RBI Circular On Unauthorised Transactions | Bank Cannot Deny Zero Liability Protection Alleging Negligence If Customer Promptly Reports Cyber Fraud: Kerala High Court

"Banks cannot absolve themselves of the liability towards losses suffered by the customers on account of unauthorized electronic transactions based on perceived negligence of the customers." Kerala High Court, in a significant ruling delivered on October 5, 2026, held that a bank cannot evade its obligation to indemnify a customer under the Reserve Bank of India’s zero liability framework by raising a bald plea of customer negligence when an unauthorised transaction is reported immediately.

Justice Harisankar V. Menon quashed an order of the Banking Ombudsman that had rejected a customer's claim for compensation, observing that where an account holder is tricked into sharing credentials during cyber fraud and immediately notifies the bank, the case falls squarely under Clause 6(ii) of the RBI Master Circular governing unauthorised electronic banking transactions.

The petitioner, a retired college principal, suffered an unauthorised debit of ₹3,73,000 from her State Bank of India account after a fraudster contacted her under the pretext of reactivating her blocked debit card and obtained an OTP to register on the "State Bank Secure App". She immediately notified the bank's customer care on the very same day to block her account, followed by formal complaints to the branch and the police, but her claim for refund was rejected by the Banking Ombudsman under Clause 7(i) of the RBI Circular. Aggrieved by the Ombudsman's rejection order, she approached the High Court seeking full compensation from the bank.

The legal question before the court was whether a customer siphoned off of funds by cyber fraudsters after being deceived into sharing an OTP is entirely excluded from the 'Zero Liability' mandate under Clause 6(ii) of the RBI Circular dated July 6, 2017, by operation of customer negligence under Clause 7(i).

Scope Of Limited Customer Liability Under RBI Circular

Examining the circular issued by the Reserve Bank of India bearing reference DBR.No.Leg.BC.78/09.07.005/2017-18 dated July 6, 2017, the court addressed the competing applicability of Clause 6 and Clause 7. The bank contended that under Clause 7(i), where a loss is due to negligence by a customer—such as sharing payment credentials—the customer must bear the entire loss until the unauthorised transaction is reported. Conversely, the petitioner maintained that the transaction constituted a third-party breach under Clause 6(ii), which entitles the customer to zero liability if notified within three working days.

Unbelievable That Customer Would Deliberately Share Credentials To Siphon Hard-Earned Money

To resolve this conflict, the court placed primary reliance on a Division Bench judgment of the Gauhati High Court in Writ Appeal No. 364 of 2022, which was affirmed by the Supreme Court in Petition for Special Leave to Appeal (C) No. 30677 of 2024. The court underscored the finding that it is inherently implausible that a customer would intentionally part with confidential information to cause their own financial ruin.

"Learned single Judge has rightly observed that regardless of whether it was a UPI or PG transaction, it is not believable that the respondent no. 1/petitioner would deliberately share his OTP, password and MPIN so as to allow his hard-earned money to be siphoned off from the bank account by a fraudster..."

The court reiterated that cybercrimes often involve deceit where unsuspecting individuals are coerced or manipulated into parting with access credentials. Such instances do not per se establish complicity or fatal negligence so as to deprive the consumer of regulatory protections.

Bank Must Cogently Establish Negligence Through Reliable Material

The bench emphasized the authoritative pronouncement of the Gauhati High Court, which held that financial institutions cannot shift their custodial liability onto customers merely by presuming negligence without evidentiary backing. While banks may avoid liability if customer negligence is conclusively shown, the burden of establishing such negligence rests squarely on the bank through cogent and reliable materials.

"However, in such cases, negligence on the part of the customers must be cogently established by the Bank by bringing reliable materials on record. The Banks cannot absolve themselves of the liability towards losses suffered by the customers on account of unauthorized electronic transactions based on perceived negligence of the customers."

Noting the Supreme Court's dismissal of the Special Leave Petition arising from that ruling, Justice Menon highlighted the Apex Court's dictum that the primary institutional responsibility to maintain vigilance and detect fraudulent transactions lies on the bank, which commands the best technological infrastructure.

Customer Promptly Reported Fraud While Bank Remained Inactive

Analyzing the specific factual matrix, the High Court observed that the petitioner was under the genuine belief that further transactional OTPs would still be needed before amounts could actually be debited from her account. The bench observed that the bank had failed to give wide publicity to the operational mechanisms of the newly floated application used by the fraudster to divert the funds into digital wallets.

Crucially, the court found that the petitioner had acted with utmost diligence by lodging a formal complaint via SMS immediately upon receiving debit alerts, followed by an immediate police complaint. In sharp contrast, the bank failed to demonstrate any affirmative remedial action, neglected to raise chargeback requests with the recipient entities, and did not take proactive measures even after the police investigation report identified the fraudster.

Entitlement To Complete Zero Liability Under Clause 6(ii)

Given that the investigation proved the petitioner was not privy to the fraud and that she had reported the illicit debits to the bank on the very day of occurrence, the court ruled that her case strictly attracted the zero-liability safeguard. The bench held that the Ombudsman's reliance on Clause 7(i) was entirely untenable in the absence of substantiated negligence.

"When that be so, the petitioner’s case would definitely fall under the provisions of clause 6(ii) of Ext.P15 circular of the RBI. That being the position, the petitioner’s case is covered by the judgment of the Division Bench of the Gauhati High Court, as has been confirmed in the order dated 03.01.2025 passed by the Apex Court..."

Setting aside the impugned rejection order passed by the Banking Ombudsman, the High Court directed the State Bank of India to make good the entire loss of ₹3,73,000 to the petitioner within four weeks. The ruling reinforces that banks cannot evade the RBI's zero liability framework by merely citing the disclosure of an OTP during an orchestrated cyber scam where the customer notifies the bank without delay.

Date of Decision: 05 October 2026