The High Court of Kerala has directed the State Bank of India to refund ₹3,73,000 to a retired teacher, ruling that the financial institution failed to establish customer negligence in a case involving an unauthorized digital transaction. Justice Harisankar V. Menon set aside an earlier order by the Banking Ombudsman that had rejected the petitioner's claim, finding that the bank had not taken adequate steps to protect the account holder despite prompt reporting of the fraudulent activity.

The case concerns Remadevi T.L., who held a savings account with the bank and maintained an active debit card. In July 2019, she received an SMS informing her that her card was slated for blocking and could be reactivated through an online process. Shortly thereafter, she received a telephone call from the same number that sent the initial message. The caller, posing as a bank representative, persuaded the petitioner to download the “State Bank Secure App” and provide a one-time password (OTP) to complete the reactivation. Following this interaction, the account was debited of ₹3,73,000 within a short timeframe.

The petitioner acted immediately upon realizing the fraud, contacting the bank’s customer service to block her internet banking access and subsequently filing a formal complaint with the local police. A police investigation later confirmed that the funds had been siphoned off by an individual operating from West Bengal, who utilized multiple digital wallets to move the money. Despite these findings and the prompt reporting, the Banking Ombudsman initially ruled against the petitioner, citing her compliance with the fraudster’s request as proof of negligence under the Reserve Bank of India’s circular guidelines on customer liability.

The legal dispute centered on the interpretation of the Master Circular issued by the Reserve Bank of India, specifically whether the incident fell under “Zero Liability” in cases of third-party breaches or “Limited Liability” in instances of customer negligence. The bank contended that by sharing the OTP, the customer violated security protocols, effectively assuming liability for the loss until the fraud was reported. Conversely, the petitioner argued that the bank had failed to provide sufficient awareness regarding the security of the “State Bank Secure App,” leading her to believe the authentication process required further confirmation steps, and that the bank failed to act on her timely report to prevent the final siphoning of funds.

Justice Harisankar V. Menon, in reviewing the petition, observed that the bank failed to provide concrete evidence of the customer’s complicity in the fraud. The court noted that in modern digital banking, the burden of proving customer negligence rests with the financial institution. The court referenced the precedent set by a Division Bench of the Gauhati High Court, which was recently affirmed by the Supreme Court of India, establishing that banks cannot absolve themselves of liability through broad claims of user negligence without substantial proof.

“It is unbelievable that a person will deliberately share the password/OTP, etc., so that his hard-earned money could be siphoned off from the bank account by a fraudster,” the Court remarked while emphasizing the technological disparity between financial institutions and the average account holder. The judgment further highlighted the bank's administrative failure to mitigate the loss. As the court observed, “Though the complaint was lodged on the very same day, the bank has not taken any steps for ensuring that the amounts debited are recredited to the petitioner’s account. Similarly, even after the police identified the fraudster, the bank has not taken any further steps in the matter.”

The High Court underscored that because the bank failed to substantiate the alleged negligence and because the petitioner acted with due diligence by reporting the unauthorized transfer within the mandatory timeframe, the case falls squarely under clause 6(ii) of the Reserve Bank of India’s circular. This provision protects customers from liability when an unauthorized transaction occurs due to third-party breaches, provided the bank is notified promptly. The court held that the state-owned lender’s reliance on the petitioner’s participation in the scam was inconsistent with the evidence provided by the police investigation, which identified the fraudster as an external actor.

The ruling is expected to have broader implications for customer protection in cyber-related financial disputes, as it places a stronger emphasis on the remedial responsibilities of banks. By setting aside the Banking Ombudsman’s non-speaking order, the court reinforced the expectation that financial institutions utilize their sophisticated fraud-detection systems to prevent unauthorized outflows rather than relying on the premise of customer fault.

In its final directive, the High Court ordered the State Bank of India to make good the loss of ₹3,73,000 to the petitioner. The bank has been given a period of four weeks to comply with the order and ensure the recredit of the funds into the account holder's savings account. This judgment solidifies the legal requirement for banks to act proactively in securing customer accounts and underscores the principle that in the absence of evidence of intentional negligence, the financial liability for system-wide failures remains with the banking institution.