The Karnataka High Court set aside the orders of the National and State Consumer Disputes Redressal Commissions, holding that State Bank of India is liable to reimburse an unauthorised electronic debit when the customer reports the fraud within the stipulated period, and affirmed the bank’s duty to pay compensation under the RBI’s zero-liability circular.
Background & Facts
The Dispute
The petitioner, State Bank of India (SBI), challenged the orders of the Karnataka State Consumer Disputes Redressal Commission (KSCDRC) and the National Consumer Disputes Redressal Commission (NCDRC) which directed the bank to credit the respondent’s account with Rs.1,99,000 and to pay Rs.25,000 as compensation.
Key Facts
- The respondent, Mr. Pradosh Kumar Banerjee, is the holder of SBI account No. 10406856376 (IFSC SBIN0003994).
- On 19.07.2022, two unauthorised transactions debited Rs.1,99,000 and Rs.25,000 from his account.
- Within three hours of noticing the debit, the respondent emailed the bank reporting the fraud.
- The bank subsequently re-credited only Rs.25,000; the larger amount remained unrecovered.
- The respondent made several further correspondences requesting reversal of the remaining amount, which the bank ignored.
- The respondent filed a complaint before the District Consumer Disputes Redressal Commission (DCDRC). The bank contended that the customer had shared the OTP and that the RBI circular on zero liability was inapplicable.
- The DCDRC dismissed the complaint, finding no deficiency of service.
- The respondent appealed to the KSCDRC (Appeal No. 1742/2023). The KSCDRC held that the bank was liable under the RBI’s zero-liability clause, directing credit of Rs.1,99,000 and compensation of Rs.25,000.
- The bank appealed to the NCDRC (Second Appeal No. NC/SA/540/2025). The bank argued that the OTP was shared, that the complaint was filed after an eight-day delay (letter dated 26.07.2022), and that the RBI circular did not apply.
- The NCDRC, relying on RBI circular dated 06.09.2017 and precedents (State Bank of India v. Valhava, WA No. 364/2022, 13.09.2024; SBI v. Kodudhala Joji Reddy, RP No. 1381/2018, 17.11.2025), upheld the KSCDRC order, directing the bank to comply within four weeks and imposing interest of 8 % per annum from the date of default.
Procedural History
- 19.07.2022: Unauthorised debit of Rs.1,99,000 and Rs.25,000.
- 19.07.2022 (within 3 hrs): Email to SBI reporting fraud.
- Date not specified: Complaint filed before DCDRC.
- Date not specified: DCDRC order dismissing complaint.
- 2023: Appeal filed before KSCDRC (Appeal No. 1742/2023).
- 26.05.2025: KSCDRC order directing SBI to credit Rs.1,99,000 and pay Rs.25,000 compensation.
- 15.04.2026: NCDRC second-appeal order dismissing bank’s appeal and upholding KSCDRC order.
- 23.07.2026: Writ petition (WP No. 18741 of 2026) reserved.
- 11.08.2026: Judgment pronounced by Hon’ble Mr. Justice D K Singh and Hon’ble Mr. Justice T M Nadaf.
Relief Sought
The petitioner-bank sought quashing of the KSCDRC and NCDRC orders and restoration of the status quo ante, arguing that it bore no liability for the unauthorised debit.
The Legal Issue
Whether, under the Reserve Bank of India’s circular dated 06.09.2017 and the “zero liability” clause, a bank is liable to reimburse an unauthorised electronic transaction when the customer reports the fraud within the stipulated period, notwithstanding the bank’s claim that the customer shared the OTP.
Arguments Presented
For the Appellant/Petitioner
- The bank contended that the customer had disclosed the OTP, which is a prerequisite for any unauthorised debit.
- It argued that the complaint was lodged after an eight-day delay (letter dated 26.07.2022), breaching the reporting timeline prescribed in the RBI circular.
- The bank relied on the principle that where the customer’s negligence is established, the zero-liability clause does not apply.
- Cited Sant Rohidas Leather Industries & Charamakar Development Corp. Ltd. v. Vijaya Bank (2026 SCC Online SC 45) to support the view that negligence on the part of the customer defeats bank liability.
For the Respondent
- The respondent asserted that the fraud was reported within three hours of the debit, well within the three-working-day window mandated by the RBI circular.
- He maintained that no OTP was shared; the fraudster had gained access to the banking software independently.
- Relied on the KSCDRC’s finding of deficiency of service and the applicability of the zero-liability clause.
- Cited State Bank of India v. Valhava (WA No. 364/2022, 13.09.2024) and SBI v. Kodudhala Joji Reddy (RP No. 1381/2018, 17.11.2025) for the proposition that the bank bears the loss where the fraud is perpetrated by a third party and the customer reports promptly.
The Court's Analysis
The Court began by interpreting the RBI circular dated 06.09.2017, which imposes a “zero liability” obligation on banks when an unauthorised electronic transaction is reported within three working days. The Court held that the statutory intent is consumer protection, ensuring that banks bear the risk of third-party fraud unless the customer’s negligence is proved.
"The Bank is liable to make good the amount unauthorisedly debited, in view of Reserve Bank of India circular dated 06.07.2017."
The Court examined the factual matrix: the respondent’s email was sent within three hours of the debit, satisfying the reporting requirement. The bank’s claim of OTP sharing was unsupported by any independent evidence; the respondent’s assertion that the OTP was never disclosed was corroborated by the fact that the bank had already credited Rs.25,000 after receiving the complaint, indicating awareness of the fraud.
The Court distinguished Sant Rohidas on the ground that the present case involved no act of negligence by the customer; the fraud stemmed from a compromised application, not from the customer’s voluntary disclosure of OTP. The Court also affirmed the precedents of Valhava and Kodudhala Joji Reddy, emphasizing that the burden of proving OTP sharing rests on the bank, and mere allegation does not suffice.
Statutory interpretation was guided by the purposive approach: the circular’s purpose is to protect consumers from loss due to cyber-fraud. The Court rejected the bank’s reliance on the alleged eight-day delay, noting that the complaint dated 26.07.2022 was a formal letter, whereas the initial electronic intimation occurred within three hours, which is the operative communication under the circular.
Consequently, the Court concluded that the KSCDRC and NCDRC correctly applied the zero-liability clause. It affirmed the direction that the bank must credit the full amount of Rs.1,99,000 and pay Rs.25,000 compensation, with interest at 8 % per annum from the date of default if compliance is delayed beyond four weeks.
The Verdict
The writ petition is dismissed. The Court upholds the orders of the KSCDRC and NCDRC, directing State Bank of India to credit Rs.1,99,000 to the respondent’s account and to pay Rs.25,000 as compensation, together with interest at 8 % per annum from the date of default until full payment. The bank must comply within four weeks of the judgment; failure to do so will attract the stipulated interest.
What This Means For Similar Cases
Prompt Reporting Triggers Zero Liability
- Banks are obligated to reimburse unauthorised debits when the customer reports the fraud within three working days, irrespective of alleged OTP sharing.
- Practitioners must advise clients to lodge electronic complaints immediately and preserve all communication timestamps.
Burden of Proof Lies With the Bank
- The onus is on the bank to prove that the customer disclosed the OTP or was negligent.
- Absence of concrete evidence will result in the bank being held liable under the RBI circular.
Interest and Compliance Deadlines Are Enforceable
- Courts may impose statutory interest of 8 % per annum for delayed compliance.
- A specific compliance window (e.g., four weeks) is routinely ordered; failure to meet it invites interest accrual.
Practical Takeaways
- Draft complaint letters referencing the RBI circular and citing the three-day reporting rule.
- Preserve email headers and server logs as proof of prompt reporting.
- In defence, banks should retain OTP logs and any forensic evidence before alleging customer negligence.
