The banks are required to maintain ISO 27001 standards because they handle confidential and sensitive personal data of users of their services.
In brief, the banks need to undertake the following steps in order to be able to succeed in any litigation against them:
- They should provide a handbook to the online banking services users at the time they apply for such services. The handbook should mention directions for safe use of online banking and should also contain complete information about phishing emails and scams, including information on how users can protect themselves from such phishing attacks.
- The online banking services application should have an Indemnity clause, whereby the user indemnifies the bank.
- The terms and conditions of online banking should contain Indemnity clauses with respect to password of the user, online transactions and use of bank’s services.
- There should be a security tips page which warns users of phishing emails each time they log in for online banking. Customers/ users should be proactively informed about all the Cyber threats.
- There should be Cyber security and Cyber law compliance panel. This panel should comprise of cyber security experts who should ensure that proper cyber security measures are always in place and the cyber lawyer in the panel should ensure that the online banking user agreement clauses are up-to-date to restrict the bank’s liability in an environment where new cyber crimes get added each day.
- The online user should be made to agree to indemnify the bank with respect to his usage of his password and online banking transactions with each log in and not just one click wrap agreement which he agrees to at the time of activating online banking.
- There should be a well drafted privacy policy whereby the bank’s liability is reduced to a negligible level. This privacy policy should clearly outline where the user’s data is being stored and how is it being used. It should also outline which third parties have to access to such data and the usage of the same by them and till what duration. Each time user data is shared with a new third party, the privacy policy should be amended to include the same and the consent of the user should be taken.
- The cyber security and cyber law compliance panel should send emails and messages on a routine basis to all users of online banking about the latest cyber crimes and safe guard measures. This helps show the banks active role in prevention of cyber crimes and shows the bank in positive light in cyber crime litigation against the bank.
- The Online Banking Services Agreement should have a well drafted Alternative Dispute Resolution Clause. This clause is very important as it helps preserve the image and reputation of a bank, which can get damaged when the bank is accused in such matters involving litigation.
- The bank should actively follow-up the case investigation after filing the FIR.
In the current scenario most cases where the victim in phishing scams files a complaint against the bank manages to succeed in getting compensated for his losses.
These are a few guidelines which can help a bank succeed in litigation faced by them due to phishing scams.
Advocate Puneet Bhasin is one of the leading Cyber-law experts in India, specialized in laws related to technology, blockchain, cyber-crime, data theft, corporate data espionage, GDPR compliance, artificial intelligence & IoT. She is the Founder of Cyberjure Legal Consulting. She has been Awarded the Best Cyber Lawyer in India.
