The Calcutta High Court has reaffirmed that banks bear the burden of proving customer negligence in cases of unauthorized electronic transactions, reinforcing the RBI’s 2017 guidelines on zero liability. In a significant ruling, the Court quashed the dismissal of a complaint by the RBI Ombudsman and ordered immediate refund of fraudulent amounts, setting a clear precedent for customer protection in digital banking.
Background & Facts
The Dispute
The petitioner, Tilak Shankar Mazumder, sought redressal against unauthorized transactions of 2,000 Euros (approximately Rs. 1,80,000) on his Axis Bank credit card, which was used by an unknown third party while his daughter, Sohini Mazumder, was traveling in Dublin, Ireland. The card in question was an add-on card linked to the petitioner’s primary account and did not require OTP or PIN authentication.
Key Facts
- The add-on credit card (ending in 1045) was issued by Axis Bank without OTP or PIN verification facilities.
- On 20.10.2024 at 22:48 IST and 22:49 IST, two transactions of 1,000 Euros each were processed at a store in Dublin.
- The daughter of the petitioner received automated alerts from Axis Bank at 22:49 IST and immediately reported the theft to the Dublin police on the same day.
- The petitioner lodged a formal complaint with the RBI Ombudsman (respondent no. 2) on 21.10.2024.
- Axis Bank acknowledged receipt of the complaint on 23.10.2024 and requested the last four digits of the card, which were promptly provided.
- On 25.10.2024, the daughter sent a detailed email to Axis Bank describing the theft and unauthorized use.
- On 30.10.2024, Axis Bank closed the complaint without assigning any reason.
- On 07.12.2024, Axis Bank emailed the petitioner alleging that the fraud could only have occurred if the card details were shared by him or his daughter.
- The daughter responded on 13.12.2024 denying any negligence; Axis Bank rejected her rebuttal the same day.
- The petitioner filed a complaint with the RBI Ombudsman (respondent no. 1) on 16.12.2024.
- Axis Bank submitted its reply on 24.01.2025.
- The petitioner filed a rejoinder.
- On 29.01.2025, the RBI Ombudsman dismissed the complaint under Clause 16(2)(a) of the RBI Integrated Ombudsman Scheme, 2021, without assigning any reason.
Procedural History
- 20.10.2024: Unauthorized transactions occur in Dublin.
- 20.10.2024: Daughter reports theft to Dublin police.
- 21.10.2024: Petitioner files complaint with RBI Ombudsman.
- 23.10.2024: RBI Ombudsman formally registers complaint.
- 25.10.2024: Daughter emails detailed incident report to Axis Bank.
- 30.10.2024: Axis Bank closes complaint without reason.
- 07.12.2024: Axis Bank accuses petitioner of negligence via email.
- 13.12.2024: Daughter rebuts allegation; complaint rejected same day.
- 16.12.2024: Petitioner files complaint with RBI Ombudsman (respondent no. 1).
- 24.01.2025: RBI Ombudsman communicates Axis Bank’s reply to petitioner.
- 29.01.2025: RBI Ombudsman dismisses complaint under Clause 16(2)(a) without reasons.
- 07.04.2026: Hearing concluded.
- 20.04.2026: Judgment delivered.
Relief Sought
The petitioner sought quashing of the impugned orders dated 29.01.2025 and 07.12.2024, restoration of his complaint, refund of Rs. 1,80,000 (equivalent to 2,000 Euros) with applicable charges, and a direction to Axis Bank to implement zero liability as per RBI guidelines.
The Legal Issue
The central question was whether Clause 16(2)(a) of the RBI Integrated Ombudsman Scheme, 2021 permits dismissal of a complaint without assigning reasons when the customer reports unauthorized transactions within 24 hours, and whether the burden of proving customer negligence under Clause 12 of the RBI Circular dated 06.07.2017 can be shifted to the customer in the absence of evidence.
Arguments Presented
For the Petitioner
Mr. Sourojit Dasgupta argued that the petitioner reported the fraud within 24 hours of the transaction, as required under the RBI Circular. He emphasized that the card was stolen, not misused due to negligence, and that the bank had no evidence to prove the petitioner or his daughter shared credentials. He relied on Hare Ram Singh v. Reserve Bank of India and State Bank of India v. Pallabh Bhowmick to establish that banks cannot absolve themselves of liability merely by alleging negligence without proof. He contended that Clause 12 places the burden of proof squarely on the bank, and that Clause 9 mandates reversal within 10 working days.
For the Respondent
Ms. Sayani Roy Choudhury argued that the card was issued without OTP or PIN, implying higher customer responsibility. She claimed the transactions were consistent with credential sharing under Clause 7(i) of the RBI Circular and that the criminal case pending in Ireland precluded civil liability. She asserted that the bank had blocked the card promptly and that the Ombudsman’s dismissal was procedural, not substantive.
The Court's Analysis
The Court examined the RBI Circular dated 06.07.2017 in detail, particularly Clauses 6, 9, 12, and 7(i). It noted that Clause 6 grants zero liability where the unauthorized transaction occurs without customer negligence or due to bank deficiency. Clause 12 explicitly states: "The burden of proving customer liability in case of unauthorized electronic banking transactions shall lie on the bank."
"The bank has not placed any documents or evidence to show that if the credit card is issued without any PIN or OTP facilities, the liability is upon the card holder for any fraudulent transactions."
The Court rejected the bank’s argument that lack of OTP/PIN implies negligence, observing that such a condition is a product of the bank’s own product design, not the customer’s failure. The Court further held that the mere existence of a pending criminal case in Ireland does not absolve the bank of its contractual and regulatory obligations under the RBI Circular.
The Court distinguished State Bank of India v. Pallabh Bhowmick, which was affirmed by the Supreme Court, and held that the bank’s failure to investigate, provide evidence of negligence, or even attempt reconciliation rendered its dismissal arbitrary. The Ombudsman’s closure of the complaint without assigning reasons violated principles of natural justice and the procedural mandate under the RBI Scheme.
The Court emphasized that the customer’s prompt reporting, police complaint, and immediate card blocking were sufficient to trigger zero liability under Clause 6(ii) and Clause 9. The bank’s silence and refusal to credit the amount within 10 working days constituted a deficiency in service.
The Verdict
The petitioner succeeded. The Court set aside the impugned orders dated 29.01.2025 and 07.12.2024, quashed the dismissal of the complaint, and directed Axis Bank to refund Rs. 1,80,000 (equivalent to 2,000 Euros) along with all associated charges to the petitioner’s account within 14 days. The Court further directed that the refund be value-dated to 20.10.2024 and that interest at 6% per annum be paid from the date of the unauthorized transaction until actual payment.
What This Means For Similar Cases
Burden of Proof Rests Entirely on the Bank
- Practitioners must insist that banks produce concrete evidence of customer negligence before any liability is imposed.
- Allegations of credential sharing without forensic or digital trail are insufficient.
- Banks cannot rely on product design (e.g., no OTP) to shift liability.
Zero Liability Applies Even Without OTP/PIN
- Customers are entitled to zero liability even on cards issued without multi-factor authentication.
- The RBI Circular protects consumers regardless of the bank’s security architecture.
- Banks must proactively implement fraud detection systems, not penalize customers for their absence.
Ombudsman Must Assign Reasons
- Dismissals under Clause 16(2)(a) without reasons are arbitrary and violative of natural justice.
- Writ petitions under Article 226 are maintainable against Ombudsman orders where statutory duties are breached.
- Delayed or non-responsive Ombudsman decisions must be challenged promptly with emphasis on procedural non-compliance.
