Axis Bank to Reimburse Rs 1.76 Crore Cyberfraud Loss; KPMG Says Report Not Legal Opinion

In a landmark ruling emphasizing accountability, the Adjudicating Authority (AA) under the Information Technology (IT) Act has held Axis Bank liable for failing to implement adequate security practices, which directly contributed to unauthorized transactions from a customer’s account.

The AA has ordered Axis Bank to reimburse Rs 1.76 crore with 18% interest and pay Rs 53 lakh as compensation and legal expenses to Dhule Vikas Sahakari Bank Ltd.

Adjudicating Authority’s Findings
Parrag Jaiin Nainutia, Principal Secretary of the Department of Information Technology for Maharashtra and the adjudicating authority under the IT Act, stated in the order that Axis Bank’s failure to adhere to reasonable security practices, as mandated by Section 43A of the IT Act, led to the unauthorized transactions.

The hacking of Axis Bank’s systems, as acknowledged in the First Information Report (FIR), revealed a lapse in protecting sensitive customer data.

Registrations Open for FutureCrime Summit 2025: India’s Largest Conference on Technology-Driven Crime

Section 43A of the IT Act imposes liability on entities that handle sensitive personal data but fail to maintain adequate security safeguards, resulting in financial loss or damage. The AA observed that Axis Bank’s negligence in securing its systems compromised the confidential information of Dhule Vikas Sahakari Bank, leading to fraudulent transactions.

The order further highlighted the absence of robust real-time monitoring and fraud detection mechanisms, which exacerbated the situation. The bank’s non-compliance with statutory obligations under the IT Act and Reserve Bank of India (RBI) guidelines caused significant financial and reputational harm to the complainant.

Case Background
Dhule Vikas Sahakari Bank, represented by advocate Dr. Prashant Mali, filed the case to recover Rs 1.76 crore lost in unauthorized transactions. The bank maintained a current account with Axis Bank and used its cash management services (CMS), national electronic funds transfer (NEFT), and real-time gross settlement (RTGS) systems.

On June 8, 2020, an employee of Dhule Vikas Sahakari Bank discovered 26 unauthorized transactions amounting to Rs 2.06 crore in the Axis Bank account. An additional NEFT transaction had occurred on June 7, 2020. These transactions were executed between 7:00 AM and 10:00 AM, before the bank’s working hours.

The complainant noted that neither the maker nor the checker, who used separate mobile numbers, received the mandatory one-time passcodes (OTPs) required to authorize the transactions. Furthermore, no batch numbers were generated, indicating a significant lapse in Axis Bank’s security protocols.

Nominations for FCRF Excellence Awards in FutureCrime Summit 2025

Axis Bank’s Defense and AA’s Observations
Advocate Naveen Raheja, representing Axis Bank, argued that remote access software, ‘AnyDesk,’ was installed on Dhule Vikas Sahakari Bank’s systems, enabling unauthorized access. According to a report by the KPMG cyber forensic team, remote desktop logins were observed from different IP addresses on June 6, 2020.

However, the AA noted discrepancies in Axis Bank’s claims, pointing out that KPMG did not conduct an audit and explicitly stated in its report that no assurance or legal opinion was provided. Additionally, the AA highlighted that the transactions on June 7, 2020, occurred on a Sunday, a bank holiday, contradicting Axis Bank’s statements.

Verdict and Compensation
The AA concluded that Axis Bank’s failure to follow RBI guidelines on Know Your Customer (KYC) and anti-money laundering (AML) practices facilitated the fraudulent transactions. It directed Axis Bank to:

• Reimburse Rs 1.76 crore with 18% interest.
• Pay Rs 50 lakh as compensation.
• Cover Rs 3 lakh in legal expenses.

Significance of the Order
This ruling underscores the importance of robust cybersecurity measures and adherence to statutory obligations by financial institutions. It also sets a precedent for holding banks accountable for lapses in security that lead to financial losses for customers.