Case at a Glance
A retired professor lost ₹12,93,922 from his SBI savings account through unauthorised UPI and payments-bank transactions in April 2019. The District, State and National Consumer Commissions all held the bank liable, applying the RBI’s ‘zero liability’ rule. Allowing SBI’s writ petition, the Karnataka High Court held that the case fell under the customer-negligence clause instead, because the professor received real-time SMS alerts and did not act, and had shared his Aadhaar details with an unknown person claiming to be a bank manager. Finding no deficiency in service, it set aside the NCDRC order.
The respondent, a retired Professor of Botany, had about ₹25 lakh in gratuity and DCRG credited to his SBI savings account after retiring in November 2017. On 11 March 2019 he instructed a transfer to his Syndicate Bank account; the bank said the account number did not exist and informed him by SMS. Between 12 and 30 April 2019, ₹12,93,922 was withdrawn through unauthorised UPI, Paytm Payments Bank and Airtel Payments Bank transactions. He discovered this on 30 April 2019, reported it to the bank on 2 May 2019, and complained to the police, the cyber crime police, the Banking Ombudsman and the Police Commissioner. He said he could not monitor the account because of poor mobile network coverage at his native place.
He filed a complaint under Section 35 of the Consumer Protection Act, 2019. On 27 May 2022 the District Commission ordered a refund with savings-bank interest, ₹25,000 damages and ₹10,000 costs. The State Commission dismissed SBI’s appeal on 19 September 2024, holding that sharing Aadhaar details is not sharing banking credentials and applying zero liability. On 15 May 2026 the National Commission dismissed SBI’s revision, applying Para 6(ii) of the RBI circular dated 6 July 2017. SBI then filed a writ petition.
The Key Question Before the Court
Is a customer who received real-time alerts of unauthorised debits and had shared his Aadhaar details with an unknown caller entitled to ‘zero liability’ under the RBI circular, or does the customer-negligence clause apply?
Zero Liability or Customer Negligence?
The RBI circular of 6 July 2017 provides, in Para 6(ii), for zero liability of the customer where a third-party breach occurs and the customer notifies the bank within three working days, and, in Para 7(i), that where the loss is due to the negligence of the customer, such as sharing payment credentials, the customer bears the loss until reporting. The Bench noted the respondent admitted receiving SMS messages about the transactions, and the bank produced records of alerts sent as the debits occurred; he therefore had “real-time knowledge regarding the same”. His explanation that he “had confidence in the petitioner-bank” did not explain the delay. He had also operated the account on 15 April 2019, during the disputed period, and the bank blocked further attempts once it received his complaint.
The respondent had admitted sharing his Aadhaar number with a person who claimed to be a bank manager — “a person whose identity he did not know”. The Internal Ombudsman’s report had noted the possibility that an OTP was shared with the fraudster. On these facts the Court held that Para 7(i), not Para 6(ii), applied: “Having been negligent, it is not open to him to shift the blame upon the petitioner,” and “having regard to his own negligence and conduct, we are unable to grant relief in his favour.” The deficiency findings of the lower Commissions were described as unsustainable, as there was no deficiency in service under Section 2(11) of the Act.
What the Court Actually Held
- Where a customer receives real-time alerts of unauthorised debits and fails to act, and has shared Aadhaar details with an unknown person, the loss falls under Para 7(i) (customer negligence) of the RBI circular of 6 July 2017, not the zero-liability clause in Para 6(ii).
- The bank, which sent alerts and blocked further transactions on receiving the complaint, was not guilty of deficiency in service under Section 2(11) of the Consumer Protection Act, 2019.
- The concurrent findings of the District and State Commissions holding the bank liable were described as unsustainable.
- The writ petition was allowed and the National Commission’s order dated 15 May 2026 was set aside, with no order as to costs.
Why This Judgment Matters
- It shows that the RBI’s zero-liability protection is not automatic: a customer’s own conduct after receiving alerts can shift the loss to the customer.
- It is a rare case of a High Court overturning concurrent findings of all three consumer fora in a banking-fraud dispute.
- It is a practical warning for senior citizens and pensioners: never share Aadhaar or OTP details with callers, and act at once on debit alerts.
What Should Advocates Take Away From the Judgment?
For Bank Customers
- Report any unauthorised debit to the bank immediately — the zero-liability rule depends on prompt notice.
- Do not share Aadhaar, OTP or other details with anyone claiming to be a bank official.
- Keep your registered mobile number active and check SMS alerts regularly.
For Counsel
- In banking-fraud complaints, establish when the customer first received alerts and when the bank was notified.
- Banks should produce SMS-alert logs and internal ombudsman reports to invoke Para 7(i).
- Writ jurisdiction may be invoked against NCDRC revisional orders; this judgment does not discuss maintainability and decides on merits.
Key Takeaways
- Zero liability under the RBI circular is not available where the customer’s negligence caused the loss.
- Ignoring real-time SMS alerts weighed heavily against the customer.
- Sharing Aadhaar details with an unknown caller was treated as negligence.
- The NCDRC order upholding a refund of ₹12.9 lakh was set aside.
Frequently Asked Questions
What is the RBI zero liability rule for online fraud?
Under Para 6(ii) of the RBI circular dated 6 July 2017, as described in this judgment, a customer has zero liability where the unauthorised transaction arises from a third-party breach and the customer notifies the bank within three working days. Para 7(i) makes the customer bear the loss where it is due to the customer’s own negligence.
Why did the professor lose despite winning before three Commissions?
The High Court found he had real-time knowledge of the debits through SMS alerts but did not act, had operated the account during the period, and had shared his Aadhaar number with an unknown person claiming to be a bank manager, so the negligence clause applied.
Were the District and State Commission orders also set aside?
The operative order expressly sets aside the National Commission’s order of 15 May 2026, while the reasoning describes the lower Commissions’ deficiency findings as unsustainable.
Conclusion
State Bank of India v. Prof. K.P. Sreenath is a sobering reminder that consumer protection in digital banking is a two-way street. The RBI framework protects vigilant customers who report promptly; it does not shield those who ignore alerts or hand personal details to strangers.
Practical takeaway: In any online-fraud claim, the timeline of alerts and reporting is decisive — customers should report within three working days, and banks should preserve alert logs to show what the customer knew.
For more judgments, legal opinions and case analysis, visit courtkutchehry.com