[vrprabhu]

Originally Posted by Shan2nu

Im a novice when it comes to banking.

So, what are the steps i should follow to secure my account, so that things like this don't happen to me.

A "five star" novice

Just kidding, man!

This is strictly

Normally for net banking the following options are available -
1. View
2. Offline request
3. Tax Payment
4. Transfer funds from one account to another - own accounts (you can specify which account)
5. Transfer funds to somebody else's account - but within the same bank
6. Transfer funds to somebody else's account - some other bank - will be channeled through RTGS/NEFT etc.
7. Bill Payments
8. Online Shopping - from portals identified by / tied up by the Bank
9. Online trading in shares - with brokers / agencies identified by / tied up by the Bank.

Some more facilities are in the offing..

There is no compulsion that you have to opt for ALL the above facilities. 1 to 4 are the most secure. 7 and 8 somewhat secure. The rest, there is an element of risk.

You can start with tax and bill payment, and as and when you are confident proceed further. Yes, it will take some time to put in a request for upgrading the status of the account, but it is better than loosing money!

Now coming to your needs -
a. I will strongly advise you to do net banking only from your HOME or your OWN laptop.
b. Install a good anti-virus and firewall. For less than Rs. 3,000/- there are good solutions available. Take somebody's advice on this - if you are not sure which one to go for. Whatever you do, make sure you update the virus def's periodically. There are trojans which had been dormant for quite a long time, getting active for a short while and pushing out all sensitive data. (I don't mean to scare people here, but there is no point in crying later).
c. Always type in the URL yourself. Don't use auto complete. Don't click on hyperlinks.
d. Always type the user id and password yourself. Do not store passwords. Do not use auto complete.
e. There are plenty of techniques to create a good password. Doesn't matter if you forget your password - it is better the account is locked and you to approach the bank for a new password, rather than having it hacked!
f. Close the browser window immediately after completing the transactions. Do not leave the PC/laptop unattended when doing net banking.
g. Change password frequently.


My additional hints -
h. Check your account balance frequently. It will help you to keep a track of your expenses, and also enable to you to spot suspicious / fraudulent transactions quickly. (This includes the various charges banks hoist upon you, for whatever reasons :-))

i. Don't keep more money than necessary in the account. There is an utility called autosweep - specify a limit of say Rs. 20,000/- and any balance above this goes to a fixed deposit. This enables you earn more interest! (Of course, if you set up a reverse sweep, then it doesn't help!!)

j. Go the extra step - don't store bookmarks, browsing history etc.; clear cookies after closing the browser. Frequently clear temp folder and do disk clean up. I even clear the SSL state every now and then.

k. Keep an eye on how your net connection behaves - you might not be doing anything, but your system could be showing a lot of traffic. I believe in switching the modem OFF after I am done browsing.

l. The moment you feel something is fishy - contact the bank. It is better to bolt the stable before the horse has bolted!!

[ddriver]

Originally Posted by vrprabhu

Been following for your travails, and was sure that this was bound to happen - unavoidable.

IMHO, you are mixing two issues into one -

(a) You lost money from your account;

(b) The bank was aware of such incidences!!

Why I am specifying the above is, we have to start at the beginning -

1. The moment you have applied for a net banking id, you have bound yourself with the terms and conditions imposed by the Bank. How many of you have a copy of the applications and the terms & conditions with you?
In your case, the terms and conditions are here - https://netbanking.netpnb.com/web/helpfile/Terms.htm

2. Every Bank has to put in place a security policy / guideline for net banking. This is broadly as per the standards set out by RBI.

3. The moment you notice something wrong in your account, you MUST bring it to the attention of the BANK in WRITING. Have you done so? Do you have a copy acknowledged by the BANK? Your complaint should be specific about "unauthorised debit / withdrawal from your account" - without getting into the part about the person who is alleged to have stolen the money, the manager being aware, freezing of account etc.

A note here - don't get into investigation part - that is BANK's headache. As a customer - you have LOST your money, and if it was BANK's fault, they have to reimburse it to you.

4. Having submitted the complaint, you have to wait a reasonable period for the bank to study it and come out with a solution.

5. In your case, thankfully, the reply received from Customer Care Centre acknowledges your complaint.

6. This letter is helpful on these counts (a) the Bank is investigating the issue - indirect admittance that there was something wrong and your complaint had merits; and (b) they have advised you to file a complaint with the Cyber Crime Cell - in which case, you can name them in your complaint and they will be forced to hand over whatever information they have.

7. Now what you have to do is (a) write back to them saying that you are not satisfied with their reply. This is the time to bring in the fact that the Bank was already aware of such phishing attacks, but had been complacent. Mark a copy of this to the concerned dept whose address has been given by them. AND ALSO to (1) the head office of PNB - let us say to General Manager, IT Dept; (2) to the customer service cell of public sector bank of your area. For each area / state, there is a designated PSB which will co-ordinate the customer complaints pertaining to any member Bank. Find out which Bank is the co-ordinator for your city. (Remember - there is no point threatening or aggravating the issue).

8. Send these complaints by registered post and obtain confirmation.

9. Wait for some more time - a couple of weeks and then send a reminder. Remind them that the issue is now ___ months old and taking an inordinately long time to get resolved. The loss of money is causing financial distress and you would like the matter to be settled in maximum time of one month etc. Keep a record of all the correspondence.

10. If the problem is not resolved to your satisfaction, then comes the time to approach the banking ombudsman.

11. You have to write a separate letter to the ombudsman, stating all the above and attaching copies of the correspondence.

A note here - ombudsman deals generally treats complaints like this : (a) deficiency / discrimination in service; (b) where there is a mistake / over charging etc. by the Bank and customer has suffered a loss which has to be made good by the bank.

12. The ombudsman will take up the matter with the bank and give a fair hearing to both the parties concerned and come out with their verdict.

If your problem is not solved, then go ahead with legal / consumer court formalities.

PS - I would advise a little patience. Things take their time to move in a PSB. They will looking for scape goats.

Thanks Mr. Prabhu for taking out valuable time for my problem. I just like to ask few things in form of your opinion--
The mail which i recieved from customer care is the final reply from the bank or still they are looking into the matter?
Secondly, last week i sent registered letter complaint to Banking ombudsman, PNB chairman, PNB chief manager crime cell, and CBI Cyber Cell Delhi and also given letter of FIR request to local police and they are looking upon in which dept it will be filed.Also some 20 days back i send a fax to chairman of pnb and sent email to nodal officer of PNB.
Now should i wait for filing my case to consumer court or should i wait little more as it is already over 4 months?

[vrprabhu]

Originally Posted by ddriver

I just like to ask few things in form of your opinion--
The mail which i recieved from customer care is the final reply from the bank or still they are looking into the matter?
Secondly, last week i sent registered letter complaint to Banking ombudsman, PNB chairman, PNB chief manager crime cell, and CBI Cyber Cell Delhi and also given letter of FIR request to local police and they are looking upon in which dept it will be filed.Also some 20 days back i send a fax to chairman of pnb and sent email to nodal officer of PNB.
Now should i wait for filing my case to consumer court or should i wait little more as it is already over 4 months?

Though the mail received from PNB hints as if it is the end of the isssue, it is not. You have to keep the issue open - by informing them their reply does not redress your complaint, nor your loss has been made good. Hope you have mentioned this point in your registered letter.

Secondly, try to obtain the copy of the FIR - the complaint given to police becomes FIR only after it is registered - meaning the police have taken congisance of the complaint / theft.

Letter to Chairman, PNB would most likely to be directed to the concerned department in the Bank. Therefore, it would be advisable to follow up with the concerned department - which would most likely be Information Technology Department.

Have you received any acknowledgment from the Ombudsman? This will confirm that they have taken up the matter with PNB. I am not sure of the time frame, but normally you should get a reply within a month from the date of registering your complaint.

If you go to consumer court, and if PNB takes a stand that there was no deficiency in service, and that you were negligent , then your chances of getting the money become slim.

Can you try this out?

Visit the branch manager - preferably in the evening when he is not too busy. Find out from him what is the general approach of the bank in these type of cases (generally all the fraud cases are handled by the head office and an investigation officer takes care of the case till it is closed). Try to find out who is handling the case. If you know anybody in Delhi (where PNB is having their head office), ask him to drop in on this person and find out the status of the investigation and the chances of the Bank settling the issue by reimbursing the money. If you are not able to get this information, try to meet / contact the Chief Nodal Officer at their head office. You should definitely get a fair idea on the stand the bank has taken about your complaint.

Generally, PSU bank may be slow, but they don't customers take for a ride. So, if yours is one of several such cases, they may be apprehending that by settling one case they may be forced to settle all such cases in future!!

I am not sure about the provisions of consumer protection act, but AFAIK you can approach ombudsman with cases which upto an year old. At the moment, I would suggest you wait for the reply from ombudsman before proceeding further.

[ddriver]

These are the articles which i came to know couple of days back, i guess they can make my case stronger. Should I send my complaint to allconcerned once again attaching this as reference or still i wait before any response from the banking ombudsman?

[vrprabhu]

Originally Posted by ddriver

These are the articles which i came to know couple of days back, i guess they can make my case stronger. Should I send my complaint to allconcerned once again attaching this as reference or still i wait before any response from the banking ombudsman?

In fact, I have also taken a cutting from "The Business Line" of 14/04 which reports a similar instance. The facts are similar to yours, and the Bank in question is ICICI. Will scan and upload for your reference - when time permits.

In this case the Secretary to State Govt. has acted on behalf of the complaint filed by the client of ICICI Bank.

My advise is - don't quote this as reference. Send a reminder and give a gentle hint that you are contemplating legal remedies.

[vrprabhu]

Originally Posted by vrprabhu

Will scan and upload for your reference - when time permits.

Here it is - what was reported in rediff has been given in detail in "The Business Line".

In this case the customer has taken the facility available under IT (Information Technology) Act. That looks like a quick work and clear cut case - which could work in your favour. Why don't you also give it a try?

[pypkmsrikanth]

Find the difference between the two. No wonder there are unsuspecting people who fall victim to this fraud.

[BaCkSeAtDrIVeR]

I was pondering over this issue for couple of days; (mostly because I too have a netbanking a/c, and was thinking how I will react when faced with this situation).

Here is what you can do.


1. File an application to the bank under the Right to Information Act.
2. You will ask for details of the account and account holder(s) of the account to which your amount was transferred.
3. The bank is bound to follow some "Know your customer" aka KYC procedures as part of some anti-terrorism law; so they are bound to have it.
4. You may have to pay some fee to the bank.
5. Since the info may be regarded as "commercial" or "personal" by the bank as per the RTI act, the bank may have to give notice to the other guy before this information is disclosed.
6. Here is their info an RTI act - http://www.pnbindia.in/Right_inform.htm

[cnureddy.b]

My SBI account was hacked and somebody tried to register a payee.
By Luck I had enabled high security in the Inter banking which would send out SMS passcode to register a payee and also for online transfer.

I didnt not file a complaint with the bank but I changed my password.
Now I ensure only 20k in SB account rest as FD in icici bank, in ICICI bank you cancel FD via phone.

I was pretty sure that SBI would not take any action. I am hating these socialist age PSBs and BSNL

[vrprabhu]

Originally Posted by BaCkSeAtDrIVeR

1. File an application to the bank under the Right to Information Act.
2. You will ask for details of the account and account holder(s) of the account to which your amount was transferred.
3. The bank is bound to follow some "Know your customer" aka KYC procedures as part of some anti-terrorism law; so they are bound to have it.
4. You may have to pay some fee to the bank.
5. Since the info may be regarded as "commercial" or "personal" by the bank as per the RTI act, the bank may have to give notice to the other guy before this information is disclosed.

You may or may not get all the information you want. Even if you do get it, what will you do with it? You won't be able to recover the money from him, will you?

Secondly, the relationship between a Banker and a Customer is confidential. Normally these details are given only as per law - Income Tax Dept or Court Order etc.

Originally Posted by cnureddy.b

My SBI account was hacked and somebody tried to register a payee.
By Luck I had enabled high security in the Inter banking which would send out SMS passcode to register a payee and also for online transfer.
I didnt not file a complaint with the bank but I changed my password.
Now I ensure only 20k in SB account rest as FD in icici bank, in ICICI bank you cancel FD via phone.
I was pretty sure that SBI would not take any action. I am hating these socialist age PSBs and BSNL

That's what is called for - awareness and preventive measures

That last appears to be baised! I can quote several instances where the so call new age bank's and their staff have goofed up and had clients running for cover.....

[BaCkSeAtDrIVeR]

Originally Posted by cnureddy.b

My SBI account was hacked and somebody tried to register a payee.
By Luck I had enabled high security in the Inter banking which would send out SMS passcode to register a payee and also for online transfer.

Good thing.

SBI requires alpha numeric passwords, with special characters. (!@#$%^&*()_+|). These kind of passwords cannot be cracked at one go.

So, my conclusion is - your computer is compromised. Have you sanitised it?

And SBI does not send alternate passwords by email. It is always sent on paper, by registered post. So, simple "forgot password" is not an easy task.

I didnt not file a complaint with the bank but I changed my password.

Bad thing; because informing the bank always helps them step up security measures.

I was pretty sure that SBI would not take any action. I am hating these socialist age PSBs and BSNL

My guess is, you are wrong.

But, I do think you use a very weak password. Worse, on an unsecured PC. So, the fault still is yours.

Originally Posted by vrprabhu

You may or may not get all the information you want. Even if you do get it, what will you do with it?

Prosecute the person directly. It is not easy to forge an identity. At least there was some loophole in the bank's procedures which allowed the fraudster to open an a/c with false credentials.

Secondly, the relationship between a Banker and a Customer is confidential. Normally these details are given only as per law - Income Tax Dept or Court Order etc.

I am APIO myself (but not in a bank). My guess is, a properly framed demand under the RTI Act will work wonders.

Either the identity of the fraudster(s) will be revealed, or a failure on part of the bank to follow the KYC measures will come out. EIther way, the OP wins.

[mithun]

Originally Posted by pypkmsrikanth

Find the difference between the two. No wonder there are unsuspecting people who fall victim to this fraud.
Attachment 335271
Attachment 335272

The difference is there in the URL itself !

[ddriver]

Just now i recieved this mail fom banking ombudsman office-->

Kunal Chaudhary
IHM
Haryana


Sh. S.K.Bansal
Nodal Officer
PNB
Delhi












Dear Sir

Complaint No.200910014005739

It has been decided to convene a meeting in the captioned case on 14 May 2010 at 12.00 hrs. at Conference Hall, Banking Ombudsman Office, 2nd Floor, Reserve Bank of India, 6, Sansad Marg, New Delhi – 110001 . Meanwhile please acknowledge receipt of this letter/email and confirm your participation over email/fax No.011-23725218.



(Jyoti Kukreja)
p.Banking Ombudsman
Office of the Banking Ombudsman
2nd Floor, RBI's Building
6, Sansad Marg
New Delhi - 110 001

Now please let me know is it necessary to have my presence there? Secondly the email they quoted in cc for nodal officer is wrong, so most probably he wont be getting intimation about it. Thirdly what exactly will happen there? as they are calling both the parties.

[ddriver]

Secondly the email they quoted in cc for nodal officer is wrong, so most probably he wont be getting intimation about it.

They just send another mail, this time correct email address of the nodal officer.

[vrprabhu]

Originally Posted by ddriver

Just now i recieved this mail fom banking ombudsman office-->

Now please let me know is it necessary to have my presence there? Secondly the email they quoted in cc for nodal officer is wrong, so most probably he wont be getting intimation about it. Thirdly what exactly will happen there? as they are calling both the parties.

Yes, you should very much be present. Consider it an honour that the Ombudsman (who is generally a very senior (retired) official having good knowledge about the banking system) has called you to attend the hearing!

What he is likely to do is give an hearing to both the parties. If either party doesn't turn up, he can give an ex-parte decision.

This is the time to present your side of the case - I would lay emphasis on the Bank not acting in time / taking necessary steps even after the fraudulent activity was brought to their notice and secondly, that you have not contributed in anyway to this - your stand is that as an innocent account holder you have lost money for no fault of yours.

The Bank is likely to present their side with their rules / regulations / policies etc. - you have to affirm that you have followed all these and the breach was not from your end.

All the best!