Delhi Consumer Court: Bank Liable for OTP Fraud Despite Customer Device Issue

• A Delhi Consumer Commission ordered a private bank to refund Rs 70,084 for unauthorized online transactions.
• The bank was also directed to pay an additional Rs 25,000 in compensation and litigation costs.
• The ruling emphasized that the bank failed to prove customer negligence in an OTP fraud case.
• The commission relied on an RBI circular stating banks are liable if fraud is reported within three days.
• A Bombay High Court precedent places the burden of proving customer liability on the bank in such cases.

It clarifies that banks bear the burden of proving customer negligence in such cases, especially when the fraudulent activity is reported within the three-day window specified by RBI guidelines.

A Delhi resident encountered a series of unauthorized online transactions from her savings account in July 2016, amounting to Rs 77,114. These fraudulent debits occurred between July 4 and July 9, 2016. Her bank account was linked to her mobile phone for receiving transaction alerts and one-time passwords (OTPs); however, she reported experiencing technical issues with her device during this period, which prevented her from receiving these crucial notifications promptly. Upon discovering the illicit activity, she acted swiftly, sending an email to her bank's customer care on July 10, 2016, to request a block on her card and further transactions, and also filed a police complaint.

Despite her timely notification, the private bank did not process a refund for the debited sum. The complainant asserted that these unauthorized withdrawals led to a cascade of financial difficulties, including penalty charges for Electronic Clearing Service (ECS), the failure of her mutual fund investments, and the lapse of her life insurance policy, which she later reinstated by incurring additional penalty fees. After a legal notice sent on her behalf went unanswered, she escalated the matter to the consumer commission, seeking a refund, compensation, and litigation costs. The bank, in its defense, disclaimed responsibility for the transfers, contending that the cardholder was accountable for any compromise of OTP or card details.

The Delhi Consumer Commission, presided over by Monika Aggarwal Srivastava and Member Ritu Garodia, ultimately ruled in favor of the complainant. In its order issued on October 30, the commission instructed the private bank to refund Rs 70,084, specifically corresponding to a debit that occurred on July 9, 2016. In addition to the refund, the bank was mandated to pay an extra Rs 25,000 to the complainant, covering both compensation and the costs associated with the litigation.

The commission determined that the bank was guilty of a "deficiency in service." This conclusion was reached because the bank failed to reverse the fraudulent debits despite receiving prompt notification from the account holder. Crucially, the commission dismissed the bank's argument that the complainant was responsible for the security breach, emphasizing that the bank had not presented sufficient evidence to establish any negligence on her part.

A pivotal element in the commission's decision was the Reserve Bank of India's (RBI) circular, dated July 6, 2017. This circular explicitly states that in situations involving third-party breaches where neither the bank nor the customer is at fault, and the customer informs the bank within three working days, the liability for the unauthorized transaction rests entirely with the bank. The commission observed that the complainant had notified her bank on July 10, 2016, merely one day after the Rs 70,084 debit on July 9, 2016, thereby placing her well within the stipulated three-day notification period.

Furthermore, the commission bolstered its position by citing a precedent established by the Bombay High Court. This precedent dictates that in cases concerning unauthorized electronic transactions, the burden of proving customer liability lies squarely with the financial institution. The Delhi Consumer Commission concluded that the private bank had failed to meet this stringent evidentiary standard, as it could not demonstrate any fault or negligence on the part of the complainant. This legal framework underscores the principle that banks must actively prove customer negligence rather than simply asserting it.

This ruling from the Delhi Consumer Commission carries significant implications for both financial institutions and consumers across India, particularly concerning OTP fraud and unauthorized online transactions. It clarifies that banks bear the burden of proving customer negligence in such cases, especially when the fraudulent activity is reported within the three-day window specified by RBI guidelines. This establishes a high evidentiary bar for banks, compelling them to enhance their fraud investigation protocols and internal processes.

For consumers, this decision reinforces their rights and provides a clear legal precedent. It assures account holders that the timely reporting of unauthorized debits can protect them from liability, aligning with the RBI's objective to safeguard customers from third-party breaches. The finding of "deficiency in service" against the bank serves as a reminder that financial institutions are expected to act diligently upon receiving fraud notifications, and failure to do so can result in significant financial penalties and compensation awards. This case highlights the critical role of consumer commissions in upholding customer protection against digital financial fraud.

This Delhi Consumer Commission ruling clarifies that banks bear the burden of proving customer negligence in OTP fraud cases, especially when reported within three days as per RBI guidelines. Lawyers should advise financial institutions to strengthen fraud investigation protocols and be prepared to meet this high evidentiary standard, while lawyers representing customers can cite this precedent to secure refunds and compensation.

Source: Original reporting via Indian Express