RBI Circular Requiring Banks To Reverse Unauthorized Transactions To Customers Apply Independently Of Criminal Probe: Bombay HC

The Bombay High Court has held that RBI rules shielding customers from liability in online fraud and requiring banks to reverse such transactions where the customer is not at fault apply independently of any criminal investigation and directed HDFC Bank to remit Rs. 38.04 lakh to a businessman who lost the amount in a cyber fraud.

A bench of Justices Bharati Dangre and Manjusha Deshpande said the RBI's July 6, 2017 framework on unauthorized electronic banking transactions is intended to protect customers from financial loss and is to be applied independently of the outcome of a police probe.

“In our view, the circular of the RBI dated 06/07/2017 is independent of any criminal investigation to be conducted to establish any cyber crime, as the RBI intended to protect the customer who has suffered financial loss on account of fraudulent or unauthorized electronic banking transactions.”

Clarifying, in line with the RBI framework, that where a customer reports an unauthorized transaction within three days, the bank must act without awaiting criminal proceedings, the court said:

“The burden to establish that the customer is at fault is on the bank and once a customer has notied the bank about the fraudulent transaction, from the date when he received communication from the bank, it is imperative for the bank to credit the amount involved in the unauthorized electronic banking transaction to the customer's account and if the reporting is within three days, then the liability of the customer is zero.”

The case arose from a cyber fraud incident on July 15, 2021, in which Rs 38.04 lakh was siphoned off from the accounts of Subodh C. Korde, a freelance business consultant from Pune, within a span of forty-one minutes.

Korde contended that unknown beneficiaries were added to his accounts and transaction limits enhanced without his knowledge, and claimed that he did not receive any OTPs or alerts. Upon discovering the transactions, he immediately informed the bank, sought to block his account, and later lodged a police complaint.

HDFC Bank, however, maintained that all transactions were authenticated through valid credentials and OTPs sent to the petitioner's registered mobile number and email and argued that the matter involved disputed questions of fact that could not be examined in writ jurisdiction.

Rejecting the bank's contention that action must await completion of a cyber investigation, the court held that the very purpose of the RBI circular is to protect a diligent customer. Since the bank failed to establish any negligence on the part of the petitioner, the court held that he would be entitled to the benefit of the circular, warranting reconsideration of his claim.

The court observed, “The whole purpose of the circular/guidelines issued by the RBI is to provide a buffer to a customer, who is diligent, and is not responsible for negligence or contribute to the fraud by sharing OTP/password and since, the Bank has failed to establish that the Petitioner did so, in our view, the Petitioner is entitled for the benefit under the circular of RBI dted 06/07/2017 and he deserve the amount of which he is deprived back in his account.”

The court also set aside the decision of the Banking Ombudsman, which had earlier rejected Korde's complaint.

Ultimately, the court set aside the Ombudsman's decision and directed HDFC Bank to remit Rs 38.04 lakh to the petitioner's account within eight weeks along with interest at 6% per annum, holding that he was deprived of his money despite no fault on his part.