Debit Card Breach: What Recourse Do Cardholders Have?

If you have lost money in the recent debit card breach, do you have a recourse?

Thirty-two lakh debit cards compromised. Nineteen banks impacted. Fraudulent transactions worth Rs 1.3 crore made. 641 customer complaints filed. These numbers revealed by National Payments Corporation of India Ltd (NPCIL) are both staggering and worrying.

Banks say their systems are robust, card network companies say their infrastructure is watertight, the payment switch provider has assured that its system isn’t the one that has been compromised and the government has promised prompt action. But words and assurances are unlikely to make up the losses, that consumers have suffered.

So, what recourse do consumers affected by debit card frauds have?

RBI Regulation

The Reserve Bank of India’s (RBI) 2015 Master Circular on debit card issuing banks makes the bank responsible for direct losses incurred by a cardholder due to a system malfunction directly within the bank’s control.

Tishampati Sen, an advocate who practices consumer law explains that banks cannot shift the blame to technology intermediaries such as payment switch providers.

Large number of ATMs, I think around 30 percent of them, are not managed and operated by the banks themselves but it is outsourced. In such cases also a bank cannot put its hands up. So, for instance, if Hitachi (a payment switch provider) is at fault, it doesn’t absolve the bank of its liability towards the aggrieved consumer.

Tishampati Sen, Advocate, Consumer Law

The Vidyawanti Case

While in this case, the breach is large scale and banks cannot outrightly deny its existence, in cases where individual customers are affected, banks may deny foul play. For instance, last year, a certain Vidyawanti argued before the National Consumer Disputes Redressal Commission (NCDRC) that two fraudulent withdrawals had taken place from her State Bank of India (SBI) account.

SBI shifted the blame on Vidyawanti and stated that the withdrawal could not have happened unless she had parted with her ATM card and disclosed the pin number to someone, or that she had herself operated the account. But the NCDRC concluded that SBI was liable for the breach as another complaint regarding the same ATM had been filed by another customer with the police.

Read the full story on BloombergQuint.