HDFC credit card holder lost Rs 1.39 lakh in an unauthorised transaction, bank says card details and OTP were used; court orders HDFC Bank to pay him Rs 1.75 lakh

An HDFC Bank credit card holder in Kakinada found a transaction worth Rs 1,39,901 on his card that he said he had never authorised. He immediately informed the bank and cyber-crime authorities and later approached the consumer commission after HDFC Bank refused to reverse the amount.

The Kakinada consumer commission has now held HDFC Bank responsible for the disputed transaction and ordered it to reimburse the full Rs 1,39,901 with 9% annual interest. The bank has also been directed to pay Rs 30,000 as compensation and Rs 5,000 towards litigation costs, taking the immediate monetary relief to Rs 1,74,901.

Rs 1.39 lakh charged through online transaction

The complainant, V.V.V. Seshagiri Rao of Kakinada, was an HDFC Bank credit card customer with a credit limit of Rs 7 lakh. According to the consumer complaint, he had been regularly using the card and paying his dues.


On February 18, 2024, at around 8.22 pm, Rs 1,39,901 was debited through an online transaction without his authorisation.

Rao informed HDFC Bank's customer care and cyber-crime authorities on the same day. He also visited the bank and sent repeated emails seeking reversal of the transaction.

After receiving no satisfactory resolution, he sent a legal notice to the bank on April 23, 2024, asking for a refund and an explanation.

HDFC Bank said card details and OTP were used

HDFC Bank denied liability for the transaction. The bank said the card number, CVV, expiry date and OTP had been used for the payment.

The bank also claimed that the customer had shared his card details during an online scam involving a purported booking through a website called “shriramrentals.co.in”.

HDFC Bank argued that the customer's own negligence meant the bank should not be held responsible under RBI rules governing unauthorised electronic banking transactions.

The bank also relied on the fact that an OTP SMS had been sent for the transaction.

Commission says OTP use alone did not prove approval

The Kakinada consumer commission examined the RBI circular dated July 6, 2017, governing customer liability in unauthorised electronic banking transactions.

A key point considered by the commission was the burden of proving customer liability. Under the RBI framework, the bank has to establish the circumstances supporting the customer's liability.

The commission found that HDFC Bank had produced transaction and SMS records, but had not produced independent evidence showing that Rao had communicated the OTP or knowingly authorised the disputed payment.

The commission said technical authentication using card details and an OTP, by itself, could not establish that the customer was legally responsible for the transaction.

The bank also failed to show whether any fraud-risk analysis, transaction monitoring or other security verification had been carried out before processing the substantial transaction.

Customer had reported the transaction immediately

The commission also considered the customer's conduct after discovering the disputed payment.

Rao had contacted HDFC Bank and cyber-crime authorities on the same day the transaction took place. He subsequently followed up with the bank, sent emails and issued a legal notice seeking reversal.

The commission found this prompt reporting relevant to the dispute and held that HDFC Bank had failed to discharge its burden of proving customer liability.

It concluded that the bank's refusal to reverse or properly resolve the unauthorised transaction amounted to deficiency in service.

HDFC Bank ordered to refund Rs 1.39 lakh

The commission ordered HDFC Bank to reverse or reimburse Rs 1,39,901, along with 9% annual interest from February 18, 2024, until the amount is actually paid or reversed.

The bank was also directed to reverse or waive interest, finance charges, late-payment charges, penalties and other charges arising solely from the disputed transaction.

HDFC Bank must recompute the credit card account and provide a corrected statement within 30 days of receiving the order.

The commission further directed the bank not to report or continue adverse CIBIL or default information arising solely from the disputed transaction and related charges. If such information had already been reported, the bank must take steps to correct it.

Rs 30,000 compensation and Rs 5,000 costs

Apart from the refund and interest, HDFC Bank was ordered to pay Rs 30,000 as compensation and Rs 5,000 towards litigation costs.

The bank was given 45 days from the date of the order to comply.

If it failed to comply within that period, the monetary amounts would attract 12% annual interest from the expiry of the 45-day period until realisation, as directed by the commission.

The order was passed by the Kakinada consumer commission on August 22, 2026.