How to protect your money online

“Congrats! Your personal loan has been approved up to Rs. 5 lac!”. Some of us may be familiar with such messages, on our phones and on emails. After the initial elation about receiving a congratulatory message, you may soon realize that you never applied for any loan, and just ignore the message. However, some people may click on the link attached, which would take them to a page which looks almost exactly like their own bank’s and ask for personal financial information. Once you have done that, the loop is complete. Your money is gone, you just experienced online bank fraud.

The increase in digital transactions in India has also led to a corresponding increase in the number of people losing their money online. The report of the High-Level Committee on Deepening of Digital Payments, chaired by Nandan Nilekani, shows that digital payments per capita have increased from 2.38 per annum in March 2014 to 22.42 in March 2019. This refers to the number of non-cash transactions per person made annually. The rate of online bank fraud has also been following a similar curve. As per an RBI report, a total of 2,059 cases of cyber fraud were reported in 2017–18 amounting to Rs 109.6 crore. The number of cyber fraud cases in 2016–17 was 1,372 amounting to Rs 42.3 crore. As more and more Indians enter the digital payments space, it is becoming increasingly important to have more awareness on issues related to online bank fraud.

There are multiple ways you can lose money online. It’s difficult to give an exhaustive list because even as you are reading this article, new ways are being devised to take away your money online. Some of the most common ways this can happen are:

Phishing This was made famous by the “Nigerian Prince” email scams. This starts with you getting an email from someone from a foreign country who claims to have a royal title, and presumably, a lot of money. However, the prince is facing some issues in getting the money out of the country and has chosen you for help, in exchange for a share in the money. All you are required to do is to give your bank details or make a small advance payment. Another interesting variation is about you having won a huge lottery, but the money being stuck with some person at the airport due to some customs issues. Again, you are either required to deposit a small amount or share your bank details. Once this is done, the fraudsters will disappear with the money you paid, and also may empty out your bank account. There can be multiple variations to this, but the main focus is either on getting you to make an advance payment or to give up your bank details

Card Skimming: This is fairly straightforward. A small electronic machine, called a skimmer is installed in a Point of Sale (POS) machine or an ATM. When you use your card, the skimmer copies information about your card, which helps to steal money from your account. This is easier to do in magnetic strip cards, and is one of the main reasons for the push to upgrade all debit and credit cards to EMV chip cards.

Vishing: Vishing is similar to phishing, with the interaction happening over the phone. The most common scenario involves someone pretending to call from your bank, already having some of your banking details and asking for your personal banking information. This is often coupled with threats about your debit or credit card being blocked if you don’t give up the information. Giving up your personal information can lead to your money being stolen

Fake Bank Apps: These are android apps which have your banks logo, and an almost similar user interface to the original app. Sometimes cashback and other rewards may also be offered to entice people to download these apps. This makes it easy for fraudsters to steal customer information at a large scale and then extract money from their account.

What can I do about it?

As a customer, you first have to understand your rights and responsibilities. You have the following rights so as to be protected from online bank fraud:

• The right to register and receive SMS notification of all electronic banking transactions that take place through your account.

• The right to register and receive email alerts for electronic banking transactions through your account.

You are also advised to notify the bank of any unauthorised transaction as soon as you can or at the earliest possible opportunity. The longer the time taken to notify the bank, the higher will be the risk of loss to the bank/ customer.

You must not reveal/share payment credentials with any third party. If you do this then your liability will increase. It is the bank’s responsibility to prove that the customer is liable (to whatever degree) in case of unauthorised electronic banking transactions. At their discretion Banks may also decide to waive off any customer liability in case of unauthorised electronic banking transactions. They can do this even in cases of customer negligence.

You incur zero liability when:

There is an unauthorized transaction due to contributory fraud or negligent behaviour or deficiency in the bank’s services. If you don’t report the unauthorized transaction to the bank, it does not matter because the zero liability occurs whether or not you report it.

There is a breach but it is not with the customer or bank, but somewhere else in the system. In this case, you should notify the bank within three working days of receiving communication about the unauthorized transaction.

Even otherwise, there is a limit on the maximum liability of a customer. The limit varies based on the type of account you have.

What are the legal options to complaint?

In this situation, you have multiple options. Let’s look at them

Lodging a complaint to the Bank: Most banks have staff dedicated to matters like this. The relevant contact details are found on the backside of your card as well as the website of the bank. Telephone numbers of help desks are also displayed at every ATM machine. If you have suffered a loss you must immediately contact the banks via phone (preferable) or email. Do not forget to note the complaint number and follow up your complaint using the same number. The bank should acknowledge your email.

Filing a complaint with the Banking Ombudsman in your jurisdiction

If you are not satisfied with the solution provided by the bank and would like to further enquire the matter, you can approach the Banking Ombudsman established by the Reserve Bank of India under the Banking Ombudsman Scheme, 2006. Each bank is required to display at its branch the details of the Banking Ombudsman under whose jurisdiction the branch falls. Complaints may be lodged with the respective Banking Ombudsman

Filing a complaint with the nearest cyber crime cell/police station

When you go to the police station to complain about online bank fraud, they will ask you to file an FIR. Besides filing an FIR with the cybercrime cell of a police station, you can also file an online complaint on the Ministry of Home Affairs’ Online Crime Reporting Portal. Register a complaint by providing detailed information about the incident.

Filing a case with the relevant consumer forum

The Consumer Forum is present at the District, State and National Levels. You can file a case there depending on 2 factors:

• The amount of money you lost:

• District Forum: Upto Rs. 20 Lakhs

• State Commission: Rs. 20 Lakhs to Rs. 1 Crores

• National Commission: Exceeding Rs. 1 Crores

• Where the loss happened :

• You can file a complaint in the place where the money was lost, or where the opposite party (that is, the bank) carries on their business.

You should approach consumer forums only when you feel that the bank has been negligent, and has not given you proper service. The forum does not prosecute the actual culprit.

Online fraud is going to remain an issue, and as the volume and value of our digital payments system increases, so does the threat of online bank fraud. It is not really possible to eliminate bank fraud totally, but you can reduce its density by being careful. Simple things like installing an antivirus on your phone to protect from malware, or never sharing any banking information with anyone who you don’t trust can make a big difference. For general awareness, it would be useful to keep a lookout for guidelines and warnings that RBI keeps releasing on a regular basis. As a customer, it’s also important for you to know about your rights and responsibilities in this situation, as well as the different options that are available for you to complain.

A version of this article was originally published at Moneycontrol.

Sumeysh Srivastava is a Programme Manager at Nyaaya and a Senior Resident Fellow at Vidhi Centre for Legal Policy.