Bank Must Refund Cyber Fraud Victim Where It Cannot Prove Customer Negligence, Rules Kerala High Court in Remadevi T.L. v. Reserve Bank of India

Case: Remadevi T.L. v. Reserve Bank of India and Others
Citation: 2026:KER:76636
Date of Judgment: 05 October 2026
Court: High Court of Kerala
Coram: Justice Harisankar V. Menon
Proceedings: W.P.(C) No. 28970 of 2021

Court Observation

“Though the complaint was lodged on the very same day, the bank has not taken any steps for ensuring that the amounts debited are recredited to the petitioner’s account. Similarly, even after the police identified the fraudster, the bank has not taken any further steps in the matter.”

Summary

Remadevi T.L., a retired college principal holding a savings account with the State Bank of India at Mattannur, Kannur, received an SMS on 13 July 2019 stating that her non-chip-based debit card would be blocked and could be reactivated online. A caller from the same number then persuaded her to share a one-time password (OTP) to register the “State Bank Secure App”. She believed that a further authentication step would be needed before any money could be debited. Soon after, Rs. 3,73,000 was withdrawn from her account.

She complained to the bank’s customer care on the same day, and later to the branch and the police. The police investigation identified the fraudster and found that he had created four digital wallets and siphoned off the amount. The bank refused to reimburse her, and the Banking Ombudsman rejected her complaint, treating her as responsible for the transactions under the customer-negligence provision of the Reserve Bank of India’s circular on customer liability in unauthorised electronic banking transactions.

Justice Harisankar V. Menon set aside the Ombudsman’s order and directed SBI to refund Rs. 3,73,000. The Court held that the bank had failed to cogently establish negligence on the petitioner’s part and that her case fell under Clause 6(ii) of the RBI circular — zero liability for a third-party breach reported within three working days — rather than the negligence provision, following the reasoning of the Gauhati High Court’s Division Bench judgment confirmed by the Supreme Court in its SLP order dated 3 January 2025.

Key Holdings

• Merely downloading an application at the direction of a fraudster cannot, by itself, be treated as negligence; the bank must cogently establish the customer’s negligence through reliable material.
• Where the complaint is lodged on the very same day, the bank takes no steps to ensure recredit of the amounts, and the police report shows the customer was not privy to the fraud, the case falls under Clause 6(ii) of the RBI circular (zero liability for third-party breach), not the customer-negligence provision.
• The petitioner’s explanation — that she thought she was giving the OTP for registering on the app and that there would be a separate OTP for debiting money — was not specifically disputed by the bank.
• The bank cannot deny a refund in an unauthorised electronic banking transaction without assessing customer liability in accordance with the RBI guidelines.

Directions Issued

• The Banking Ombudsman’s order rejecting the petitioner’s complaint was set aside.
• The State Bank of India was directed to make good the loss of Rs. 3,73,000 as stipulated under the RBI circular, as expeditiously as possible and in any event within four weeks.

Background

On 13 July 2019, the petitioner received an SMS and a telephone call stating that her debit card would be blocked and needed reactivation. She shared an OTP for registration of the “State Bank Secure App”, after which Rs. 3,73,000 was debited from her account. She immediately complained to the bank through customer care, and the police later identified the fraudster. The Banking Ombudsman rejected her complaint, holding that she was privy to the transaction and that her case fell under the customer-negligence provision. She challenged that decision before the High Court.

Disclaimer: This is a summary prepared for informational purposes only and does not constitute legal advice. Readers should refer to the official judgment for the authoritative text.