A Kerala court ruling shows customers may still recover money lost to scams despite sharing an OTP, but swift reporting and evidence can determine who bears the loss.
A simple warning that a debit card will be blocked can be enough to trigger panic, and fraudsters know it. In one case involving a retired teacher and State Bank of India, the scam began with a text message that appeared to echo a real bank policy, followed by a call from someone posing as a bank employee. By persuading the customer to share one-time passwords and install what was presented as a security app, the fraudsters were able to siphon off Rs 3.73 lakh in minutes. The dispute later turned on a broader question that is increasingly common in digital banking: when money is stolen through deception, who should bear the loss? According to the Indian Express account of the case, the customer reported the fraud within an hour, and police later traced the trail through a network of wallets linked to different phone numbers.
The Reserve Bank of India’s customer-protection rules draw careful distinctions between fraud caused by bank negligence, third-party breaches and customer negligence. Livemint and other personal-finance explainers note that if a customer reports unauthorised electronic transactions within three working days, the liability can fall entirely on the bank. Where the report comes after four to seven working days, the customer may face limited liability, depending on the account type and the facts. In cases where the customer has caused the breach, for example by handing over credentials, the loss may remain with the customer until the bank is notified, although any further loss after that point is meant to be borne by the bank.
That framework matters because sharing an OTP does not automatically end a reimbursement claim. Prasanth Sugathan, legal director at the Software Freedom Law Centre, told the Indian Express that a bank can be fully liable where the loss results from its own failure, such as weak security, delayed action or internal fraud, and that it must produce proof if it wants to pin negligence on the customer. A Kerala High Court ruling highlighted in reporting by LiveMint went further, with the court directing SBI to refund the amount lost after it found the bank had not adequately dealt with the complaint. The Guwahati High Court has also said banks must rely on reliable material, not bare allegations, if they want to prove customer negligence.
For customers, the practical lesson is to act at once and document everything. The Indian Express advised account holders to contact the bank through official channels, ask for the account or card to be secured, file a written complaint, preserve screenshots, call logs and transaction alerts, and report the matter to the police or the national cybercrime portal. If a claim is rejected, the customer should ask for the decision in writing and challenge it through the bank’s grievance process or, where eligible, the RBI’s ombudsman system. That urgency is especially important because the RBI’s framework is expected to evolve further from January 2027, with industry reporting indicating wider consumer protection, a shorter reporting window and a heavier burden on banks to resolve disputes quickly.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
