HDFC Bank — Complaint regarding fraudulent withdrawal of funds from my account no [protected] Ref No: Complaint No MUMP[protected]

Address:

HDFC BANK MAPUSA

I HAD FILED A LETTER TO HDFC BANK WHICH IS SELF EXPLAINATORY
To,
The Manager,
HDFC Bank,
Feira-Alta Branch,
Mapusa-Goa
403507
Date :[protected]
Subject: Complaint regarding fraudulent withdrawal of funds from my account no [protected]

Ref No: Complaint No MUMP[protected]

Dear Sir/Madam,
I am writing to you today to complain about a fraudulent withdrawal of funds from my HDFC Bank account. On 31.08.2023, I received an SMS from HDFC Bank with a link to a website that said was for encashing rewards points. I clicked on the link on my phone and was taken to a website that looked like the HDFC Bank website. I entered my login ID and login password, and I was then asked to enter an OTP that was sent to my mobile phone. I entered the OTP and immediately an amount of Rs 89022 was debited from my account without a transaction password and despite the fact that the payee was not in my beneficiary list. Additionally, the amount withdrawn was above Rs 50000/- and it is rather surprising that your systems were so fragile as to allow a transaction without cross verification.
I immediately contacted the free helpline number and they blocked all transactions to the account.
Just for additional information, I am an ex-employee of Canara Bank who retired barely a year back after serving the institution for 38 years. In my service, I worked on an IT platform and my job centered around troubleshooting, reconciling and analyzing bank data. Till date, I have never experienced such a fraud wherein a transaction could be carried out without a transaction password and how a NEFT transfer could be done and that too immediately through Net banking without creating a beneficiary. Additionally, I wish to humbly say that I have also analyzed and converted account statements of some of your HDFC account holders running in over a hundred pages in just a few minutes using advanced technology. The reason I have mentioned this is because for years I have been doing all my transactions online and have never encountered such a problem. I believe that HDFC Bank has a serious security lapse in their software. I also believe that the branch was not competent enough in handling the issue and needs to be more professionally equipped.
Additionally, just a couple of months back since there were no Forex cards available at this branch, I had problems with just the delivery of the Forex cards for me and my daughter despite completing all the formalities online. It was only after frequenting and fussing at your Mapusa branch Code 0202 that I was able to get it.

Kindly note that I opened this account because it is just a few meters away from my residence but its only added to my woes
I demand that HDFC Bank refund the amount that was fraudulently withdrawn from my account. I have attached herewith a Cardholder dispute form and would be highly obliged if you could activate my netbanking and issue a new debit card and kindly furnish the reference Id of the transaction so as to file a complaint with the Cyber Crime Department.
Transaction Details:
Complaint No MUMP[protected]
Service request no. 31545780
Customer ID:[protected]
Type of transaction: EPI
Date & Time: AUG[protected]:15:27
Amount (INR) : 89902
Beneficiary Name: PAYUBAJAJFI6
Transaction Status: APPROVED
Device Name:realme RMX1911 10 Q OS
Type:android OS Version:10

I look forward to hearing from you soon.

IN BRIEF I RECIEVED THIS REPLY
We wish to inform you that any such debits happening to the customer's account using NetBanking is valid transaction for the Bank since the same has been done using the Customer ID, NetBanking password (IPIN) and other account sensitive information which is known only to the customer.

As per the Bank, the transaction have been a validly executed transaction using your Customer ID and NetBanking password followed by the second factor authentication i.e., One Time Password (OTP) which is sent on your registered mobile number / Challenge Questions (CQ) that is privy and known only to you.

TO WHICH I REPLIED
To,
Grievance Redressal Officer,
Mr. Mehernosh Dhamodiwala,
HDFC Bank Limited., 1st Floor,
Empire Plaza - 1,
Lal Bahadur Shastri Marg,
Chandan Nagar,
Vikroli West, Mumbai
400083

Date:10th September 2023.
Subject: CRM# 31545780

Complaint regarding fraudulent withdrawal of funds from my account no [protected]

Ref No: Complaint No MUMP[protected]

Dear Sir,
With reference to the above, I was very dismayed with the negative response by the customer service/cybercrime cell of your institution. You have mentioned in your response that such debits happen to the customer’s account. As per the bank, the transaction has been a validly executed transaction using your Customer ID and NetBanking password followed by the second factor authentication i.e., One Time Password (OTP) which is sent on your registered mobile number / Challenge Questions (CQ) that is privy and known only to you. Using NetBanking for transactions is valid for the bank since the same has been done using the Customer ID, NetBanking password (IPIN), and other account sensitive information which is known only to the customer.
Although I do admit that my Customer ID, password, and OTP received were fed into a system that looked similar to your Net banking platform, kindly note that this access was only given to my login and not for the transaction no other sensitive information was compromised with.
I would like to contest the explanation and would be obliged if I could get an explanation of the details given below.
1. Can a transaction on the account be carried out without a Transaction Password which I did not punch and neither was an OTP received for my Transaction password to carry on the transaction. As per the bank, a transaction cannot be carried out without a transaction password and OTP.Please Clarify the process.
2. According to HDFC website, creating a beneficiary is mandatory for transferring funds using net banking. Can this transaction take place without me creating a beneficiary
3. As per the Reserve Bank of India (RBI), NEFT transactions are processed in batches and settled in hourly time slots . Therefore, it is unlikely that an NEFT transfer of Rs 89902/- would be carried out immediately. Can you furnish the Timeline of my transaction
5. Kindly furnish the details of the HDFC logs or timeline of transactions.Additionally kindly furnish a timeline of the transaction as per your Logs in the system including of my call to the helpline no to block my account..The fraud was done on 31st August 2023 approximately between 3 pm and 3.15 Ref[protected] and the account was blocked immediately within a few minutes I would like to know the timeline to this call log too
6. I have filed a complaint with Cyber Crime online within 12 hours, and now you advise me to file an FIR with the local Police Station. Does it mean that spending an hour filing a complaint to The Cyber Crime has no solution to my financial loss, but the local Police station would solve this mystery?
Kindly note that I suspected the fraud within a few seconds and contacted your Helpline No and blocked all the transactions within 5 minutes. Additionally, I visited the HDFC branch immediately within 15 minutes, and maybe the manager was too busy to listen to my explanation. The reaction I received from the Branch was just the same as your response to my Grievance. It was only after a patient wait of almost an hour that I was handed a Card dispute form which I filled and handed it over the next day i.e., 1st September 2023. I had also filed my grievance with Cybercrime online, which has been reported successfully on cybercrime.gov.in with Acknowledgement No.[protected].

Additionally, if you have gone through my complaint letter, I have had a very bad experience with your services on getting the Forex cards, and definitely this response does not come as a solace to my banking experience with HDFC Bank. I have attached herewith a copy of two complaints filed with Cybercrime and awaiting a response to this mail.
I would be highly obliged if you could furnish the details to my queries at the earliest so I can pursue the matter.
Sincerely
Kenneth Charles D Souza

THE ABOVE INFORMATION IS SELF EXPLAINATORY AND I WOULD LIKE TO TAKE ACTION AGAINST HDFC BANK FOR THE SAME