Nagpur: The Nagpur District Consumer Disputes Redressal Commission has directed ICICI Bank to refund ₹5,18,437 to a victim of a digital arrest cyber fraud, holding that the bank cannot escape liability solely because the customer authorised the transactions using one-time passwords (OTPs). The Commission observed that banks have a statutory and regulatory obligation to continuously monitor suspicious accounts and unusual financial transactions. Failure to do so amounts to deficiency in service, negligence and unfair trade practices.
According to the case, the complainant, Prachi Digambar Dhoke, maintained a savings account with ICICI Bank. On January 8, 2023, she received a phone call from a person claiming to be a FedEx customer service representative. The caller falsely informed her that an international parcel booked in her name contained two passports, five ATM cards, 300 grams of prohibited narcotic substances and a laptop. She was then connected to individuals impersonating Mumbai Police officers, who threatened her with criminal action and persuaded her to transfer money as alleged investigation and processing charges.
The complaint states that, acting under fear and pressure, the victim transferred a total of ₹6,93,437.50 in four separate transactions to another ICICI Bank account. After realising that she had fallen victim to a cyber fraud, she immediately informed the bank, lodged a complaint on the National Cyber Crime Reporting Portal and registered an FIR with the police.
According to the records, ICICI Bank initially provided the complainant with temporary shadow credit but later reversed the amount, stating that all transactions had been authenticated using OTPs. The matter was subsequently taken before the Banking Ombudsman, which directed that approximately 25% of the disputed amount be credited to the complainant. To recover the remaining ₹5,18,437, she approached the Consumer Commission.
During the proceedings, ICICI Bank argued that the matter was criminal in nature because it involved cyber fraud and therefore fell outside the jurisdiction of the Consumer Commission. The bank also contended that the complainant had voluntarily authorised the transactions by entering OTPs, leaving no deficiency in service on its part. It further submitted that the Banking Ombudsman had already examined the dispute.
The Commission, however, rejected the bank’s principal arguments. It held that while the cyber fraud itself constituted a criminal offence, the question of whether the bank had complied with the Reserve Bank of India’s KYC and transaction monitoring guidelines was a consumer dispute falling within its jurisdiction. The Commission observed that banks cannot limit their responsibilities to merely opening customer accounts and must undertake continuous monitoring to identify suspicious or unusual transactions.
The Commission found that the beneficiary account, which had remained largely inactive, recorded transactions worth approximately ₹2.84 crore within just two days. It observed that such an unusual transaction pattern should have triggered enhanced scrutiny under the RBI’s regulatory framework. However, ICICI Bank failed to demonstrate that it had undertaken any effective monitoring or preventive action in accordance with the prescribed guidelines. The Commission also noted that the bank did not take immediate steps to freeze the transferred funds after the fraud was promptly reported.
Based on these findings, the Commission held ICICI Bank guilty of deficiency in service, negligence and unfair trade practices, and partly allowed the complaint. It directed the bank to pay the complainant ₹5,18,437 along with interest at 9% per annum from the date of filing of the complaint until the amount is realised. The Commission also awarded ₹25,000 as compensation for mental agony and ₹10,000 towards litigation costs, directing the bank to comply with the order within 45 days.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
