SBI ordered to refund nearly Rs 2 lakh after online fraud as customer said he never shared his ATM PIN, OTP or banking details

A consumer commission in Punjab has directed the State Bank of India (SBI) to refund Rs 1.64 lakh to a customer who lost money in an unauthorised online banking transaction, ruling that the bank failed to prove negligence on the customer's part.

Read more - Nepal communal tensions: Security tightened in Bihar's Madhubani border district

The commission also ordered SBI to pay Rs 15,000 as compensation for harassment and mental agony, along with Rs 10,000 towards litigation costs, observing that the bank's failure to properly investigate the complaint amounted to a deficiency in service.

Customer reported fraud immediately

According to the order, the complainant alleged that Rs 1.64 lakh was transferred from his savings account without his knowledge or consent.

He maintained that he had never shared his ATM PIN, one-time password (OTP), internet banking credentials or any confidential banking information with anyone.

The customer said he reported the unauthorised transaction immediately through the SBI helpline, the National Cyber Crime Reporting Portal, his bank branch and the police.

Customer relied on RBI's customer protection rules

The complainant argued that SBI rejected his claim without carrying out a proper investigation or providing an enquiry report.

He relied on the Reserve Bank of India's Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions circular dated 6 July 2017, which provides protection to customers who promptly report unauthorised electronic banking transactions resulting from third-party breaches.

SBI claimed customer may have been negligent

SBI contested the complaint, arguing that the disputed transaction could not have been completed without entering the customer's username, password and OTP sent to his registered mobile number.

The bank contended that the customer may have acted under the influence of fraudsters and suggested that the transaction could have resulted from his own negligence.

Commission says SBI failed to produce evidence

However, the consumer commission found that SBI had failed to produce any technical evidence supporting its claim.

The commission noted that the bank did not submit server logs, IP address details, forensic reports, technical investigation records or any electronic evidence to show that the customer had voluntarily authenticated the transaction.

It observed that under the RBI's 2017 circular, the burden of proving customer negligence rests with the bank when it seeks to deny protection in cases involving unauthorised electronic banking transactions.

The commission further remarked that SBI's decision to reject the claim appeared to be based on assumptions rather than legally admissible evidence.

Commission orders refund and compensation

Allowing the complaint, the commission directed SBI to:

• Refund Rs 1.64 lakh to the customer.
• Pay Rs 15,000 as compensation for harassment and mental agony.
• Pay Rs 10,000 towards litigation expenses.

The commission observed that once a customer promptly reports an unauthorised transaction, banks are expected to conduct a fair, transparent and thorough investigation in accordance with RBI guidelines. Failure to do so, it said, amounts to a deficiency in service.

The order was passed on 28 July by Commission President Charanjit Singh and members Nidhi Verma and V P S Saini.

Court order here