IMPORTANT POINT
[The court established that customers have zero liability for unauthorized electronic banking transactions due to third-party breaches, emphasizing the bank's duty to notify customers of any changes and the burden of proof resting on the bank to demonstrate customer negligence.]

JUDGEMENT

Firdosh P. Pooniwalla, J. - Rule. Respondents waive service. Rule made returnable forthwith. Heard finally by consent of the parties.

2. This Petition deals with a Cyber Fraud and is an example of how increasingly the innocent persons are becoming victims of Cyber Fraud.

3. Petitioner No.1 is a Director in Petitioner No.2, which is a closely held family company of Petitioner No.1. Both Petitioner No.1 and Petitioner No.2 are hereinafter jointly referred to as the Petitioners.

4. The Petitioners had maintained a bank account bearing No.76080200000481 of the Petitioner No.2-Company with Respondent No.2 for the previous 15 to 20 years ("the said bank account").

5. It is the case of the Petitioners that, on 1st October 2022, certain entities/ individuals were added as beneficiaries to the said bank account without any OTP being sent to the Petitioners on the registered mobile number or registered email address.

6. It is further the case of the Petitioners that, on 2nd October, 2022, Mr. Vishwanathan Shetty, the accountant of the Petitioner No.2-Company, informed the Petitioners at about 7:45 a.m. that he had received several messages from Respondent No.2 regarding a total sum of Rs.76,90,017/- being debited in several tranches from the said bank account to various unknown individuals by way of an online transaction.

7. It is also the case of the Petitioners that, since 2nd October 2022 was a Sunday and a public holiday, the Petitioners were certain that no transfer requests were initiated by them or any other authorised person and they realized that certain unknown persons had illegally siphoned off the said amount from the said bank account.

8. The Petitioners, within a period of 30 minutes to 1 hour of the aforesaid illegal transactions, informed the Cyber Cell at Worli Police Station, Mumbai and the Bank Manager of Respondent No.2 about the same and were advised to block the Sim Card of the registered mobile number associated with the said bank account.

9. On 3rd October 2022, the Petitioner issued a letter to Respondent No.2 narrating the aforesaid incident along with the details of the 20 transactions which took place from the said bank account to several unknown individuals.

10. On 3rd October 2022, the Petitioner also lodged a FIR with the Cyber Crime Police Station for offences under Section 379 of the Indian Penal Code, 1860 and Sections 43A and 66 of the Information Technology Act, 2000.

11. On 7th October 2022, the Petitioner issued a letter to Respondent No.2 seeking copies of the Security Incident Report as submitted to Respondent No.3, a Cyber Security Incident Report as submitted to CERT-IN and to provide an update on the steps taken to refund the amount of the Petitioner as per the Circular dated 6th July 2017 of Respondent No.3-RBI titled Customer Protection-Limiting Liability of Customers in Unauthorized Electronic Banking Transactions.

12. Further, on 7th October 2022, the Petitioner also sent emails to the Managing Director of Respondent No.2 inquiring about the steps taken and informing him that the Petitioner has already filed a complaint with Respondent No.1.

13. On 7th October 2022, the Petitioner No.1, on behalf of Petitioner No.2, gave an undertaking to Respondent No.2 that Petitioner No.2 was neither connected nor involved with the illegal transactions which took place in the said bank account on 2nd October 2022. It is the case of the Petitioners that these undertakings were given on the representation that the Petitioners' grievance would be redressed and the amount would be refunded as per the RBI Circular.

14. On 10th October 2022, the Petitioners sent a follow up e-mail to Respondent No.2 inquiring about time within which the said amount of Rs.76,90,017/- would be refunded as per the RBI Circular.

15. On 12th October 2022, the Petitioner received an email from Respondent No.3 stating that, since the Petitioner had filed a complaint with Respondent No.3 without filing it first with Respondent No.2, the co