1. Introduction
Imagine checking your bank account one morning and finding that ₹38 lakh has disappeared, not because you gave your password to anyone, but because someone else had managed to take control of your mobile number. The transactions appear genuine, the OTPs have been used, and the bank's records show successful authentication. But the customer says he never authorised any of it. Who, then, should bear the loss?
This was the central problem before the Bombay High Court in the above-mentioned case. A senior citizen who lost ₹38.04 lakh through a series of unauthorised transactions allegedly carried out after his SIM was cloned. What made the case particularly significant was that the bank's own security system had flagged unusual activity, including the addition of new beneficiaries and a substantial increase in the transaction limit.
The dispute therefore went beyond the question of whether OTPs had been correctly entered. The Court had to consider whether successful authentication was enough to make the customer liable when he denied authorising the transactions and the bank's own system had raised alerts about the earlier activity. The Court also had to examine whether such a claim could be brought against a private scheduled bank under Article 226 and whether the petitioner was entitled to protection under the RBI's zero-liability framework.
2. The Parties
The petitioner, Subodh C. Korde, is a freelance business consultant based in Pune. He held savings and current accounts with HDFC Bank's Wakad branch. The petition impleaded the Union of India, the Reserve Bank of India, HDFC Bank Ltd., ICICI Bank Ltd., Bharat Sanchar Nigam Limited (BSNL) and the State of Maharashtra through Wakad Police Station, Pune.
3. Facts of the Case
The petitioner had maintained a savings account with HDFC Bank since 2011 and a current account since 2016. The dispute arose when a large amount of money was transferred from these accounts without his knowledge.
On 14 July 2021, three persons unknown to the petitioner - Samir Tamang, Aloke Pal and Subhomoy Biswas - were added as beneficiaries to his account. Around the same time, the petitioner's third-party transfer limit was increased from ₹4 lakh to ₹40 lakh.The petitioner maintained that he had not authorised either of these changes and had not received OTPs for adding the beneficiaries or increasing the transaction limit.
The bank's internal records later became important. Its security system had reportedly flagged the beneficiary additions as suspicious, including an alert stating "Decline add payee" and an IP mismatch. Despite these alerts, the beneficiaries were manually approved.
On 15 July 2021, eight transactions were carried out from the petitioner's accounts within approximately 41 minutes. A total amount of ₹38,04,000 was transferred to the accounts of the newly added beneficiaries.
The petitioner received an SMS alert regarding one of the transactions, involving ₹2,14,000, at around 5:55 p.m. After checking his account, he discovered that several transactions had taken place without his authority.
The petitioner alleged that the fraud was carried out through SIM swapping, which enabled the fraudsters to obtain access to the mobile number linked to his bank account and consequently intercept OTPs and other banking communications.
He approached the bank and reported the transactions. Since the money had been transferred to accounts maintained with ICICI Bank, the petitioner also raised concerns regarding the steps taken to prevent further movement of the funds.
HDFC Bank, on the other hand, denied liability and relied upon the fact that OTPs had been sent to the registered mobile number and email address and that the transactions had been authenticated. The Banking Ombudsman subsequently closed the complaint on 28 March 2022, taking note of the OTP authentication and the device from which the transactions were carried out.
4. Issues Before the Court
The Court was required to consider four connected questions:
Whether a writ petition under Article 226 of the Constitution was maintainable against a private scheduled bank such as HDFC Bank for enforcement of RBI directions and guidelines.
Whether the petitioner was entitled to zero liability under the RBI Circular dated 6 July 2017 dealing with unauthorised electronic banking transactions.
Whether HDFC Bank had established any negligence or contributory fault on the part of the petitioner.
Whether successful OTP authentication, by itself, was sufficient to establish that the petitioner had authorised the transactions and could therefore be made liable for the loss.
5. Court's Reasoning
The Court first dealt with the objection that HDFC Bank was a private bank and therefore could not ordinarily be subjected to a writ petition under Article 226. The Court did not treat the private status of the bank as conclusive. The relevant question was the nature of the obligation which the petitioner sought to enforce.
The petitioner was relying upon the RBI's regulatory framework governing unauthorised electronic banking transactions. HDFC Bank, as a scheduled bank, was subject to the regulatory control of the RBI. The Court therefore considered that the dispute involved more than an ordinary private contractual relationship between a bank and its customer. The regulatory obligations imposed upon the bank gave the matter a sufficient public law element for the Court to examine it under Article 226.
Having dealt with maintainability, the Court then turned to the question of the petitioner's liability. The RBI Circular dated 6 July 2017 was central to this issue. The framework does not make a customer liable merely because an unauthorised electronic transaction has taken place. Where the bank seeks to attribute the loss to customer negligence, the bank must be able to establish such negligence.
In the present case, HDFC Bank was unable to establish that the petitioner had himself disclosed his banking credentials or otherwise acted negligently. The petitioner had disputed authorising the transactions and had reported the fraud after discovering it. The circumstances surrounding the transactions also suggested that a third party had obtained access to the account.
This led to an important point regarding the bank's reliance on OTPs. The fact that an OTP was successfully entered only established that the authentication mechanism had been completed. It did not necessarily establish that the genuine customer had personally authorised the transaction. In a case involving an alleged SIM swap, the distinction becomes particularly important because a fraudster who gains control of the customer's mobile number may also be able to receive the OTP.
The surrounding circumstances further weakened the bank's case. Before the fraudulent transfers took place, three unknown beneficiaries had been added to the account and the transaction limit had increased from ₹4 lakh to ₹40 lakh. The bank's own system had also raised alerts concerning the beneficiary additions and detected an IP mismatch. These circumstances were relevant in deciding whether the transactions could simply be treated as customer-authorised merely because the OTP verification had been completed.
The Court therefore considered the transaction history, the security alerts, the petitioner's conduct and the absence of sufficient material establishing negligence together. On that basis, the bank could not shift the entire loss to the petitioner merely by relying on successful authentication.
6. Decision of the Court
The Court ruled in favour of the petitioner and granted relief in respect of the unauthorised transactions.
It held, in substance, that successful OTP authentication could not by itself be treated as proof that the petitioner had authorised the transactions. The bank also had to establish that the customer had been negligent if it sought to deny liability on that basis.
In the circumstances of the case, the Court found that HDFC Bank had not produced sufficient material to establish such negligence. The addition of unknown beneficiaries, the sudden increase in the transaction limit and the security alerts generated by the bank were relevant circumstances which could not be ignored.
The petitioner was therefore entitled to the protection available under the RBI's framework relating to unauthorised electronic banking transactions.
7. Ratio Decidendi
The ratio of the judgment can be understood through the connection between Article 226, customer negligence and authentication.
The Court held that a writ petition could be maintained against a private scheduled bank where the relief sought involved enforcement of obligations arising from the RBI's regulatory framework governing banks. The dispute therefore had a sufficient public law element to attract Article 226 jurisdiction.
On the question of liability, the Court held that where a customer disputes an electronic transaction as unauthorised, the bank cannot shift the loss to the customer merely by showing that the transaction was successfully authenticated. If customer negligence is relied upon, the bank must establish it.
The Court further distinguished authentication from authorisation. Successful OTP verification establishes completion of an authentication step, but it does not, by itself, establish that the genuine customer authorised the transaction. Therefore, in circumstances indicating third-party fraud, including an alleged SIM-swap fraud, OTP authentication alone cannot make the customer liable where the bank has failed to establish customer negligence.
8. Legal Significance
The judgment is significant because it brings together two important aspects of digital banking disputes - the bank's regulatory obligations and the customer's responsibility for unauthorised transactions.
First, the decision shows that the private status of a bank does not automatically prevent the High Court from exercising jurisdiction under Article 226. Where the dispute concerns compliance with obligations arising from the RBI's regulatory framework, a public law element may be present.
Second, the judgment makes it clear that the use of an OTP cannot be treated as conclusive proof that the customer authorised a transaction. This is particularly relevant in cases involving SIM swapping and other forms of cyber fraud where the fraudster may obtain access to the authentication mechanism without obtaining the customer's actual consent.
The decision also places importance on the surrounding circumstances of a transaction. Here, the addition of unknown beneficiaries, the sudden increase in the transaction limit and the bank's own security alerts were relevant while considering whether the transactions could reasonably be attributed to the customer.
The broader significance of the judgment is therefore that banks cannot rely only on the fact that their authentication process was successfully completed. Where the customer disputes the transaction and the bank relies on customer negligence, the question of negligence has to be established on the material available in the case.
9. Conclusion
This case underlines a principle that a transaction can be authenticated without being authorised by the genuine customer.
The Court's approach was based not merely on the presence of OTP authentication, but on the circumstances in which the transactions took place. The addition of unknown beneficiaries, the sudden increase in the transaction limit and the bank's own security alerts were relevant in determining whether the petitioner could be held responsible for the loss.
The judgment therefore reinforces the protection available to customers under the RBI's framework for unauthorised electronic banking transactions and makes it clear that customer negligence cannot simply be presumed from the successful use of an OTP.
About Author :- Ms. Sakshi Kewalramani, S.Y.LL.B , KC Law College