Introduction:

The Kerala High Court has directed the State Bank of India (SBI) to refund ₹3.73 lakh to a customer who lost money in a cyber fraud after being deceived into sharing a one-time password (OTP), holding that she was entitled to the protection of the Reserve Bank of India’s (RBI) zero-liability framework. Justice Harisankar V. Menon set aside an order of the Banking Ombudsman that had rejected the customer’s complaint on the ground that she was privy to the fraudulent transaction. The Court found that the bank had not established her involvement in the fraud and emphasised that she had promptly informed the bank and the police about the unauthorised transaction.

The ruling, reported as 2026 LiveLaw (Ker) 591, addresses an important question in digital banking: whether a customer who is tricked into disclosing an OTP should automatically bear the entire loss, or whether the bank must reimburse the customer when the circumstances bring the transaction within the RBI’s prescribed zero-liability protections. The judgment highlights the need to distinguish between a customer’s disclosure of confidential credentials under deception and actual complicity in a fraudulent transaction.

The petitioner maintained a bank account with SBI and held an ATM card linked to the account. The incident began after she received information that non-chip-based debit cards would be blocked from April 29, 2019. She subsequently received an SMS stating that her debit card would be blocked but could be reactivated online. The message was followed by a telephone call from the same number, during which the caller informed her that her card had been blocked and that she needed to participate in a process to reactivate it.

Believing the communication to be genuine, the customer was instructed to provide details, including an OTP, for registering the “State Bank Secure App”. She complied with the instructions, apparently under the impression that she was completing a legitimate banking procedure. Soon afterwards, approximately ₹3.75 lakh was debited from her account.

The customer acted promptly upon discovering the unauthorised transaction. She contacted SBI’s customer care service, following which the bank blocked her internet banking account. She also submitted a complaint to the branch manager and approached the police. The police investigation subsequently identified a person named Sandip Bauri from West Bengal as the individual who had siphoned off the money.

Despite these steps, the bank did not refund the amount. The customer then approached the Banking Ombudsman, challenging the bank’s refusal to reimburse her. The Ombudsman rejected her complaint after concluding that she was privy to the fraudulent transaction. Aggrieved by that decision, she approached the Kerala High Court, arguing that the Ombudsman had incorrectly applied the RBI’s rules governing liability for unauthorised electronic banking transactions.

The petitioner relied on the RBI Master Circular governing customer protection in unauthorised electronic banking transactions. In particular, she invoked Clause 6(ii), which provides for zero liability in specified circumstances involving a third-party breach where neither the customer nor the bank is responsible for the security lapse, provided the prescribed reporting requirements are satisfied. According to her, she had reported the fraud without delay and therefore qualified for reimbursement.

SBI disputed this position, arguing that the case fell under Clause 7(i) of the circular, which deals with losses resulting from a customer’s negligence, including the sharing of payment credentials. Under that provision, the bank contended, the customer would bear the loss incurred before reporting the unauthorised transaction, while the bank would be responsible for losses occurring afterwards.

After considering the rival submissions, Justice Menon found that the customer’s case fell within the zero-liability protection. The Court noted that the bank had not disputed the explanation regarding the manner in which the fraud was carried out, that the police report supported the conclusion that the petitioner was not privy to the fraud, and that she had reported the incident on the same day. The Court also relied on a 2024 decision of a Division Bench of the Gauhati High Court in a similar cybercrime matter, against which a Special Leave Petition was dismissed by the Supreme Court on January 3, 2025.

The Kerala High Court accordingly set aside the Banking Ombudsman’s order and directed SBI to compensate the petitioner for the loss of ₹3.73 lakh within four weeks. The decision reinforces the importance of timely reporting and a fact-sensitive application of RBI customer-protection rules, while making clear that the sharing of an OTP under deception does not, by itself, conclusively establish complicity in a fraudulent transaction.

Arguments of the Parties:

The petitioner challenged the Banking Ombudsman’s decision primarily on the ground that it was inconsistent with the protections established by the RBI for customers affected by unauthorised electronic banking transactions. Her case was that she had been deceived by a caller who impersonated someone assisting with the reactivation of her debit card and registration of the State Bank Secure App. She maintained that the resulting transaction was fraudulent and that she had no intention of authorising the transfer of money from her account.

The petitioner explained that the incident followed a message warning that non-chip-based debit cards would be blocked from April 29, 2019. The subsequent SMS and telephone call appeared to be connected to the same issue. Since the caller used the same number from which the SMS had been received, she believed that the communication was genuine. The caller then instructed her to provide an OTP for registering the State Bank Secure App, presenting the request as part of the card-reactivation process.

According to the petitioner, she did not understand that the OTP would enable the fraudster to carry out a transaction or gain access to a facility through which money could be transferred. She submitted that the application had not been adequately publicised and that she believed further authentication steps would be required before any money could be debited from her account. Her explanation was that the fraudster exploited the OTP to complete the registration process and then siphoned off the money.

The petitioner argued that the mere fact that she had shared an OTP could not automatically mean that she was privy to the fraudulent transaction. Her case was that she had been manipulated through deceptive communications and had not knowingly participated in the transfer of funds. She also relied on the police investigation, which identified Sandip Bauri from West Bengal as the person who had siphoned off the amount. In her submission, the police findings supported her position that she was the victim rather than a participant in the fraud.

A central part of her argument concerned Clause 6(ii) of the RBI circular. She contended that the provision granted zero liability where an unauthorised transaction resulted from a third-party breach and neither the customer nor the bank was responsible for the security lapse, subject to the applicable reporting requirements. The petitioner submitted that she had fulfilled the relevant condition by promptly informing the bank about the transaction.

The timing of her complaint was particularly important to this argument. Immediately after noticing the debit, she contacted SBI’s customer care service. The bank blocked her internet banking account, and she also complained to the branch manager and the police. She maintained that these actions demonstrated that she had not knowingly authorised the transaction and had taken reasonable steps to report the fraud as soon as it came to her attention.

The petitioner further argued that SBI had failed to take appropriate steps to restore the money even after receiving the complaint and after the police investigation identified the alleged fraudster. In her view, the bank could not continue to deny reimbursement by simply asserting that she had shared the OTP without examining the circumstances in which it had been disclosed and the protection available under the RBI framework.

She also relied on a 2024 judgment of the Gauhati High Court Division Bench in a similar cybercrime matter, in which the bank had been directed to refund money to a customer. According to the petitioner, the legal reasoning in that case supported her entitlement to reimbursement. She pointed out that the Supreme Court had dismissed a Special Leave Petition challenging the Division Bench decision on January 3, 2025, and argued that the same approach should apply to her case.

The petitioner therefore sought the setting aside of the Ombudsman’s order and a direction requiring SBI to compensate her for the unauthorised debit. Her broader submission was that the RBI’s zero-liability mechanism would lose its protective purpose if a customer who promptly reported a fraud could be denied reimbursement merely because the fraudster had induced the customer to reveal an OTP.

SBI, on the other hand, maintained that the petitioner’s conduct brought the case within Clause 7(i) of the RBI circular. That provision addresses losses arising from customer negligence, including situations in which customers share payment credentials. The bank argued that the petitioner had voluntarily disclosed the OTP and that the resulting loss should therefore be treated as one attributable to her negligence.

Under the interpretation advanced by SBI, a customer who shares confidential payment credentials must bear the loss incurred up to the time the unauthorised transaction is reported to the bank. The bank’s responsibility would arise only in respect of any further loss occurring after such reporting. SBI relied on this provision to resist the claim that the petitioner was entitled to reimbursement of the entire amount debited from her account.

The bank’s position effectively placed the case within the negligence-based category rather than the third-party-breach category relied upon by the petitioner. It maintained that the disclosure of the OTP was sufficient to attract the applicable provision governing customer responsibility for compromised credentials.

The dispute, therefore, was not simply about whether an OTP had been shared. Both sides proceeded from the fact that the petitioner had disclosed the OTP during the purported reactivation process. The central issue was how that disclosure should be characterised under the RBI circular, taking into account the alleged deception, the circumstances of the transaction, the promptness of the complaint and the available evidence concerning the identity of the person who siphoned off the money.

The High Court had to determine whether the Ombudsman was justified in treating the petitioner as privy to the fraud and applying the consequences associated with customer negligence, or whether the circumstances supported her claim to zero liability under Clause 6(ii). It was this distinction that ultimately determined whether the financial loss should remain with the customer or be reimbursed by the bank.

Court’s Judgment:

The Kerala High Court allowed the petitioner’s challenge, set aside the Banking Ombudsman’s order and directed SBI to reimburse ₹3.73 lakh within four weeks. Justice Harisankar V. Menon held that the petitioner’s case fell within Clause 6(ii) of the RBI circular because she had promptly reported the unauthorised transaction and the material before the Court did not establish that she was privy to the fraud.

The Court’s reasoning began with the circumstances in which the transaction had taken place. The petitioner had received a message suggesting that her debit card would be blocked and that reactivation was possible online. A telephone call from the same number reinforced the impression that the communication was connected to a legitimate banking process. The caller then persuaded her to disclose an OTP on the pretext of registering the State Bank Secure App.

The Court considered the petitioner’s explanation of how the fraud had been carried out. Significantly, the bank had not disputed her contentions regarding the application and the manner in which the funds were siphoned off. In these circumstances, the Court found no reason to disbelieve her account merely because she had supplied the OTP during the interaction.

The judgment highlights the importance of examining the surrounding facts before classifying a customer’s conduct as negligence under the RBI framework. The disclosure of an OTP can be relevant to determining liability, but the legal consequence cannot necessarily be decided without considering the circumstances in which the information was obtained and the provisions governing unauthorised transactions. Here, the Court found that the petitioner’s explanation, considered alongside the other material, did not establish that she was knowingly involved in the fraudulent activity.

An important consideration was the police report. The investigation had identified Sandip Bauri from West Bengal as the person who siphoned off the amounts. The Court noted that the report supported the conclusion that the petitioner was not privy to the fraud. This finding was relevant to the dispute over whether the customer should be treated as responsible for the transaction or protected as a victim of a third-party breach.

The Court also placed considerable weight on the petitioner’s prompt reporting of the incident. She had contacted the bank’s customer care service on the same day, and SBI blocked her internet banking account. She also submitted complaints to the branch manager and the police. These actions were consistent with her assertion that she had not authorised the transaction and had acted promptly upon discovering the loss.

In its observations, the Court noted that the complaint had been lodged on the very same day, yet the bank had not taken steps to ensure that the debited amount was recredited to the petitioner’s account. It further observed that the bank had not taken appropriate steps to restore the money even after the police identified the alleged fraudster. The Court considered these circumstances while examining the bank’s refusal to reimburse the customer.

The key legal issue was the application of Clauses 6(ii) and 7(i) of the RBI circular. Clause 6(ii), as relied upon by the petitioner, concerns zero liability in specified cases of third-party breach where the deficiency lies neither with the customer nor with the bank, subject to compliance with the applicable reporting requirements. Clause 7(i), on which SBI relied, deals with loss arising from customer negligence, including the sharing of payment credentials.

The bank argued that the petitioner’s disclosure of the OTP brought her case within Clause 7(i). Under that interpretation, she would be responsible for the loss incurred before she notified the bank, with the bank bearing responsibility only for any subsequent loss. The Court, however, did not accept the bank’s position in the circumstances of this case.

Justice Menon found that the bank had not established that the petitioner was privy to the fraudulent transaction. The fact that she had shared an OTP during a deceptive interaction did not, in the circumstances presented, justify treating her as knowingly involved in the fraud. The Court accepted that the circumstances were consistent with a third party having manipulated the customer into providing information that was then misused to siphon off the money.

The distinction between an unauthorised transaction caused by third-party fraud and a loss attributable to customer negligence was central to the outcome. The RBI framework seeks to allocate responsibility according to the nature of the security breach and the conduct of the customer and bank. The Court’s decision demonstrates that the relevant provision must be applied in light of the evidence and cannot be determined solely by pointing to the fact that a customer disclosed an OTP.

The petitioner’s prompt notification was especially significant. Under the RBI circular, the reporting period is an important factor in determining whether a customer qualifies for zero or limited liability. The Court accepted that the petitioner had reported the fraud immediately, satisfying the reporting-related aspect relied upon in her claim. It therefore concluded that her case fell within Clause 6(ii) and that she was entitled to zero liability in respect of the unauthorised transaction.

The Court also relied on a 2024 decision of a Division Bench of the Gauhati High Court in Writ Appeal No. 364 of 2022. That case involved a customer who had reportedly suffered a cyber fraud in a similar manner, and the bank had been directed to refund the amount. The Kerala High Court considered the reasoning of that decision relevant to the dispute before it.

The Bench further noted that the Supreme Court had dismissed a Special Leave Petition challenging the Gauhati High Court Division Bench decision by an order dated January 3, 2025. The Kerala High Court treated that earlier ruling as supporting the petitioner’s claim under the RBI framework.

The dismissal of a Special Leave Petition does not, by itself, necessarily mean that the Supreme Court has affirmed every proposition in the judgment challenged before it. The significance of the Gauhati High Court decision in the Kerala case lay in the fact that the High Court found its reasoning applicable to a materially similar factual situation. The Kerala High Court drew support from that decision while independently assessing the material and the RBI provisions relevant to the petitioner’s claim.

Another important aspect of the judgment was the Court’s rejection of the Ombudsman’s conclusion that the petitioner was privy to the fraud. The available material, including the police report, did not support that conclusion. The Court noted that the bank had not disputed the petitioner’s explanation of the manner in which the application had been used to facilitate the fraudulent transaction. Given the prompt complaint and the absence of material establishing her complicity, the Court held that the Ombudsman’s decision could not stand.

The ruling also draws attention to the responsibility of banks to deal appropriately with complaints involving unauthorised electronic transactions. A customer who reports fraud promptly should not have the claim rejected without a proper assessment of the facts and the relevant RBI directions. While customers are expected to safeguard their authentication credentials, the protections under the RBI circular must also be given effect when the applicable conditions for zero liability are satisfied.

The judgment does not mean that every customer who shares an OTP will automatically be entitled to a refund. The allocation of liability depends on the circumstances of the transaction, the applicable RBI provisions, the nature of the security breach and whether the customer has complied with the relevant reporting requirements. Where customer negligence is established, the consequences may differ. In this case, however, the Court found that the evidence did not justify treating the petitioner as privy to the fraud and that the zero-liability provision applied.

The Court ultimately set aside the Banking Ombudsman’s order and directed SBI to make good the petitioner’s loss by refunding ₹3.73 lakh within four weeks. The decision provides an important reminder that the purpose of customer-protection rules is to ensure a fair allocation of losses arsing from unauthorised digital transactions. I