The Delhi State Consumer Disputes Redressal Commission dismissed an appeal by State Bank of India, upholding a District Commission order that directed the bank to refund ₹42,92,450 lost through unauthorised withdrawals, pay ₹1,00,000 as compensation, and pay interest at 7% per annum. The Commission held that the bank failed to prove the customer’s mandate for changing her mobile number or enabling transaction facilities, thereby establishing deficiency in service.
Background & Facts
The Dispute
State Bank of India (appellant) opposed a complaint filed by Ms. Shakuntala Mehthani (respondent), a senior citizen, alleging unauthorised withdrawals from her savings and overdraft accounts due to deficient banking services. The complainant sought refund of ₹42,92,450, ₹20,00,000 as compensation for harassment, and litigation costs.
Key Facts
- On 16.07.2021, unauthorised and fraudulent withdrawals occurred from Savings Account No.56189023119 (approximately ₹3,33,450) and Over Draft Account No.56189003771 (approximately ₹39,59,000).
- The complainant’s accounts were set to “View Only” for internet banking and were not activated for online transactions by her.
- Upon discovering the fraud, the complainant and her husband visited the bank to lodge a formal complaint, which was refused.
- Consequently, the complainant sent her complaint dated 16.07.2021 by email and courier/speed post and lodged an FIR on 27.12.2021 against the ex-accountant Shri Ajay Kumar Manchanda and bank officials of the Nehru Place Branch; the FIR remains under investigation.
- The complainant stated she had been using internet banking since 21.02.2018 and had not given access to any third party.
- The bank contended that the complainant had supplied her credentials to a third party and that the transactions were carried out by her ex-accountant.
- The bank asserted that changing the registered mobile number or upgrading internet banking from “View Only” to transaction-enabled mode required the account holder’s written mandate, which it claimed was not obtained.
- A Status Report dated 08.05.2023 filed by the Investigating Officer before the Hon’ble High Court of Delhi recorded that the respondent’s registered mobile number was changed with the assistance of a bank official (Ajay Kumar Kaushal) and that written consent of the customer was mandatory for such change, yet no such request was available with the bank.
- The District Consumer Disputes Redressal Forum-II, South District, Delhi, passed an order on 11.08.2025 directing the bank to refund ₹42,92,450 with interest at 7% per annum from the date of each transaction, to pay ₹1,00,000 as compensation for harassment, and to comply within three months, failing which interest would rise to 9% per annum.
Procedural History
- 05.12.2025: Date of institution of the complaint before the District Commission (as per the commission’s record).
- 11.08.2025: District Commission order directing refund, compensation and interest.
- FA/601/2025: First appeal filed by State Bank of India challenging the District Commission’s order.
- 04.08.2026: Counsel for the respondent submitted that they would not file a written reply and would rely on oral arguments.
- 17.09.2026: Date of hearing before the Delhi State Consumer Disputes Redressal Commission.
- 08.10.2026: Date of judgment (decision) of the State Commission dismissing the appeal.
Relief Sought
The appellant sought to set aside the District Commission’s order, thereby avoiding liability to refund ₹42,92,450, pay ₹1,00,000 compensation, and bear interest and costs. The respondent sought affirmation of the District Commission’s order and recovery of the claimed amounts.
The Legal Issue
The central question was whether the State Bank of India had discharged its burden to prove that the change of the respondent’s registered mobile number and the activation of transaction-enabled internet banking were effected with her valid mandate, such that the alleged unauthorised withdrawals could not be attributed to deficiency in the bank’s service. Relatedly, the Commission had to consider whether the bank’s reliance on RBI guidelines dated 06.07.2017 and the receipt of transaction alerts on the registered mobile number sufficed to establish compliance with the prescribed procedure for electronic banking transactions.
Arguments Presented
For the Appellant/Petitioner
The State Bank of India contended that the District Commission erred in holding deficiency of service. It asserted that the unauthorised withdrawals were carried out by the respondent’s ex-accountant, Shri Ajay Kumar Manchanda, who had access to the accounts. The bank argued that changing the registered mobile number or upgrading internet banking from “View Only” to transaction-enabled mode required the account holder’s written mandate, which it claimed was not obtained. It stated that transaction alerts were duly sent to the registered mobile number, indicating that the bank had followed procedure. The bank relied on RBI guidelines dated 06.07.2017 concerning customer protection in unauthorised electronic banking transactions to argue that the respondent failed to establish any negligence or deficiency on the part of the bank. It also maintained that the complaint suffered from misjoinder of parties because the ex-accountant was not made a party and highlighted the respondent’s delay of more than 1.5 years in lodging the complaint after the incident.
For the Respondent/State
Through counsel on 04.08.2026, the respondent indicated they would not file a written reply and would rely on oral submissions. The respondent’s case rested on the allegations that the registered mobile number was changed without her knowledge or consent and that the internet banking facility, represented as “View Only”, was misused to effect the transactions. She emphasised that the bank, as custodian of the relevant records, failed to produce any document evidencing her mandate for the change of mobile number or the upgrade of the banking facility. The respondent highlighted the Status Report dated 08.05.2023 which recorded that the change of the mobile number was effected with the assistance of a bank official and that written consent was mandatory yet unavailable. She argued that the mere receipt of transaction alerts did not explain how the mobile number itself was altered without her authority.
The Court's Analysis
The Commission framed the core inquiry as whether the bank had discharged the burden to prove the customer’s mandate for altering the mobile number and enabling transaction facilities. It noted that the bank’s defence rested on two propositions: (i) the ex-accountant acted alone, and (ii) the bank complied with procedure by sending transaction alerts. The Commission found the first proposition insufficient because the bank could not escape liability merely by pointing to a third party if its own procedures were deficient. Regarding the second, the Commission held that receipt of transaction alerts does not, by itself, establish that the change of the registered mobile number was authorised. The Commission emphasized that, under banking practice and the RBI guidelines dated 06.07.2017, a change of the registered mobile number requires the customer’s written mandate. The bank’s failure to produce any such mandate or contemporaneous record was decisive.
The Commission relied on the Status Report dated 08.05.2023, which recorded that the respondent’s registered mobile number was changed with the assistance of a bank official (Ajay Kumar Kaushal) and expressly stated that written consent of the customer was mandatory for such change, yet no such request was available with the bank. This material raised a serious question about the bank’s compliance with the prescribed procedure. The Commission further observed that the bank’s assertion that transaction alerts were duly received did not satisfactorily explain how the mobile number itself came to be altered without the customer’s authority. Once the bank admitted that a mandate was required, it was incumbent upon it to produce the relevant mandate or other contemporaneous record to establish that the change was duly authorised. The bank’s failure to do so, both before the District Commission and before the State Commission, undermined its defence.
Similarly, the bank failed to produce any cogent material to establish when and in what manner the internet banking facility was upgraded from “View Only” to a transaction-enabled facility and pursuant to whose request or authorization such change was effected. As the custodian of the relevant banking records, the bank was in a position to produce such material; its failure to do so assumed significance given that the disputed transactions occurred thereafter and the respondent consistently denied having authorised such transactions.
The Commission also considered the bank’s reliance on the RBI guidelines dated 06.07.2017. It held that, before seeking to attribute liability to the respondent, the bank was required to establish the circumstances in which the disputed transactions were authenticated and to demonstrate compliance with the prescribed procedure. The bank failed to establish that the respondent had authorised the change of the registered mobile number or the alteration of the internet banking facility. The mere fact that the transactions were carried out through internet banking or that alerts were generated on the registered mobile number could not, in the circumstances of the present case, establish authorisation by the respondent.
In view of the aforesaid discussion, it is clear that the Appellant Bank failed to establish that the change of the registered mobile number and the alteration of the internet banking facility were carried out pursuant to a valid mandate or consent of the Respondent. The Appellant also failed to produce the relevant banking records or the internal investigation report to substantiate its defense.
In these circumstances, we are of the considered view that the Appellant Bank was deficient in providing its banking services and failed to exercise the requisite care and diligence expected from it, which resulted in the unauthorized withdrawal of the amount from the accounts of the Respondent. The finding of deficiency in service recorded by the District Commission, therefore, does not call for any interference.
In view of the foregoing, we are in agreement with the reasons given by the District Commission and fail to find any cause or reason to reverse the findings of the District Commission. Consequently, we uphold the order dated 11.08.2025 passed by the District Consumer Disputes Redressal Forum -II, (South District), GNCT of Delhi, Udyog Sadan, C-22 & 23, Qutub Institutional Area (Behind Qutub Hotel), New Delhi - 110016.
The Verdict
The respondent succeeded. The Commission upheld the District Commission’s order directing State Bank of India to refund ₹42,92,450 with interest at 7% per annum from the date of each transaction, to pay ₹1,00,000 as compensation for harassment to a senior citizen, and to comply within three months from the date of the order, failing which interest would accrue at 9% per annum until realization. No costs were awarded.
What This Means For Similar Cases
Burden Lies on the Bank to Prove Customer Mandate
Banks must now be prepared to produce written mandates or contemporaneous records whenever they allege that a change in registered mobile number or upgrade of internet banking facilities was effected with the customer’s consent. Mere reliance on transaction alerts or internal assertions is insufficient to discharge the burden of proof.
Transaction Alerts Alone Do Not Authorise Electronic Banking Changes
The receipt of SMS or push notifications on a registered mobile number does not, by itself, establish that the underlying change in banking facilities was authorised. Complainants can challenge unauthorised transactions by showing that the mandate for such changes was absent, shifting the focus to the bank’s procedural compliance.
Compliance with RBI Guidelines Requires Documentary Evidence
Reliance on RBI guidelines dated 06.07.2017 is not a shield unless the bank can demonstrate actual adherence through documentary proof of customer consent, internal approvals, and audit trails. Absent such evidence, guidelines remain aspirational and do not negate a finding of deficiency in service.
