With the increased usage of digital channels for payments during the Covid-19 pandemic, attempts of digital fraud have been on the rise.Customers have been relying on digital channels to do business on account of restrictions and fear of Covid spreading.
The government of India and the RBI are aware of this menace.Infact, evenbefore the pandemic, the RBI had issued notification which said a customer’s “entitlement to zero liability” will arise if the unauthorised transaction takes place in the following events:
1. “Contributory fraud/negligence/deficiency on the part of the bank (irrespective of whether or not the transaction is reported by the customer).” In other words, the customer will be entitled to zero liability if the unauthorised transaction,or thefraud,hashappened because of the bank's fault. The bank will have to pay for the loss even if the customer fails to report the unauthorised transactions immediately.
2. The customer has zero liability in the case of a“third-party breach where the deficiency lies neither with the bank nor with the customer, butlies elsewhere in the system, and the customer notifies the bank within three working days of receiving the communication from the bank regarding the unauthorised transaction”. In other words, if a third party is behind the unauthorised transaction, the customer will have zero liability if he/she reports it within three working days. In case the unauthorised transaction is reported between four to seven days after receiving communication from the bank, the per transaction liability shall be maximum of Rs 25,000.
3. Where the loss isdue to negligence by the customer, such as where he/she has shared the payment credentials, the customer will bear the entire loss until he/she reports the unauthorised transaction to the bank. Any loss occurring after the reporting of the unauthorised transactions hall be borne by the bank.
It also needs to be noted that the RBI notification mentions the burden of proof in proving customer liability in case of unauthorised electronic transactions lies with the bank. The RBI directs all banks to “mandatorily register for SMS alerts and wherever available register for e-mail alerts, for electronic banking transactions”. The SMS alerts are to be sent “mandatorily” while email alerts may be sent wherever registered.
It is important to note that “longer the time taken to notify the bank, the higher will be the risk of loss to the bank/customer”. The RBI has highlighted some of the typical modus operandi being used by fraudsters, such as vishing, phishing, and remote access.
Vishing refers to phone calls pretending to be from bank/ non-bank e-wallet providers/ telecomserviceproviders inorder to lure customers into sharing confidential details in the pretext of KYC-updation, unblocking of account/ SIM-card, and crediting debited amount.
Phishing means spoofed emails and/or SMSes designed to dupe customers into thinking that the communication has originated from their bank/e-wallet provider and contain links to extract confidential details.
By using remote access, fraudsters lure customers to download an application on their mobile phone/computer which is able to access all the customers' data on that customer device. Fraudsters also misuse the 'collect request' featureof UPIbysendingfakepayment requests with messages like 'Enter your UPI PIN' to receive money.
The writer is a Vile Parle based social activist
