Answered by
 Abhay Datar
Hello Sir/Ma'am, I am writing to seek your professional legal advice and potential representation in a matter involving fraudulent unauthorized transactions totaling ?10,99,383 from my HDFC Bank accounts, which occurred on August 18, 2025. I believe the bank's handling of the dispute violates RBI guidelines on customer protection, and I require assistance to pursue full reversal of the fraud, compensation for distress, and any necessary escalation to regulatory or judicial authorities. Below, I provide a precise, chronological summary of the events, supported by key references and correspondence details, to enable a thorough assessment. Relevant Context: I was hospitalized on August 24, 2025, and delivered a baby on August 25, 2025, which coincided with the fraud discovery and added significant distress. II. Summary of the Fraud Incident On August 18, 2025 (IST), my HDFC Bank accounts were compromised through a targeted vishing (voice phishing) attack. The fraudster impersonated an HDFC Bank official, leveraging genuine prior communications from the bank about a credit limit enhancement (starting from August 8, 2025) to gain credibility. Under deception, OTPs were obtained, leading to the following unauthorized transactions in quick succession: 2:36 PM: Disbursal of Personal Loan (?5,00,000) – No pre-disbursal verification call or consent obtained. 2:38 PM: Immediate IMPS outflow of ?5,00,000 from the disbursed loan. 3:35 PM: Disbursal of Jumbo Loan (?5,00,000) – Second high-value loan within 59 minutes; no enhanced verification. 3:37 PM: Immediate IMPS outflow of ?5,00,000 from the second loan. 6:15 PM: Card-not-present (CNP) merchant payment to Myntra Designs Pvt. Ltd. (?99,383) using my HDFC credit card. Total fraud amount: ?10,99,383. I discovered the fraud on August 20, 2025 (within two working days) and immediately reported it to HDFC Bank via phone. However, bank staff initially disclosed only the ?99,383 credit card transaction, concealing the two ?5,00,000 loans. The full extent emerged later on 25th Sep when I downloaded the HDFC app, exacerbating my distress during my medical emergency. III. Actions Taken Post-Fraud Police Reporting: On Sep 29, 2025, I filed FIRat Cyber Crime Police Station (status: active as of November 17, 2025). Additionally, I lodged complaints with the National Cyber Reporting Portal (NCRP status: active) Bank Complaints: Initial report to HDFC on August 20, 2025. Formal loan complaints Escalations via emails (detailed below). Despite the active FIR and dispute, the bank has continued EMI collections, recovery calls, and potential adverse credit reporting, which I contend violates RBI's fair recovery and customer protection directives. IV. Key Correspondence with HDFC Bank I have maintained all communications "without prejudice and with full reservation of rights." Below is a chronological summary: Bank's Initial Response (October 28, 2025: Addressed only the ?99,383 credit card transaction, attributing liability to me based on OTP validation. Deferred the ?10,00,000 loans to a "concerned department." No holistic analysis provided. My Rejection Email (November 3, 2025) Rejected bank's findings and denied liability. Demanded a unified resolution for all transactions, root-cause analysis, and zero liability under RBI guidelines (e.g., Customer Protection – Limiting Liability in Unauthorized Electronic Banking Transactions, 2017; Digital Lending Guidelines, 2022; Cyber Security Framework, 2016). Highlighted bank's control failures: No pre-disbursal verifications, no anomaly detection for rapid high-value outflows, post-facto loan intimation(loan approval mail which I got on August 22, 2025) Posed specific unanswered questions (e.g., why no account freeze after first outflow; beneficiary details for IMPS). Requested Internal Ombudsman's (IO) speaking order and cessation of collections. Asserted zero liability, full reversal, waiver of charges/interest, credit correction, and compensation. Bank's Interim Reply (November 4, 2025 )Acknowledged my email but provided no substantive response; promised reply by November 15, 2025. Incorrectly addressed me as "Mr. xyx." although Im a woman. Bank's Follow-Up Reply (November 14, 2025) Reaffirmed liability for ?99,383 based on OTP, claiming review by Internal Ombudsman (no speaking order provided). Suggested I file a police complaint (ignoring the existing FIR). Deferred loans to "respective team" for investigation; no timeline or details given. No address to my specific questions, medical context, or demands for reversal/compensation. As of November 17, 2025, the bank has not provided: A consolidated determination for all transactions. IO's signed speaking order or evidence reviewed. Beneficiary details for IMPS outflows. Cessation of collections or credit corrections. Any compensation or systemic corrective actions report. V. Legal and Regulatory Basis for My Claim Based on my understanding: Zero Liability under RBI: Timely reporting (within 3 working days) and bank's contributory negligence (e.g., failure in fraud detection, no pre-disbursal consents) qualify me for zero liability per RBI's 2017 Customer Protection circular. OTP obtained via deception does not absolve the bank. Violations: Non-compliance with Digital Lending Guidelines (2022) – no Key Fact Statement or auditable consents; Credit Card Directions (2022) – unfair dispute handling; fair recovery instructions – harassment during medical emergency. Potential Claims: Negligence, breach of contract, deficiency in service under Consumer Protection Act, 2019; possible IPC violations (e.g., intimidation via collections). I seek full reversal, interest/charge waivers, distress compensation (considering medical context), and punitive measures if needed. Escalation Options: RBI Ombudsman, Consumer Forum, or civil suit if unresolved.Please suggest what should I do, as Im in my postpartum suffering pain and anxiety. Before my C section on 18th Aug this fraud happend, I detected it on 20th Aug, got admitted for the C section operation on 25th Aug and on 25th I detected these two fraud loans under my name.I cant enjoy my motherhood as Im busy writing, thinking and worrying about these loans.  Regulators RBI, SEBI etc
Dear Mr Pandey You have taken all the required steps right from reporting to the bank immediately to filing complaint with the Cyber Cell. Hope, you also called National Consumer Helpline number 1930... Read More
Comments
Our Experts

Shirish Shanbhag Shirish Shanbhag has an MSc in Organic Chemistry, Diploma in Higher Education, a Diploma in a French and has completed his LL.B. in first class, in 2021. Before his retirement, he was a junior college teacher at Patkar College from July 1980 to May 2012, where he taught theoretical and practical chemistry. Post retirement in 2012, he started providing guidance and counseling to people on several issues, with a specific focus on co-operative housing society related matters. Adv Shanbhag has a kee

AV Shenoy AV Shenoy hold degrees in both Mechanical and Electrical Engineering from VJTI, University of Bombay and a Post Graduate Diploma in Industrial Management from Jamnalal Bajaj Institute of Management Studies. Worked as a Design Engineer in Electrical Business Group of Larsen & Toubro Ltd. at Powai from October 1969 to September 2001 and retired as Dy. General Manager. Also worked as a Facilitator/Trainer for implementation of Total Quality Management (TQM) and ISO 9000 in the organization. Since r

Abhay Datar Abhay Datar is a consumer activist. After working at Bank of Baroda for about 29 years, he retired as IT Manager. After retirement, Mr Datar joined Consumer Guidance Cell of Mumbai Grahak Panchayat (MGP) in 2008 and solved many cases related to banking including online fraudulent transactions, misuse of credit cards and ATM cards. Also handled cases related with mobile banking frauds and mediclaim. He was a Member of the Managing Committee of MGP till March 2021.

Shailesh Gandhi Shailesh Gandhi is a former Central Information Commissioner for the Right to Information Act. He is a successful RTI activist and a regular speaker at Moneylife Foundation.

Dr Rajendra Ganatra Dr Rajendra M Ganatra, was a banker for two decades and is now a registered Insolvency Resolution Professional, restructuring consultant and visiting faculty for MBA. He has more three decades of experience in project finance, asset reconstruction and financial restructuring. He is a Registered Insolvency Professional and has been the former MD & CEO of India SME Asset Reconstruction Co. Limited

Samir Zaveri An extraordinary activist who has dedicated his life to the cause of railways, with a mission to help every rail commuter and accident victims, and improve Railway safety.

Yogesh Sapkale Yogesh Sapkale is Deputy Editor of Moneylife and writes on legal, RTI, and consumer issues

Sucheta Dalal Trustee - Moneylife Foundation

NOTE
Please do not share in your query any personal details like name, mobile number, email ID, address, bank account or other account details.

To ask a question

Please
Sign Up or Sign In
with
than you