Follow us on Google News
The Telecom Disputes Settlement and Appellate Tribunal (TDSAT) has directed ICICI Bank to pay ₹7,81,772 to a Merchant Navy seafarer whose account was hit by 98 unauthorised online transactions, holding that the bank’s failure to send mandatory SMS and email transaction alerts amounted to a failure of expected security practices.
In its August 4, 2026 judgment in Manvir Singh vs ICICI Bank, TDSAT also awarded 7% simple interest on the unpaid amount from the date of the complaint until actual payment, along with ₹50,000 as damages for mental agony and harassment. The bank has been directed to make the payment within two months of the judgment.
Singh was represented before the tribunal by Dr. Karnika Seth, advocate at the Supreme Court of India, along with advocates Gurneev Singh and Garvit Mathur. ICICI Bank was represented by Anand Shankar Jha and Nandika Kaushik. The appeal was heard by Justice Ram Krishna Gautam, Member, TDSAT.
The ruling reverses a February 7, 2020 order of the Adjudicating Officer of the Government of NCT of Delhi that had dismissed Singh’s complaint.
98 transactions siphoned ₹12.85 lakh
The dispute dates back to 2015, when ₹12,85,381.67 was siphoned from Singh’s account through 98 unauthorised online transactions.
Singh, an Indian national working as a seafarer in the Merchant Navy, was aboard a vessel for extended periods and had limited connectivity while at sea. According to the case record, terrestrial mobile networks were unavailable during these periods and communication largely depended on satellite connectivity.
https://the420.in/algoritha-security-make-in-india-cyber-lab-educational-dfir-forensics/
After returning to India and checking his account, Singh discovered the unauthorised transactions.
The case put before the tribunal was that Singh had not disclosed his 3D Secure PIN or other card credentials and had not received OTPs, SMS notifications or email alerts for the disputed transactions.
The judgment records that Singh had previously been receiving transaction alerts from the bank.
Following his complaint, several transactions were reversed or amounts credited back. Of the total ₹12.85 lakh siphoned from the account, ₹5,03,609.95 was eventually returned, leaving ₹7,81,771.72 outstanding. The tribunal rounded the amount to ₹7,81,772 while granting relief.
Bank relied on 3D Secure authentication
ICICI Bank contested its liability and maintained that the disputed transactions had undergone second-level authentication through the customer’s 3D Secure PIN.
According to the judgment, the bank argued that information required for an online transaction—including the card verification value, expiry date and personal 3D Secure PIN—was known to the cardholder and could not ordinarily be available to another person unless compromised by the user.
The bank also maintained that it could not be held liable for damages where neither its employees nor the bank itself was involved in hacking, unauthorised access or tampering.
However, the tribunal’s examination went beyond whether the transactions had technically passed through an authentication mechanism.
Failure to send transaction alerts becomes key issue
A central question before TDSAT was whether the bank had complied with regulatory requirements concerning SMS and email alerts for online transactions.
The appellant’s case, presented by Dr. Karnika Seth and the other counsel appearing for Singh, maintained that the bank had failed to send alerts despite having Singh’s registered mobile number and email address in its records.
TDSAT examined the account-opening documentation and noted that the complainant’s mobile number and email address had been registered with the bank.
The bank had taken the position that Singh was not registered for SMS alert facilities. The tribunal, however, found that the documents on record showed his mobile number and email had been provided and registered.
The judgment said that despite the bank’s efforts, it could not place material on record establishing otherwise.
TDSAT consequently found that the failure to send SMS and email alerts for the fraudulent transactions amounted to negligence and failure of the due and expected security practices imposed upon the bank through RBI directions.
The tribunal held that the claim under Section 43A of the Information Technology Act was maintainable and concluded that the earlier Adjudicating Officer had failed to properly appreciate this aspect of the case.
RBI transaction alerts are mandatory, tribunal says
The tribunal referred to RBI directions concerning electronic banking and customer transaction alerts while assessing what constituted reasonable security practices.
It also relied on its earlier decisions concerning banking security and held that sending SMS alerts to registered mobile numbers and transaction information through email were mandatory requirements for banks.
The accompanying case summary describes the ruling as establishing that RBI circulars and directions issued in this context are not merely advisory and that sending real-time transaction alerts forms part of the bank’s baseline obligations.
The issue assumed particular significance because Singh’s contention was that he had received no alert that would have enabled him to identify or report the transactions while they were occurring.
ISO 27001 certificate did not shield bank
Another significant aspect of the judgment concerned ICICI Bank’s reliance on its ISO/IEC 27001 certification as evidence that it maintained reasonable security practices.
The Adjudicating Officer had relied on the certification while concluding that the bank had complied with its obligations under Section 43A of the IT Act.
TDSAT, however, held that production of the certificate could not by itself dispose of the issue where evidence pointed towards specific non-compliance.
The tribunal observed that merely producing a certificate under Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules could not overcome evidence relating to the failure to send mandatory transaction alerts.
The case summary similarly notes that an ISO/IEC 27001 certificate may be treated as evidence of compliance but is rebuttable where specific security failures are demonstrated.
Criminal culpability and bank liability treated separately
The judgment also dealt with the bank’s reliance on the fact that a criminal investigation had not found its officials guilty of an offence.
TDSAT distinguished criminal culpability from the question of compensation and compliance with reasonable security practices under the Information Technology Act.
The tribunal observed that the absence of a criminal finding against bank officials could not automatically determine whether the bank had fulfilled its statutory and regulatory obligations in a civil compensation proceeding.
The issue before the tribunal was therefore whether the bank had maintained the level of security and customer protection required of it—not whether a bank employee had been proven to have participated in the fraud.
TDSAT overturns 2020 dismissal
Singh had initially approached the Adjudicating Officer seeking compensation under Sections 43 and 43A of the Information Technology Act.
His complaint was dismissed in February 2020.
He subsequently approached TDSAT through Cyber Appeal No. 10 of 2020. The tribunal ultimately disagreed with the earlier decision, particularly on the issue of the bank’s failure to send transaction alerts.
The appellate proceedings culminated in the August 4, 2026 judgment—nearly 11 years after the disputed transactions occurred in 2015.
Dr. Karnika Seth, advocate at the Supreme Court of India, appeared for Singh in the appellate proceedings, along with Gurneev Singh and Garvit Mathur, as TDSAT considered whether the bank’s regulatory and security failures were sufficient to attract liability under the IT Act.
₹7.81 lakh refund, 7% interest and ₹50,000 damages
TDSAT ultimately recorded that ₹12,85,381.67 had been fraudulently siphoned through 98 transactions and that ₹5,03,609.95 had subsequently been returned.
The tribunal ordered ICICI Bank to pay the remaining ₹7,81,772 to Singh.
It further directed the bank to pay:
- 7% simple interest per annum on ₹7,81,772 from the date of the complaint until actual payment; and
- ₹50,000 towards damages, mental agony and harassment.
The entire amount has to be paid within two months from the date of the August 4, 2026 judgment.
The ruling is significant for unauthorised digital banking disputes because it separates transaction authentication from the wider security obligations of a bank. In this case, the tribunal did not treat the use of 3D Secure authentication or possession of an ISO security certificate as conclusive.
Instead, it examined whether the bank had complied with the customer-protection and transaction-alert requirements applicable to it and concluded that the failure to send mandatory alerts amounted to a lapse in the reasonable security practices expected from the bank.
Click here to Read the Judgment
Follow the Centre for Police Technology on LinkedIn to stay updated on the latest developments in policing, cybersecurity, digital forensics, investigations, fraud risk management, and technology-driven public safety.
https://www.linkedin.com/company/policetechnology/