The 01:10 IMPS Debits and the Shared PC

1. Stop the bleeding (first 10 minutes). Hotlist the debit card, block her internet and mobile banking channels, and reset credentials. The transfers have already left, but the credentials that produced them are still live and a fourth debit is the only loss that is still preventable. Nothing else in this list matters if the channel stays open.

2. Register the complaint and give her a written acknowledgement with a reference number and timestamp (next 15 minutes). The clock on the bank's liability timelines starts from the date of notification, not the date the branch gets around to it. An oral complaint recorded late is a liability the branch creates for itself.

3. Attempt recovery while the money is warm. Obtain the IMPS reference numbers (RRN) for all three transfers, and route a recall request through the beneficiary banks the same morning. IMPS settles instantly, so the funds may already be withdrawn, but a same-day request occasionally catches an unemptied beneficiary account.

4. Escalate to the bank's fraud monitoring/chargeback cell and to the relationship/regional office. They control the interbank correspondence and the provisional credit decision; the branch cannot settle this locally.

5. File the police complaint, and preserve evidence before anything is cleaned. Her phone SMS, the link, the OTP message and screenshots are the case.

Only after these does the branch turn to the infected PC - but the two tracks must run in parallel, not one after the other.

The classification comes first. The transactions were not initiated by her, so they are unauthorised - but she disclosed the card credentials and the OTP, so this is not a pure third-party breach. The distinction matters because liability is graded by cause and by speed of reporting.

Under the RBI customer-protection framework for unauthorised electronic banking transactions, the working logic is:

• Where the deficiency is on the bank's side (a systems breach, a compromised server), the customer's liability is zero, provided she reports within three working days.
• Where the loss arises from the customer's own negligence, her liability is limited, capped by the bank's board-approved policy, again with the three-working-day reporting condition softening the cap.
• Where she reports after three working days, liability is determined by the bank's policy, and the bank may be entitled to recover part of the loss from her.

She reported on the day of the debit, so she is well inside three working days. But the OTP disclosure will be argued as negligence. That places the case at the limited liability end, not the zero-liability end.

Timelines the branch must meet: provisional credit within 10 working days of notification, and final resolution within 90 days, with the customer informed of the outcome. The bank must also report the cyber incident through its established channels, including CERT-In, which expects incident reporting within about six hours of detection. Confirm the current circular text and the bank's own policy before any figure is put in writing to her.

Contain, do not clean. The reflex is to format the PC and get the counter running again; that reflex destroys the only evidence that can establish whether the same malware touched other machines and whether the ₹48,000 left through card credentials alone or through a compromised branch endpoint.

Immediate steps:

• Unplug the PC from the network and disable its USB ports; do not shut it down in a way that wipes volatile memory if a forensic image has not yet been taken.
• Take a forensic image of the disk before any remediation, and photograph the pen drive and the extension's details from the browser's extension manager.
• Log the identity of every staff member who used the machine, and stop using it for customer transactions or for any credential entry until it is cleared.
• Escalate to the bank's information security team and report the incident through the cyber-incident channel; a branch does not investigate alone.
• Treat the pen drive as hostile: it is the likeliest vector - an unknown device, introduced by an unverified visitor presenting himself as a vendor, on a machine that later showed a new extension and sluggish performance, is the textbook profile of a keylogger or a remote-access tool.

Why the image matters: it establishes the timeline against the 01:10 transfers and answers a question that decides liability - was this only the customer's OTP mistake, or did the branch's own endpoint leak credentials? Without the image, the branch cannot prove the former and may end up defending the latter.