Case at a Glance
A retired college teacher lost Rs 3,73,000 in 2019 after a caller, posing as the bank, got her to share an OTP that was used to register the ‘State Bank Secure App’ and drain her account. She reported the fraud to the bank the same morning, but the Banking Ombudsman twice rejected her complaint, holding that she was ‘privy’ to the transaction. The Kerala High Court set aside the Ombudsman’s order, held that her case fell under the zero-liability clause of the RBI circular on unauthorised electronic transactions, and directed State Bank of India to make good the full loss within four weeks.
On 13 July 2019, at about 9:40 a.m., the petitioner — described in the judgment as a retired teacher (the cause title lists her as a retired principal of a college) holding a savings account and ATM card with State Bank of India, Mattanur — received an SMS saying her non-chip debit card was proposed to be blocked and could be reactivated online. A caller from the same number then told her the card had been blocked and needed reactivation, and asked for an OTP, ostensibly to register the ‘State Bank Secure App’. She shared it. Rs 3,73,000 was debited from her account. She complained to the bank’s customer care the same day (a complaint SMS at 10:31 a.m.), and her internet banking was blocked.
She complained to the branch manager and the police on 15 July 2019, and an FIR was registered on 17 July 2019. The police investigation traced the fraud to a person in West Bengal who had used her details to create four digital wallets and siphon off the money. The Banking Ombudsman rejected her complaint by a non-speaking order on 20 November 2019. The High Court set that order aside on 17 September 2021 (W.P.(C) No. 1904 of 2020) and remanded the matter, but on 3 November 2021 the Ombudsman again rejected the complaint, holding that she was privy to the entire transaction and that clause 7(i) of the RBI circular (customer negligence) applied. She returned to the High Court.
The Key Question Before the Court
When a customer shares an OTP with a fraudster posing as the bank, but reports the fraud immediately and the police find she was not party to it, is she protected by the zero-liability clause of the RBI circular on unauthorised electronic banking transactions, or does the ‘customer negligence’ clause defeat her claim?
Why the Court Rejected the ‘Customer Was Privy’ Defence
The Court examined the RBI circular relied on by both sides (Ext. P15). Clause 6 provides for zero liability of the customer where the deficiency lies with the bank, and also where there is a third-party breach and the customer notifies the bank within three working days. Clause 7 makes the customer liable where the loss is due to the customer’s own negligence, such as sharing payment credentials, until the unauthorised transaction is reported. The bank argued that sharing the OTP put her squarely in clause 7(i). The petitioner explained that the Secure App was not widely publicised, so she believed that any debit would require a further OTP; the fraudster instead used the OTP she shared to enrol her on the app and siphon off the money. The Court held that this contention “does not require to be disbelieved”, noting that the bank’s counter affidavit did not specifically deny the facts she pleaded.
The Court relied heavily on a Division Bench judgment of the Gauhati High Court (W.A. No. 364 of 2022, decided 13 September 2024), which held that “negligence on the part of the customers must be cogently established by the Bank by bringing reliable materials on record”, and noted that the Supreme Court had dismissed the special leave petition against it on 3 January 2025. While acknowledging that the Supreme Court expects account holders to stay vigilant and not share OTPs, Justice Harisankar V. Menon pointed out that the petitioner reported the fraud the same day, the police identified the fraudster and found she was not privy to the fraud, and yet “the bank has not taken any steps for ensuring that the amounts debited are recredited to the petitioner’s account”. On these facts, the Court concluded that her case “would definitely fall under the provisions of clause 6(ii)” of the RBI circular.
What the Court Actually Held
- The Banking Ombudsman’s order dated 3 November 2021, which treated the customer as privy to the transaction under clause 7(i), was set aside.
- On the facts — same-day reporting, a police report finding the customer was not privy to the fraud, and no specific denial by the bank — the case fell under the zero-liability clause 6(ii) of the RBI circular.
- Following the Gauhati High Court Division Bench, the burden is on the bank to establish customer negligence cogently with reliable material.
- State Bank of India was directed to make good the loss of Rs 3,73,000, as stipulated in the RBI circular, within four weeks.
Why This Judgment Matters
- OTP and ‘KYC update’ scams are among the most common frauds faced by bank customers; this ruling shows that sharing an OTP is not automatically fatal to a refund claim.
- It places the burden on the bank to prove negligence with reliable material, instead of the customer having to disprove it.
- It reinforces the value of reporting fraud immediately — the three-working-day window in the RBI circular was decisive.
What Should Advocates Take Away From the Judgment?
For Bank Customers
- Report any unauthorised debit to your bank at once, in writing or by the bank’s official channel, and keep the SMS or email acknowledgment.
- File a police complaint quickly; a police finding that you were not privy to the fraud can carry great weight.
- If the bank or Ombudsman refuses relief, a writ petition invoking the RBI circular is a recognised remedy.
For Counsel
- Plead specific facts on how the fraud happened and insist on specific denials; the Court relied on the absence of specific denial in the bank’s counter affidavit.
- Cite the Gauhati High Court Division Bench ruling in W.A. No. 364 of 2022 (SLP dismissed on 3 January 2025) on the bank’s burden.
- Distinguish clause 6(ii) (third-party breach, reported within three working days) from clause 7(i) (customer negligence) with reference to the record.
Key Takeaways
- Sharing an OTP does not, by itself, mean the customer was ‘privy’ to an unauthorised transaction.
- The bank must prove customer negligence with reliable material.
- Prompt reporting within three working days can attract zero liability under the RBI circular.
- The High Court can set aside a Banking Ombudsman’s order and direct the bank to make good the loss.
Frequently Asked Questions
I shared an OTP with a caller posing as my bank. Can I still get my money back?
Possibly. In this case the Kerala High Court held that the customer’s case fell under the RBI zero-liability clause because she reported the fraud the same day, the police found she was not privy to it, and the bank did not prove negligence. Each case depends on its facts.
How quickly must I report an unauthorised transaction?
The RBI circular discussed in the judgment gives zero liability for third-party breaches notified within three working days; customer liability rises with delay. Report immediately.
What if the Banking Ombudsman rejects my complaint?
The petitioner here challenged the Ombudsman’s order in a writ petition before the High Court, which set the order aside and directed the bank to make good the loss.
Conclusion
The judgment does not endorse carelessness with OTPs — the Court expressly noted that customers are expected to be vigilant. But it refuses to let banks treat every OTP-based fraud as the customer’s fault. Where the customer acts promptly, the police exonerate her, and the bank does nothing to recover the money, the RBI’s zero-liability promise must be honoured.
Practical takeaway: In OTP-fraud claims, build the record early — same-day complaint to the bank, police FIR, and the investigation report — and put the bank to strict proof of customer negligence.
For more judgments, legal opinions and case analysis, visit courtkutchehry.com