The Bombay High Court has directed Bank of Baroda to refund ₹1.24 crore, along with 6% interest, to a Mumbai-based company that fell victim to a sophisticated SIM swap cyber fraud, holding that the customer was entitled to “zero liability” protection under the Reserve Bank of India’s 2017 circular on unauthorised electronic banking transactions.
A Division Bench of Justice Bharati Dangre and Justice Manjusha Deshpande passed the ruling in a petition filed by PNP Polytex Private Limited, which had suffered unauthorised debits of ₹1.24 crore from its Bank of Baroda cash credit accounts in January 2020.
The company discovered that fraudsters had siphoned off funds through 14 transactions across two days after allegedly orchestrating a SIM swap attack. According to the petitioner, fraudsters procured a duplicate SIM linked to the company’s registered banking mobile number, allowing them to intercept OTPs and execute the transactions without the company’s knowledge.
The petitioner argued that it had immediately alerted the bank, lodged an FIR, and reported the fraud through the national cyber crime portal. It relied on the RBI’s July 6, 2017 circular, which provides zero customer liability in cases of unauthorised electronic transactions caused by third-party breaches, provided the customer reports the fraud promptly.
Bank of Baroda resisted the claim, contending that its systems had multiple security layers, including login credentials, OTP authentication, beneficiary verification, and a cooling-off period. The bank argued that such transactions could not have occurred without compromise of confidential credentials and suggested customer negligence.
Vodafone Idea, meanwhile, stated that the SIM exchange had been processed after a caller impersonated the company’s authorised representative and provided details matching its records, though the petitioner maintained the SIM had been replaced without genuine authorisation.
The Court, however, found that the criminal investigation and charge sheet clearly established that fraudsters had manipulated the company’s credentials, swapped the SIM, and diverted the money through multiple beneficiary accounts using fake documents, without attributing any negligence to the petitioner.
Rejecting the bank’s defence, the Bench held that the RBI circular is specifically intended to protect customers from unauthorised electronic fraud and operates independently of criminal proceedings.
“The burden to establish that the customer is at fault is on the bank,” the Court observed, adding that where the customer reports the fraud within the prescribed time, zero liability protection must follow.
The Bench noted that the transactions occurred on a Sunday and in the early hours before banking operations commenced, circumstances that should have triggered suspicion. It also held that once the SIM was fraudulently replaced, the petitioner could not have received OTP alerts, making the bank’s argument about OTP-based safeguards insufficient.
Holding that the petitioner had acted promptly and was a victim of third-party cyber fraud rather than negligence, the Court directed Bank of Baroda to credit the debited amount within eight weeks, adjusting the amount already frozen, and pay interest at 6% from the date of the complaint.
Appearances:
Ms Shilpi Jain with Mr Sumit Raghani, instructed by Agrud Partners, for the petitioner.
Mr Prasad Shenoy with Ms Aditi Phatak, Ms Parichar Zaiwalla and Ms Ishita Desai, instructed by BLAC Co., for respondent no. 1 (Reserve Bank of India).
Ms Prashansa Agrawal with Ms Kirti Singh, instructed by Nahush Shah Legal, for respondent no. 4 (Bank of Baroda).
Mr Mustafa Doctor, Senior Advocate, with Ms Sneha Jaisingh, Mr Akshay Ayush and Ms Asha Anandkumar, instructed by Bharucha & Partners, for respondent no. 5 (Vodafone Idea Limited).
Mr Ashok R. Varma with Mr Vinit Jain and Mr Gaurav Mhatre, for respondent no. 6 (Union of India).
