Canara Bank Ordered to Refund Customer After OTP Claim Fails

A consumer commission in Karnataka has directed Canara Bank to refund ₹4.84 lakh with interest to a 55-year-old customer after holding that the bank failed to prove its allegation that he had shared his OTP or confidential account details with fraudsters.

The Kalaburagi District Consumer Disputes Redressal Commission also awarded ₹15,000 as compensation for deficiency in service and ₹5,000 towards litigation costs, taking the total immediate relief beyond the principal amount to ₹5.04 lakh, apart from interest.

President-in-charge Malati Guranna and member M Lokesh were hearing a complaint filed by Siddayya Nandikol against Canara Bank’s Station Bazar branch in Kalaburagi.

The commission held that the bank’s failure to refund the disputed amount amounted to deficiency in service.

Three Transactions Drained ₹4.84 Lakh

The dispute arose from three allegedly unauthorised transactions made from Nandikol’s savings account on March 17, 2025.

Two of the transactions were for ₹2 lakh each, while the third was for ₹84,000, taking the total disputed amount to ₹4.84 lakh.

According to the complaint, Nandikol learnt about the transactions through bank messages and contacted the bank’s helpline.

He was advised to approach the cybercrime police and subsequently lodged a complaint in Kalaburagi the same day.

Despite reporting the transactions promptly and later issuing a legal notice, the amount was not refunded.

Nandikol then approached the consumer commission alleging deficiency in banking services.

He sought a refund of ₹4.84 lakh with 12 per cent annual interest, along with compensation for mental agony and litigation expenses.

Bank Alleged Customer Shared OTP

Canara Bank contested the complaint and claimed that the transactions had taken place with the customer’s consent.

The bank alleged that Nandikol had shared his OTP and other confidential banking information with third parties and was therefore responsible for the loss.

The commission, however, found that the bank had failed to support this allegation with clear documentary evidence.

It referred to the Reserve Bank of India’s July 6, 2017 framework on customer protection in unauthorised electronic banking transactions.

The RBI guidelines require banks to maintain adequate security systems, fraud detection and prevention mechanisms, and processes to assess and respond to unauthorised transactions.

The commission noted that Nandikol had reported the transactions to the bank and cybercrime authorities on the same day.

In the absence of evidence proving that he had deliberately shared sensitive banking credentials, the commission held that his liability for the unauthorised transactions was zero.

Commission Finds Deficiency in Banking Service

The commission also noted that the bank had traced the beneficiary of the ₹84,000 transaction.

However, the records before it did not clarify whether that amount had been recovered.

The commission criticised the bank for directing the customer to approach cybercrime police while failing to provide adequate relief itself despite being in a better position to trace and examine the unauthorised transfers.

It held that this conduct caused additional inconvenience and harassment to the complainant.

The commission ultimately directed Canara Bank to refund the full ₹4.84 lakh with 6 per cent annual interest from September 20, 2025, the date the consumer complaint was filed, until realisation.

It also awarded ₹15,000 as compensation for deficiency in service and ₹5,000 towards litigation costs.

The ruling reinforces the importance of timely reporting in unauthorised banking transactions and places the burden on banks to substantiate claims that customers themselves compromised their credentials.

Where a customer promptly reports suspicious transactions and the bank cannot establish negligence or deliberate disclosure of sensitive information, the RBI framework can significantly limit or eliminate the customer’s liability.