Unauthorised Transactions Alone Do Not Establish Bank’s Service Deficiency Without Proven Fault: Karnataka High Court
Applying the RBI’s customer-protection circular, the Court held that a customer who fails to safeguard banking particulars or delays reporting unauthorised transactions may be liable for the resulting loss.
The Karnataka High Court has held that the occurrence of unauthorised transactions in a customer’s account does not, by itself, establish deficiency in service by the bank.
Finding no fault, omission or negligence attributable to the bank and holding that the account holder’s own conduct contributed to the loss, the Court set aside the National Consumer Disputes Redressal Commission’s order fastening liability upon the bank.
The Court was hearing a writ petition under Articles 226 and 227 of the Constitution challenging the National Commission’s decision affirming concurrent consumer-forum orders directing the bank to refund ₹12.93 lakh withdrawn through unauthorised electronic transactions, with interest, damages and litigation expenses.
A Bench of Justice D.K. Singh and Justice H. Shanthi Bhushan observed: “The mere fact that unauthorized transactions occurred in the respondent's account cannot, by itself, lead to a conclusion that there was deficiency in service on the part of the petitioner. The respondent was also required to exercise reasonable care in safeguarding his banking particulars and OTP and to promptly report any unauthorized transaction upon receiving the corresponding alerts. Having regard to his conduct in the present case, the loss cannot be attributed entirely to any act or omission on the part of the petitioner. Consequently, the finding of deficiency in service recorded by the District Commission and affirmed by the State Commission and the National Commission is unsustainable. The petitioner cannot be held liable for the loss under Section 2(11) of the Act in the absence of any established fault, omission or negligence on its part.”
Senior Advocate Vikram A. Huilgol appeared for the bank, while the respondent appeared in person.
Background
The respondent maintained a savings account with the bank in which approximately ₹25 lakh in retirement benefits had been deposited. He stated that he instructed the bank on March 11, 2019, to transfer the amount to another account but discovered on April 30 that ₹12,93,922 had been withdrawn through several unauthorised transactions between April 12 and April 30.
The respondent complained to the bank and police and subsequently filed a consumer complaint alleging that the bank had failed to safeguard his account. The bank denied any deficiency and contended that the respondent had disclosed his Aadhaar particulars to an unknown person, received transaction alerts and failed to promptly report the disputed debits.
The District Consumer Commission directed the bank to refund ₹12,93,922 with savings-bank interest, ₹25,000 as damages and ₹10,000 towards litigation expenses. The State Commission and National Commission affirmed that decision after applying the zero-liability provision in paragraph 6(ii) of the Reserve Bank of India’s circular dated July 6, 2017.
Court’s Observations
Customer-Negligence Provision Applied
The Court held that paragraph 6(ii) of the RBI circular applies when an unauthorised transaction results from a third-party breach, the deficiency lies neither with the bank nor the customer and the customer informs the bank within three working days of receiving the transaction communication.
The Bench found that the case instead fell under paragraph 7(i), which makes the customer liable for losses caused by the customer’s negligence until the unauthorised transaction is reported to the bank.
The Court observed: “In our view, facts of the present case squarely fall under the scenario under Para 7(i), wherein the complete liability is placed upon the customer. In the circumstances of the present case, the respondent had ignored the fraudulent transactions from 12.04.2019 to 30.04.2019, although he had real-time knowledge regarding the same. The respondent waited until 30.04.2019 to ascertain the position of his account and thereafter reported the matter to the petitioner on 02.05.2019.”
The Bench added that the bank blocked further attempts after receiving the complaint and referred the matter to its Internal Ombudsman. It held that the later police complaint could not retrospectively cure the failure to act while the transactions and alerts were continuing.
Repeated Alerts Required Prompt Action
The Court noted that the account was actively operated during the period in which the disputed transactions occurred. It referred to transactions carried out by the respondent on April 15, including an NEFT transfer and cheque withdrawals.
The Bench also considered the Internal Ombudsman’s report, which recorded that an OTP had been sent to the registered mobile number before the UPI transaction and that, after its receipt, an MPIN could be set. The report noted the possibility that the OTP had been shared. The respondent had admitted giving his Aadhaar details to an unknown person who claimed to be a bank manager.
The Court held: “Once an SMS was received showing a debit from his account, nothing prevented him from immediately contacting the Bank. Even if the first transaction on 12.04.2019 had escaped his attention, the subsequent transactions and the SMS alerts continued, and the respondent himself operated the account on 15.04.2019. The failure to react to the repeated alerts is therefore a material circumstance, which would depict that the respondent was himself negligent.”
The Bench rejected the respondent’s explanation that he ignored the messages because he trusted the bank. It held that the receipt of repeated alerts and the delay in reporting required a finding on his conduct before liability could be imposed on the bank.
No Fault Or Negligence Established Against Bank
The Court observed that the National Commission had not properly considered the transaction records, SMS alerts, Internal Ombudsman’s report and the respondent’s conduct while applying the zero-liability provision.
The Bench found that the bank had produced records concerning the transactions and alerts and had acted after the complaint was received.
The Court stated: “The material on record shows that the respondent had received SMS alerts in respect of the disputed transactions, had himself operated the account during the period in which the transactions occurred, and had shared his Aadhaar particulars with a person whose identity was not known to him. Despite receiving repeated alerts, the respondent did not immediately bring the unauthorized transactions to the notice of the petitioner and reported the same only on 02.05.2019. The petitioner, on the other hand, has produced the transaction records and SMS records and, upon receiving the complaint, took steps to block further transactions and placed the matter before the Internal Ombudsman.”
The Court consequently held that the evidence did not establish any fault, omission or negligence in the bank’s performance of its services so as to constitute “deficiency” under Section 2(11) of the Consumer Protection Act, 2019.
Conclusion
The High Court allowed the writ petition and set aside the National Commission’s order dated May 15, 2026, which had affirmed the bank’s liability for the unauthorised transactions.
Cause Title: State Bank of India v. Prof. K.P. Sreenath
Appearances
Petitioner: Senior Advocate Vikram A. Huilgol, instructed by Advocate Francis Xavier
Respondent: Party in person
