The Court of Appeal determined that Ms. Chuc, when installing the malware-containing software, "indirectly provided" the hacker with the password..., so the loss of 14.6 billion VND in her Techcombank account was "her fault".
On the afternoon of July 2, the People's Court of Bac Ninh province heard the appeal of two lawsuits between the plaintiff, Ms. Tran Thi Chuc, 50 years old, residing in Tu Son city, and two banks: Joint Stock Commercial Bank for Foreign Trade of Vietnam (Vietcombank) and Vietnam Technological and Commercial Joint Stock Bank (Techcombank).
The case with Techcombank as defendant was tried first.
In April 2022, Ms. Chuc went to Techcombank Tu Son City branch to open an account, then transferred more than 14.6 billion VND with her family but did not receive a message notifying her of a change in the balance. 3 days later, when she went to the bank to check, she was informed that the balance was 0.
According to the police report, Ms. Chuc said that two people claiming to be police officers called her and said she was accused of causing a traffic accident, being involved in drug trafficking, money laundering, and asked to open accounts at Techcombank and Vietcombank, transferring a total of more than 26.5 billion VND. She was asked to install security software to "prove that the money was clean"; buy another phone to contact the police via Viber.
This software was later determined by the investigation agency to be able to interfere, process and change a lot of information such as location, history, contacts, messages...
Ms. Chuc accused Techcombank staff of not instructing or advising her on data security information; being "insensitive and indifferent" when she reported the loss of money and not taking measures to report, prevent and block the scammer from dissipating the money...
The court of first instance determined that Techcombank was "partially at fault" and ordered Ms. Chuc to pay VND800 million in compensation. Both the bank and the customer appealed this ruling, and the prosecutor also appealed.
Suggest showing video when customers come to Techcombank to open an account
At the appeal hearing, the Techcombank employee who directly opened the account for Ms. Chuc was absent.
The previous statement of this employee and information from Techcombank representative both confirmed that they had fully and clearly advised the customers on the regulations and procedures for opening and using accounts. When the incident occurred, they made sure to follow 3 steps correctly: advising the customers to temporarily lock their accounts; recommending to report to the police and actively cooperating and providing information to the investigation agency to track down the scammer.
In court, Ms. Chuc said she "did not receive any advice" when opening the account, and the entire process took less than 10 minutes. "I just came to request to open an account, then the staff filled in all the information and checked the services themselves, including transferring money via internet banking," she said.
She said that for the damages related to money transfers via internet banking, the bank must compensate in full because this is a service she did not request.
Techcombank representative replied: According to the law, customers are not required to fill in the information themselves, bank staff can help do this, then give it to the customer to compare, review and make sure, only tick the services that the customer registered for. The customer reads and reviews again, then signs on page 3, where there is the line: "I confirm that I have read, understood, agreed and committed to implementing the contents, terms and conditions of opening an account and using account services at Techcombank"...
Because the two sides have conflicting views on "did Techcombank staff advise Ms. Chuc when opening an account?", her lawyer requested the court to play the video of the day Ms. Chuc came to open the account to confront "what time, what minute, what advice?".
However, Techcombank said that it had already shown it at the first instance trial, so this time it did not bring the video data. Furthermore, the video only had images, no sound.
The Court of Appeal ruled that "the most important part, the sound, was missing from the video", and that it would not replay the part.
In response to the lawyer's argument that "Techcombank only said that it had provided sufficient information, but could not prove it, so it was considered that it had not provided advice", the bank's representative replied: "The plaintiff is accusing the bank of not providing advice, so the responsibility for proof must belong to the plaintiff, do not ask us to provide evidence".
The jury stopped the questioning session and asked Ms. Chuc many questions. The plaintiff said that before Techcombank, she had accounts at two other banks and had transferred money via internet banking. The court asked: "Who told you to open an account, transfer money, who told you to install security software, why did you do it even though you didn't know them?" She said "it's been so long, I don't remember".
"So was it because those two people claiming to be police asked you to open an account?", the jury asked. The plaintiff replied: "I thought the money was in the bank and no one else could withdraw it without my consent. I thought the money was safe in the bank, they kept it secure, so I opened the account without anyone telling me to."
The court analyzed that the plaintiff "at least had experience" opening a bank account and transferring money via phone, so she could not say she did not know anything, signing whatever the staff told her to without reading. "When you manage your phone and account well, no one can take your money," the trial panel said.
Lawyer: Every bank says it is not related and has no responsibility.
Lawyer Le Ngoc Ha, defending Ms. Chuc's rights, said that if Techcombank staff had properly and responsibly contacted and consulted on procedures for opening a new account, provided instructions on safe account use, information security, and warned about tricks of scammers... so that customers could understand and grasp them, Ms. Chuc would not have been taken advantage of by bad guys due to her lack of knowledge to be scammed.
This behavior of the bank employee, according to the lawyer, violated at least two articles 21 and 52 of Decree 88/2019/ND-CP on administrative sanctions for violations in the monetary and banking sector:Not advising users on the principles and scope of using credit information products; Not guiding customers to implement measures to ensure safety and information security when using banking services on the Internet.
"If you have a responsibility to do something but don't do it, you are at fault," the lawyer stated.
According to the lawyer, when a bank has an incident, it must handle it and report it to the State Bank. In this case, Techcombank said that it had reported it but could not present supporting documents, which was "intentionally concealing the error".
"If the error is reported promptly, the State Bank will take measures to direct the relevant banks to block the flow of money, not allowing the thieves to disperse. Techcombank should have acted promptly, knowing that someone had stolen money, they should have chased after it, but if they only reported it a week or a month later, can that be called timely and responsible? If the customer loses money, then who cares?", the lawyer said.
Regarding Techcombank's view that "customers lose money entirely because of customers, not related to the bank", the lawyer said that "if any bank denies responsibility, saying it has nothing to do with the safety of money in customers' accounts, then over time, no one will dare to believe it anymore".
In response, Techcombank affirmed that it had fulfilled its responsibilities according to the law on service provision. Meanwhile, Ms. Chuc had not complied with the law and bank regulations when opening an account; regarding the security of account information, balance management...
Regarding whether Techcombank is responsible for protecting customers' money, the bank representative said "both the bank and the customer have equal responsibility". In this particular case, Techcombank fulfilled its responsibility but the customer did not fulfill his responsibility when "arbitrarily installing software on the phone".
The representative cited the conclusion of the investigation agency that "this behavior caused the customer to lose access to the phone, leading to loss of money", from which Techcombank said that "the loss of money was entirely the customer's fault".
The Procuracy then stated its opinion: Proposing the Trial Panel to accept Techcombank's request, declaring that the bank does not have to compensate Ms. Chuc.
Jury: Completely the customer's fault
After 10 minutes of deliberation, the Trial Panel assessed that although Ms. Chuc did not know the content of the terms and conditions considered as a Contract and binding on the parties on Techcombank's website at the time of opening the account, the bank staff had explained the basic terms and conditions. Therefore, when she signed, she "needed to know and was obliged to know" about these terms.
According to the appeal court, the first instance judgment that "Ms. Chuc's ignorance of these terms was an indirect cause of her loss of money" was unfounded.
Regarding the process of using the service, the Trial Panel assessed: Through the video at the bank, Ms. Chuc handed the phone to the teller "for a long enough time to help download the app to activate the account, the method of confirming the transaction. She used a temporary password to log in, successfully changed the password and left. She had 29 minutes to make the transaction.
The court therefore considered Ms. Chuc's testimony that "she was not allowed to re-read the contract, not allowed to install and activate the application on her phone" to be inappropriate.
Techcombank provided Ms. Chuc with identification factors (username, phone number, password, one-time secret code, OTP code to activate and use Techcombank mobile...). After that, Ms. Chuc performed operations to cancel the use on the iPhone and register on another device to use (at the request of two people claiming to be police officers).
According to Techcombank's transfer rules, only Ms. Chuc knows the OTP code and login password to transfer money, so logging in with the password she set herself shows her subjective will. The transaction is considered valid under the law and Techcombank, the appeal judgment stated.
The Court of Appeal assessed that, according to Ms. Chuc's complaint about the two scammers, it could be seen that Ms. Chuc was at fault for installing the malicious software they requested, "indirectly providing" them with the login name, password, and OTP for Techcombank Mobile transactions. The fact that the scammers took all her money was "entirely her fault".
When relatives transferred money into the account, Ms. Chuc did not proactively check the amount received, thereby "creating conditions" for the scammer to transfer her money to another account. "If she regularly checked her account balance, she would have detected the fraud early on and taken timely measures to prevent and minimize the damage," the verdict stated.
The court rejected Ms. Chuc's appeal, accepted Techcombank's appeal and the prosecutor's protest. This means that Techcombank does not have to compensate any of the VND14.6 billion that customers lost, because the court determined that it was "not at fault".
Immediately after the verdict in the late afternoon of July 2, the Trial Panel moved on to try the second case.with the defendant Vietcombank. During the interrogation, faced with many pressing questions, Ms. Chuc could not continue the trial and was helped out by her daughter.
Ms. Chuc's lawyer requested to stop the trial and continue the next morning, because attending two consecutive lawsuits for the past 6 hours made her client stressed and tired, and the trial had lasted too late. The representative of the prosecutor's office and Vietcombank's lawyer also made the request.
After consultation, the Trial Council decided to adjourn at 8:00 p.m. and resume this morning, July 3.
VN (according to VnExpress)