ICICI Bank has been ordered to pay Rs 12.85 lakh to a customer who lost Rs 6.50 lakh in a fraud – known as phishing. Replying to a mail that Umashankar Sivasubramaniam thought was from the bank but actually was not, he revealed his password and the phishers broke his internet bank account and stole money.

The bank's defence before Tamil Nadu IT Secretary PWC Davidar (as also in response to the story carried by Governance Now) was that it was the customer's fault, and on its part ICICI Bank (and all other banks) routinely apprise customers to be careful of phishing. (A phisher recreates an exact replica of the home page of the bank and requests the customer to fill in his user name and password for the purpose of updating the records; with an accompanying warning that if the customer fails to respond s/he might be locked out of internet banking.)

The customer, no doubt, should have been careful, but a large number of customers are not necessarily e-savvy. Also, this case relates to 2007 when phishing was a relatively new concept and even banks had not done much to caution customers. Today banks caution customers about phishing, but are mere advisories enough, as Davidar has pointed out in his verdict? Are the banks doing enough to ensure that their sites cannot be phished? They have the wherewithal to invest in e-security upgrade and add, for example, the kind of digital signature that makes phishing more difficult. So, banks must fully take the hit for phishing frauds.

The counterargument is, if a customer is e-savvy enough to open an internet banking account, s/he should take responsibility and be careful about her/his money as well. So, the customer should take the hit for phishing frauds? What is your view?