Rajasthan High Court Upholds 'Zero Liability' for Bank Customer in Cyber Fraud Case, Orders Full Refund

Jaipur , Rajasthan – The High Court of Rajasthan ( Jaipur Bench), in a significant ruling on May 8, 2025, underscored the principle of 'zero liability' for bank customers in cases of unauthorized electronic transactions, provided they report the incident within the timeframe stipulated by the Reserve Bank of India (RBI). Justice Anoop KumarDhand , presiding over the case of Rakesh Totuka S/o Lt. Sh. Prakash Chand Totuka Vs. The Department of Financial Services & Ors. (S.B. Civil Writ Petition No. 14828/2023) , allowed the petitioner's plea, directing IDBI Bank to refund the full amount of Rs. 58.93 lakhs siphoned from his account, along with interest.

The Court modified an earlier order by the Banking Ombudsman , which had only granted partial relief, and found "glaring service deficiency" on the part of IDBI Bank.

Case Background: The Disputed Transactions

The petitioner, Rakesh Totuka , held an Overdraft (OD) account linked with a current account with IDBI Bank. On February 11-12, 2022, a sum of Rs. 58.93 lakhs was fraudulently transferred from his account through 16 unauthorized electronic transactions. Mr. Totuka discovered the fraud and reported it to the bank via email on February 13, 2022, and subsequently lodged an FIR on February 14, 2022.

The Banking Ombudsman , in an order dated December 13, 2022, partly allowed Mr. Totuka 's complaint, directing IDBI Bank to pay Rs. 15.60 lakhs. Dissatisfied with the partial relief, Mr. Totuka approached the High Court seeking a refund of the remaining Rs. 43.33 lakhs, plus interest debited by the bank.

The core legal question was whether the petitioner was entitled to the full refund under the RBI's 'zero liability' provisions, especially considering his SIM card was compromised (skipped/removed) at the time of the fraud, preventing him from receiving transaction alerts.

Arguments Presented

Petitioner's Submissions: Mr. Prateek Kasliwal, counsel for the petitioner, argued: * The fraud occurred on a weekend (Friday evening/Saturday morning), and the complaint was lodged on Sunday, February 13, 2022, well within the three working days mandated by the RBI circular dated July 6, 2017, for 'zero liability'. * The petitioner did not receive any SMS alerts as his SIM card was non-functional or compromised at the time. * The bank failed to act promptly to stop subsequent transactions even after the initial fraudulent debits. * The case was covered by several High Court judgments, including one upheld by the Supreme Court, supporting full reimbursement in similar circumstances.

Respondents' Submissions: Mr. Ashish Tiwari, representing IDBI Bank, contended: * Transaction alerts were sent to the petitioner's registered mobile number, but he failed to respond. * The petitioner had not registered an email ID for receiving alerts. * The Banking Ombudsman 's order was justified. * The writ petition was not maintainable as the Banking Ombudsman and the mobile service provider were not impleaded as parties.

Court's Analysis and Application of RBI Circular

Justice Dhand , in a detailed judgment, meticulously analyzed the RBI's circular dated July 6, 2017, concerning "Consumer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions."

The Court highlighted Clause 6(ii) of the circular, which stipulates: > "A customer's entitlement to zero liability shall arise where the unauthorised transaction occurs in the following events: ... (ii) Third party breach where the deficiency lies neither with the bank nor with the customer but lies elsewhere in the system, and the customer notifies the bank within three working days of receiving the communication from the bank regarding the unauthorised transaction."

The Court observed: > "In the instant case also, the unauthorized transactions occurred in the bank account of the petitioner between 06:39 PM on 11.02.2022 till 1:30 AM on 12.02.2022 and the matter was reported to the Respondent-Bank on 13.02.2022 on 11:38 A.M. The mobile SIM of the petitioner was skipped/removed from phone, hence, he did not receive any alerts... Hence, as per the provisions mentioned in Clause 6 of the RBI circular there would be zero liability of the petitioner as the complaint was made by him well within time i.e. within one day." (Para 20)

The Court found no fault or negligence on the petitioner's part for not responding to alerts he never received due to a compromised SIM. It noted his prompt action in reporting the fraud upon discovery.

Bank's Service Deficiency: The judgment was particularly critical of the bank's handling of the situation: > "In the present case, there was glaring service deficiency on the part of the respondent- Bank. Despite the petitioner’s prompt intimation regarding the fraudulent transaction, the respondent- Bank failed to demonstrate any sense of urgency or exercise due diligence. This reflects a clear negligence on their part, in discharge of their duty to act swiftly upon receiving notice of the fraud. No immediate steps were taken by the respondent to initiate a chargeback, retrieve the funds, or freeze the suspicious accounts..." (Para 29)

Further, the Court emphasized the bank's inherent responsibility: > "The respondent -IDBI bank cannot shy/walk away from its responsibility to safeguard the petitioner or other customers from unauthorized transaction reported from their account. If the account is maintained by the bank, the bank itself is liable for its safety and security." (Para 30)

The Court relied on several precedents, including Jaiprakash Kulkarni (Bombay HC) , Tony Enterprises (Kerala HC) , Smt. Jyoti Bezbarua Goswami (Gauhati HC) , State Bank of India Vs. Pallabh Bhowmick (Gauhati HC DB, upheld by SC) , and Hare Ram Singh (Delhi HC) , to support its findings. The argument regarding non-joinder of the Banking Ombudsman and service provider was dismissed, citing that the Ombudsman is a persona designata and no relief was sought against the service provider.

Final Decision and Broader Directives

The High Court allowed the writ petition and modified the Banking Ombudsman 's order dated December 13, 2022.

The Court directed IDBI Bank to: 1. Pay Rs. 58,93,000/- to the petitioner, after adjusting the Rs. 15,60,000/- if already disbursed. 2. Pay interest @ 6% per annum on the balance amount from December 13, 2022 (date of Ombudsman 's order) till the date of actual payment. 3. Comply with the order within three months.

In its concluding remarks, the Court expressed deep concern over the rise of digital scams, terming them "one of the most insidious forms of cyber crime." Justice Dhand called for a multi-faceted approach to combat these threats, including robust legislation, public awareness campaigns, technological innovations, and collaborative initiatives. The Court also directed its office to send a copy of the order to the Department of Financial Services and the RBI for necessary compliance and to take more suitable measures to protect customers.

This "Reportable" judgment reinforces the protective ambit of the RBI's guidelines for bank customers and serves as a strong reminder to banks of their obligations in preventing and addressing cyber fraud and service deficiencies.