The District Consumer Disputes Redressal Commission in Punjab’s Tarn Taran has directed the State Bank of India (SBI) to refund ₹164,000 to a customer who lost the money in an unauthorised online banking transaction. The commission also ordered the bank to pay ₹15,000 as compensation for mental harassment and ₹10,000 towards litigation expenses. It held that the bank failed to establish negligence on the part of the customer and that rejecting his claim without conducting a proper investigation amounted to a deficiency in service.
In its order dated July 28, the commission observed that SBI was unable to prove that the disputed online transaction had been authorised by the customer or had occurred due to his negligence. Consequently, the commission held that the complainant’s claim had been wrongly rejected. Besides refunding the disputed amount of ₹164,000, the bank has been directed to pay a total of ₹25,000 in compensation and litigation costs.
According to the complaint, ₹164,000 was transferred from the customer’s savings account without his knowledge or consent. He maintained that he had never shared his ATM PIN, one-time password (OTP), internet banking credentials, or any other confidential banking information with anyone. Upon discovering the unauthorised transaction, he immediately reported the matter to the SBI helpline, the National Cyber Crime Reporting Portal, the concerned bank branch, and the police.
The complainant argued that despite reporting the incident without delay, SBI rejected his claim without conducting a proper inquiry or providing him with any investigation report. He relied on the Reserve Bank of India’s circular dated July 6, 2017, titled Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, which provides protection to customers who promptly report unauthorised electronic banking transactions resulting from third-party breaches.
SBI contested the complaint, arguing that the disputed transaction could not have been completed without the customer’s username, password, and the OTP sent to his registered mobile number. The bank further contended that the customer may have knowingly or unknowingly shared his credentials or acted under the influence of fraudsters, and that the unauthorised transaction occurred due to his own negligence.
However, the commission found SBI’s defence to be unsupported by evidence. It noted that the bank failed to produce any technical investigation report, server logs, IP address records, forensic analysis, or any other electronic evidence demonstrating that the customer had voluntarily authenticated the disputed transaction. The commission emphasised that under the RBI guidelines, the burden of proving customer negligence rests with the bank when it seeks to deny protection against unauthorised electronic transactions.
The commission further observed that the customer’s claim had been rejected merely on assumptions and that SBI had failed to place on record any reasoned inquiry report demonstrating that a fair, transparent, and independent investigation had been conducted before denying the claim. It held that once a customer promptly reports an unauthorised electronic transaction, the bank is obligated to carry out a thorough, evidence-based investigation in accordance with RBI guidelines. Failure to do so constitutes a deficiency in service.
The ruling is being viewed as a significant reinforcement of consumer rights in cases involving cyber-enabled banking fraud. Legal experts believe the order underscores that banks cannot reject claims solely on presumptions of customer negligence. Instead, they must substantiate such allegations with credible technical evidence and follow a transparent investigative process before denying liability, making the decision an important precedent for future disputes involving unauthorised electronic banking transactions.
