In a significant ruling on bank liability for unauthorised credit card transactions, the Uttarakhand State Consumer Disputes Redressal Commission held that banks cannot be held liable for deficiency in service if transactions were validated through OTP and CVV, and the complainant failed to report the fraud within three days of discovery.
Background & Facts
The Dispute
The appellant, Sh. Pratap Singh Rauthan, a 64-year-old resident of Dehradun, held SBI Credit Card Account No. 4726428027598117. On 08.07.2024, an unauthorised payment of Rs. 19,100 was made via his credit card to GOOGLE ADS MUMBAI IN (Pay in EMIs) without his knowledge or consent. The appellant claimed he had never shared his user ID, password, or OTP with any third party. Upon reviewing his credit card statement on 04.08.2024, he discovered the unauthorised debit.
Key Facts
- The appellant blocked his credit card and internet banking immediately after discovering the fraud
- He reported the fraud to P.S. Nehru Colony, Dehradun on 11.07.2024
- Despite multiple approaches to the bank, he received no response
- After 30 days of no refund, he lodged a complaint with the RBI Ombudsman on 17.08.2024
- The bank rejected his refund request via an e-mail dated 26.09.2024, stating the transaction was validated by OTP and CVV
- The appellant filed a consumer complaint before the District Consumer Disputes Redressal Commission, Dehradun (Complaint No. DC/49/CC/94/2024) on 07.10.2024
Procedural History
- 07.10.2024: Registered notice sent to the respondent (SBI Credit Card)
- 29.01.2025: District Commission proceeded ex-parte against the respondent due to non-appearance
- 22.07.2025: District Commission dismissed the complaint, holding no deficiency in service on the bank’s part
- 15.09.2025: Appellant filed the present appeal (SC/5/FA/83/2025) before the State Consumer Disputes Redressal Commission, Uttarakhand
- 13.05.2026: Commission directed ex-parte proceedings against the respondent due to non-appearance
- 10.07.2026: Final order pronounced by the State Commission
Relief Sought
The appellant sought:
- Refund of Rs. 19,100 debited from his account
- Compensation for mental harassment and deficiency in service
- Costs of litigation
The Legal Issue
The central question was whether the bank could be held liable for deficiency in service under the Consumer Protection Act, 2019 for unauthorised transactions validated by OTP and CVV, where the complainant failed to report the fraud within three days of discovery.
Arguments Presented
For the Appellant
The appellant argued:
- The unauthorised transaction was made without his knowledge or consent
- The bank failed to reverse the transaction despite his complaints
- The bank’s rejection of his refund request amounted to deficiency in service
- He had taken immediate steps to block his card and report the fraud to the police and RBI Ombudsman
For the Respondent
The respondent did not appear before the Commission. However, the bank’s e-mail dated 26.09.2024 contended:
- The transaction was performed in a secured manner, validated by OTP and CVV
- Transaction alerts were sent to the appellant’s registered mobile number
- No change in contact details was identified
- The appellant had a previous trend of online transactions and was aware of the process
- The liability for the disputed transaction rested with the appellant, as he may have inadvertently compromised his card details
The Court's Analysis
The Commission examined the bank’s e-mail and the appellant’s conduct in light of consumer protection principles. Key observations included:
-
Validation of Transaction: The bank’s investigation revealed that the transaction was validated by OTP and CVV, which are confidential details. The Commission noted that no unauthorised transaction can occur without these details, implying potential negligence on the appellant’s part.
-
Delay in Reporting: The appellant discovered the unauthorised debit on 04.08.2024 but reported it to the RBI Ombudsman only on 17.08.2024, beyond the prescribed period of three days. The Commission emphasised that timely reporting is crucial to enable banks to reverse fraudulent transactions.
-
No Deficiency in Service: The Commission held that the bank’s rejection of the refund request was justified, as the transaction was validated through secure means. There was no averment in the complaint showing any deficiency in service on the bank’s part.
"Any card absent (online/IVR) transaction cannot be done without confidential details of the card i.e., card expiry date, CVV. Dynamic OTP and transaction alerts were delivered on his registered mobile number and no change in the contact details has been identified."
The Commission concluded that the appellant’s failure to report the fraud within three days and the absence of any evidence suggesting bank negligence absolved the bank of liability.
The Verdict
The appeal was dismissed. The Commission upheld the District Commission’s order dated 22.07.2025, holding that:
- The bank was not liable for deficiency in service
- The appellant’s delay in reporting the fraud defeated his claim
- No costs were awarded to either party
What This Means For Similar Cases
Timely Reporting Is Non-Negotiable
- Consumers must report unauthorised transactions within three days of discovery to enable banks to reverse them
- Delay in reporting may absolve banks of liability, even if the transaction was unauthorised
- OTP and CVV validation shifts the burden of proof to the consumer to demonstrate negligence on the bank’s part
Banks’ Liability Is Limited to Negligence
- Banks cannot be held liable for unauthorised transactions if they were validated through secure means (OTP, CVV)
- Consumers must safeguard their confidential details to avoid liability for fraudulent transactions
- Previous transaction trends may be used by banks to argue that the consumer was aware of the process and potentially negligent
Consumer Protection Act Does Not Guarantee Refunds
- The Consumer Protection Act, 2019 does not automatically entitle consumers to refunds for unauthorised transactions
- Consumers must prove deficiency in service to succeed in such complaints
- Mere unauthorised debit without evidence of bank negligence is insufficient to establish liability
