Banks are liable to compensate customers for “unauthorised and fraudulent” online transactions involving their accounts provided the victim lodges a complaint within the RBI-stipulated three days, the Supreme Court has ruled in a huge relief to account holders.
“It is the responsibility of the bank so far as such unauthorised and fraudulent transactions are concerned. The bank should remain vigilant. The bank has the best of the technology available today to detect and prevent such unauthorised and fraudulent transactions,” the bench of Justice J.B. Pardiwala and Justice R. Mahadevan said.
But it sounded a caution: “We expect the customers, ie, the account holders also to remain extremely vigilant and see to it that the OTPs generated are not shared with any third party. In a given situation and in the facts and circumstances of some case, it is the customer also who could be held responsible for being negligent in some way or
the other.”
In the January 3 order, uploaded on Monday, the bench directed the public-sector State Bank of India to pay ₹94,204 and 80 paise as compensation to a customer, Pallab Bhowmick.
It dismissed the SBI’s appeal against the concurrent findings of a single-judge bench and a division bench of Gauhati High Court that had held there was no negligence on the part of the customer.
The high court division bench had observed: “…We are in full agreement with the learned Single Judge that the online transactions that took place on 18.10.2021 from the respondent No. 1/ petitioner’s bank account were unauthorised and fraudulent in nature. No negligence on the part of respondent No. 1/ petitioner could be established.... The respondent No. 1/ petitioner will not have any liability.”
The apex court expressed “complete agreement” with this and underlined that the customer had “within 24 hours of the fraudulent transaction... brought it to the notice of the bank”.
The high court had referred to Clause 8 of the RBI circular, which says that in case of an unauthorised electronic banking transaction due to third-party breaches, that is, where the deficiency lies neither with the customer nor the bank, the customer’s liability will be “zero” if the fraudulent transaction is reported within three working days from the date on which the customer receives the communication.
It noted that the fraudulent transaction, caused by a breach in the customer database of respondent No. 3 — Louis Phillipe, an Aditya Birla group company — had been reported to the bank on October 19, 2021, that is, within one working day.
The high court also held that Clause 9 of the RBI circular gives the bank the discretion to waive any customer liability even if there has been negligence on the customer’s part.
Bhowmick, who had a savings account with an SBI branch in Guwahati, had bought some garments online from a Louis Philippe store that he wanted to return against a refund.
On October 18, 2021, the customer received a call from a man who, posing as a customer care manager with Louis Philippe, asked him to download a mobile app to secure the ₹4,000 refund. After the customer downloaded the app, a sum of ₹94,204 was siphoned off his bank account.