The bank is liable for unauthorized transactions if it fails to protect customers from cyber fraud, and the burden of proof lies with the bank to establish customer negligence.

J U D G M E N T

1. The petitioner herein invokes the writ jurisdiction of this Court under Article 226 of the Constitution of India , 1950, seeking the following reliefs against the respondents:

“(i) Issue writ of mandamus or any other appropriate writ, Order or directions quashing the rejection order dated 26.07.2021 by SBI Branch Greater Noida (Annexure P/8 herein) as violative of Articles 14, 16 and 21 read with Article 300A of the Constitution of India read with RBI Master Circular dated 6.7.2017;

(ii) Issue writ of mandamus or any other appropriate writ, Order or directions to the respondents to restore the amount illegally siphoned off from the Petitioner's SBI savings Account bearing No. 30051013904 IFSC Code: SBIN0004324 on 18/4/2021 by unknown 3rd Parties amounting to Rs 2,27,000/- with interest and;

(iii) Pass any other necessary/appropriate directions in the matter as the Hon'ble Court may deem fit and proper in the interest of justice.”

BRIEF FACTS:

2. Shorn of unnecessary details, the petitioner who is an academician aged about 55 years, became a victim of cyber fraud Signature Not Verified Digitally Signed W.P.(C) 13497/2022 Page 1 of 20 perpetrated through a „vishing attack‟ i.e., a voice-phishing attack wherein innocent people are enticed over voice-call to divulge sensitive information pertaining to their bank accounts, which information is then misused by the unscrupulous attacker so as to wrongfully enrich himself monetarily.

3. Shorn of unnecessary details, the petitioner on 18.04.2021 at about 05.15 PM, received an SMS1 containing a link, upon receipt of which SMS he got a call from an unknown caller who convinced him to click on the said link contained in the SMS so as to keep the SMS service on his mobile number open and operational, and as soon as the unsuspecting petitioner clicked on the SMS link upon being prompted by the unknown caller/fraudster, an aggregate amount of Rs. 2,60,000/- was unauthorisedly withdrawn by way of two transactions in the sum of Rs. 1,00,000/- and Rs. 1,60,000/- each, from his Savings Bank Account maintained with the respondent Nos.2 and 3/State Bank of India [‘SBI’] at its Greater Noida, Uttar Pradesh branch; and that on perusal of the statement of account of the petitioner, it was found that by way of internet banking on 18.04.2021, the first transaction of Rs. 1,00,000/- was made to a bank account maintained with IDFC Bank, and the second transaction of Rs. 1,60,000/- was made to One 97 Communications Ltd. (Paytm).

4. Upon realising that he had been defrauded, the petitioner herein immediately dialled the „Customer Care Department‟ of the SBI to register a complaint and seek a hold on the transactions that had been initiated without his permission, however to no avail. The petitioner

1 Short Message Service Signature Not Verified Digitally Signed W.P.(C) 13497/2022 Page 2 of 20 filed a complaint dated 20.04.2021 before the Branch Manager, SBI, Greater Noida besides filing a cyber complaint dated 18.04.2021 as well as complaint dated 19.04.2021 at PS Hajipur, Bihar, and also registering his grievance under the CPGRAMS2 against the unauthorised withdrawal.

5. It is stated that since the grievance of the petitioner was not being redressed by the SBI, he filed a complaint dated 26.04.2021 before the Banking Ombudsman [‘BO’] against the SBI for its inaction and failure to resolve the matter; and during the pendency of the complaint filed before the BO, the petitioner regularly served reminders upon the Chairman, SBI dated 02.05.2021, 21.05.2021, and 31.05.2021 seeking the updated status as regards the action taken upon his complaint. On 26.07.2021, the Chief Manager SBI, Greater Noida Branch, issued a letter to the petitioner, thereby rejecting the petitioner‟s complaint firstly on the ground that the impugned transaction had taken place through INB3wherein OTPs were received by the petitioner, and secondly on the ground that he accessed a link forwarded by an unknown person that led