Accepting the customer’s explanation that the OTP was only for app registration and a further OTP would be needed for debits, the Kerala High Court (Ernakulam Bench) applied zero liability protection, relying on her immediate reporting and police findings that she was not privy to the fraud. The Court placed the case under Clause 6(ii) of the RBI circular, which provides zero liability for qualifying third-party breaches reported within three working days, not under the customer-negligence provision in Clause 7(i) applied by the Ombudsman.
Finding that the customer complained on the same day, the Court noted that the bank took no steps to ensure recredit of the money and no further action even after the police identified the fraudster. The Court relied on the Gauhati High Court’s reasoning that banks must establish customer negligence through reliable material. Accordingly, the Court set aside the Ombudsman’s rejection order, and directed SBI to make good the Rs. 3.73 lakhs loss expeditiously, within four weeks at the latest.
AccordinglkySBI was directed to make good the ₹3,73,000 loss within four weeks.
Briefly, Remadevi T.L., a retired teacher holding an SBI savings account, received an SMS and a telephone call on 13 July 2019 stating that her debit card would be blocked and needed reactivation. She shared an OTP for registration of the “State Bank Secure App”, despite the SMS warning against sharing it. An amount of Rs. 3.73 lakhs were then debited from her account. She immediately informed the bank through customer care, following which her internet banking account was blocked.
The police investigation subsequently identified a fraudster who had used her details to create four digital wallets and siphon off the money. After an earlier Ombudsman order was set aside and reconsideration directed, the Banking Ombudsman again rejected her complaint.
Also read Delhi High Court Upholds Denial of RTI Information on PM’s Foreign Flights Citing National Security
A Single Judge Bench of Justice Harisankar V. Menon accepted the petitioner’s explanation that she believed the OTP was only for registering the app and that a further OTP would be necessary to debit money. Her contention that the app had not received wide publicity, and the facts stated in her petition, had not been specifically denied in the bank’s counter affidavit.
The Court also noted that she reported the fraud on the same day, but the bank took no steps to secure recredit of the money or further action even after the police identified the fraudster. The police report showed that she was not privy to the fraud.
The Court relied on the Gauhati High Court’s decision in W.A. No.364 of 2022 dated Sep 13, 2024, that banks cannot avoid liability merely based on perceived customer negligence, and that negligence must be established through reliable material. It also acknowledged the Supreme Court’s caution that customers must remain vigilant, must not share OTPs, and may themselves be held negligent depending on the facts.
