Mumbai: An adjudicating authority under Information Technology Act, 2000, has directed Bank of India to pay Pune-based audit firm G D Apte & Co Rs 64.44 lakh with 12% annual interest–around Rs 1.5 crore–for losses from unauthorised electronic transactions in a 2015 cyber fraud.Idea Cellular Ltd, now Vodafone Idea Ltd, was ordered to pay Rs 5 lakh as compensation for inadequate verification while issuing a duplicate SIM linked to the firm’s internet banking facility. Both payments must be made within 30 days.The authority held Bank of India primarily liable for failing to enforce the agreed maker-checker authorisation process and transaction-limit controls. It said the telecom operator’s security lapse contributed to the compromise of the authentication channel.Cyber lawyer Prashant Mali said the case involved 13 allegedly unauthorised RTGS transactions on March 11, 2015, from the firm’s current and overdraft accounts at Bank of India’s Jangli Maharaj Road branch in Pune. One transaction of Rs 6.6 lakh was made from the current account and 12 totalling Rs 78.93 lakh from the overdraft account. After the fraud, around Rs 14 lakh was recovered.The firm said its registered mobile number became non-functional on March 10, 2015, and a duplicate SIM was issued without its authorisation. The number was used to receive banking alerts and one-time passwords.Transactions had to be initiated by a lower-level user and authorised by two of three higher-level users, while the cumulative monthly RTGS limit was Rs 50 lakh. The authority said records did not establish compliance with the authorisation process. Bank of India also failed to satisfactorily explain how transactions totalling Rs 78.93 lakh were permitted despite the limit.It found Idea Cellular had inadequately verified the authority, identity particulars, letterhead and stamp presented for the duplicate SIM. However, its liability was contributory because it neither initiated nor processed the transactions.Bank of India denied fault, while Idea Cellular said a person posing as the firm’s authorised representative obtained the SIM using apparently valid documents.
