The Supreme Court has held that banks are responsible for safeguarding their customers against unauthorised transactions reported from their accounts.
However, the Court also emphasised the need for customers to exercise vigilance and avoid sharing sensitive information like OTPs.
The bench, comprising Justices JB Pardiwala and R Mahadevan, upheld the State Bank of India’s (SBI) liability in a case involving fraudulent transactions totaling ₹94,204.80 from a customer’s account.
“All transactions relating to the account of the respondent No.1 – herein maintained with the petitioner – Bank were found to be unauthorised and fraudulent. It is the responsibility of the bank so far as such unauthorised and fraudulent transactions are concerned. The Bank should remain vigilant. The Bank has the best of the technology available today to detect and prevent such unauthorised and fraudulent transactions,” the bench observed.
The case arose when the customer, Pallabh Bhowmick, attempted to return an online purchase and received a fraudulent call from someone posing as customer care. Following instructions, he downloaded a mobile app that facilitated the unauthorised transactions.
While SBI denied liability, citing that OTPs and MPINs were shared, the customer claimed no sensitive information was disclosed. He attributed the fraud to a data breach on the retailer’s website.
Both the Single Bench and Division Bench of the Gauhati High Court ruled in favor of the customer, referring to clauses 8 and 9 of the Reserve Bank of India’s (RBI) Circular dated July 6, 2017. These clauses impose “zero” liability on customers for unauthorised transactions arising from third-party breaches, provided they are reported promptly.
The Supreme Court refused to overturn the High Court’s judgment, noting the fraudulent transaction was reported within 24 hours. “We also take notice of the fact that within 24 hours of the fraudulent transaction, the customer, i.e., the respondent No.1 – herein brought it to the notice of the Bank,” the Court stated.
The Court, however, cautioned customers to remain vigilant. “We expect the customers, i.e., the account holders also to remain extremely vigilant and see to it that the O.T.Ps. generated are not shared with any third party. In a given situation and in the facts and circumstances of some case, it is the customer also who could be held responsible for being negligent in some way or the other.” The petition filed by SBI was dismissed.