India has witnessed a significant move towards digital banking in recent years. Financial transactions are now quicker and more convenient than ever thanks to services like digital wallets, UPI payments, mobile banking, and internet banking. At the same time, this digital transition has led to a huge growth in cyber fraud. Fraudsters increasingly utilize sophisticated methods such as phishing links, bogus banking websites, UPI scams, OTP fraud, investment scams, and impersonation calls to deceive customers and get unauthorised access to their bank accounts.
A major legal question has surfaced as cyber fraud continues to rise: Who should shoulder the loss when money is fraudulently removed from a customer’s bank account? Should the customer be held accountable if their own actions contributed to the fraud, or should the bank be in charge of returning the money? The answer depends on the details of each case and the legal standards governing unauthorised electronic banking activities.
A notable case addressing this topic is State Bank of India v. Hare Ram Singh & Anr., decided by the Delhi High Court on 29 May 2026. The Court reviewed whether a bank can be held accountable simply because a customer asserts that they never disclosed their OTP. It added that consumer irresponsibility may extend beyond sharing passwords or OTPs and may even involve clicking suspicious sites or compromising banking credentials. The judgement has grown to be a significant precedent for assessing culpability in cyber fraud cases and interpreting the Reserve Bank of India’s customer protection policy.
Understanding Unauthorized Electronic Banking Transactions
An unlawful electronic banking transaction is any transaction carried out from a customer’s bank account without their knowledge, authorization, or agreement. Typically, debit or credit cards, UPI apps, mobile banking, internet banking, and other digital payment channels are used for these purchases. Frequently, the account holder doesn’t realize the fraud until they check their account balance or receive a transaction alert.
Cyber criminals can obtain a customer’s banking information in a number of ways. Phishing emails and messages, phony banking websites, fraudulent SMS links, OTP scams, phony customer service numbers, UPI payment requests, QR code scams, remote access applications, and social engineering techniques that deceive clients into disclosing private banking information are some of the most popular techniques.
When an unlawful transaction takes place, it’s critical to ascertain whether the loss was caused by the customer’s carelessness or by a malfunction in the bank’s security system. If a bank’s security flaws or noncompliance with regulations led to the fraud, it could be held accountable. However, the user may also be held accountable for the loss if they willingly disclosed private information, clicked on bogus links, or neglected to use reasonable caution when utilizing online banking services.
To counter such scenarios, the Reserve Bank of India released the Customer Protection Circular on Unauthorized Electronic Banking Transactions on 6 July 2017. The circular lays down the standards for evaluating culpability in circumstances of unlawful electronic transactions. It takes into account things like the reason behind the fraud, the client’s behavior, the bank’s role, and how long it took the consumer to disclose the issue. The purpose is to ensure that actual victims obtain protection while simultaneously encouraging users to utilize digital banking responsibly.
Facts of State Bank of India v. Hare Ram Singh & Anr.
The occurrence involving an unapproved online transaction from the respondent, Hare Ram Singh’s bank account, gave rise to the State Bank of India v. Hare Ram Singh & Anr. case. The disagreement started when a number of internet transactions took almost ₹2.60 lakh out of his account. The consumer stated that he had become the victim of a cyber fraud after clicking on a fake SMS link that appeared to be legitimate.
According to the customer, although One Time Passwords were delivered to his registered mobile number throughout the transactions, he had never willfully shared the OTPs or allowed the transfers. He maintained that the bank ought to reimburse him for the money he lost because the transactions were not allowed. Based on this, he petitioned the Delhi High Court to order the State Bank of India to reimburse the sum withheld plus interest.
The claim was rejected by the State Bank of India. The bank claimed that the transactions had been carried out using legitimate client credentials and authentication processes and that there was no proof of any security system malfunctions. SBI contended that the bank shouldn’t be held automatically accountable because the loss seems to have been caused by the customer’s own conduct, especially after clicking on the fake link.
The customer’s claim was approved by a single judge of the Delhi High Court, who ordered SBI to reimburse the whole amount plus any relevant interest. Dissatisfied with this verdict, the bank filed an appeal before the Division Bench of the Delhi High Court. The Division Bench was therefore compelled to determine whether a customer’s mere denial of sharing an OTP was sufficient to impose liability on the bank or if the customer’s conduct additionally needed to be examined before deciding culpability for the loss.
Legal Issues Before the Court
The Delhi High Court’s Division Bench had to make decisions on a number of significant legal matters pertaining to responsibility in instances of unlawful electronic banking transactions. The Court’s main concern was whether a bank could be held accountable for a customer’s claim that they had never given their One Time Password to anyone. The Court had to decide if this kind of declaration was enough to order the bank to reimburse the money that was lost.
Another crucial issue was whether clicking on a bogus SMS or phishing link may amount to customer negligence. The Court looked at whether a customer’s negligent online behavior could contribute to the fraud and impact the consumer’s ability to get reimbursement from the bank, even if the customer didn’t explicitly provide an OTP or password.
The Reserve Bank of India’s July 6, 2017, Circular on Customer Protection Concerning Unauthorized Electronic Banking Transactions was also taken into consideration by the Court. This circular gives recommendations for evaluating liability in cases of cyber fraud by examining the conduct of both the bank and the consumer. The Court had to determine whether the customer’s acts qualified as negligence under the RBI framework and whether the unlawful transactions were caused by a weakness in the bank’s security system. These considerations formed the core of the Court’s analysis while considering the appeal.
Judgment and Court’s Reasoning
The Delhi High Court’s Division Bench upheld the State Bank of India’s appeal and overturned the Single Judge’s judgement after reviewing the facts and relevant legal precedents. The Court decided that the bank could not be directed to refund the disputed sum just because the customer stated that he had not shared the One Time Password. It noted that each instance of an unlawful electronic banking transaction must be determined on its own facts following a thorough analysis of the available data.
The Court’s interpretation of consumer carelessness in accordance with the Reserve Bank of India Circular dated July 6, 2017, was a key component of the judgement. The Court made it clear that giving an OTP, password, or financial information freely does not constitute negligence. Customers who click on dubious links, reply to phishing emails, divulge private information via fraudulent websites, or neglect to use digital banking services with appropriate caution may also be held liable. Such acts could impact the customer’s reimbursement claim and contribute to the fraud.
The Court also underlined the relevance of technical and forensic evidence in cyber fraud proceedings. It noted that analyzing digital records, transaction logs, device data, network information, and other technical materials is frequently necessary to identify the true cause of an unlawful activity. Without such proof, it is challenging to determine whether the customer’s actions or a flaw in the bank’s security system caused the fraud.
For this reason, the Division Bench decided that writ procedures are often not the appropriate forum for deciding disputed questions requiring complicated technical facts. A writ court can’t typically carry out a thorough factual investigation that calls for technical research and expert testimony because its main focus is on legal issues.
Additionally, the judgement made a clear distinction between banking service deficiencies and client negligence. If the bank fails to maintain proper security standards or does not comply with regulatory requirements, it may be held accountable for the loss. However, if the customer participates to the fraud through irresponsible behavior, culpability cannot automatically be moved to the bank. The Court consequently highlighted that culpability in cyber fraud cases must be decided only after a rigorous analysis of the facts, technical evidence, and the conduct of both parties.
Legal Analysis of the Judgment
The judgement in State Bank of India v. Hare Ram Singh & Anr. is significant because it strives to strike a compromise between safeguarding customers and respecting the obligations of banks. Financial transactions are now simpler thanks to digital banking, but there is a greater chance of cybercrime. Although the Court noted that consumers have an obligation to utilize these services wisely, it also emphasized that banks must maintain secure financial systems. Without first reviewing the case’s details, a bank cannot be held accountable for every illegal transaction.
This judgement is more expansive view of consumer carelessness is among its most significant contributions. In the past, sharing an OTP, password, or PIN directly was frequently linked to carelessness. The Court made it clear that clicking on dubious links, replying to phishing emails, inputting financial information on phony websites, and neglecting to use reasonable caution when utilizing online banking services are all examples of negligence. This view reflects the evolving nature of cyber crime, as fraudsters increasingly depend on deceit rather than direct requests for personal information.
Future cyber fraud lawsuits are probably going to be impacted by the judgement. It makes it abundantly evident that judges should refrain from drawing conclusions solely from the bank’s or customer’s claims. Rather, culpability should be assessed after taking into account the relevant circumstances and the information at hand. It is anticipated that this strategy will promote more thorough investigations prior to assigning blame.
The decision’s reliance on technical and forensic inquiry is another significant feature. Digital evidence such as transaction records, server logs, mobile device details, internet protocol addresses, and authentication records might help determine how the fraud occurred and who was involved. Such evidence gives a firmer foundation for a fair judicial decision.
From the standpoint of counsel and litigants, the judgment underscores the necessity of collecting and maintaining evidence from the very outset of the dispute. Customers should quickly report illegal transactions, keep records of all conversations with the bank, and preserve digital proof. Advocates should carefully analyze the facts, gather technical records wherever available, and base their argument on credible evidence rather than assumptions. In the end, the judgement encourages a more impartial and fact-based method of settling issues involving cyber fraud.
What Should You Do If Money Is Deducted from Your Account?
Take urgent action if you discover that funds have been taken out of your bank account without your consent. In addition to increasing the likelihood of halting more transactions, a prompt response may even aid in recovering the lost money. Do not ignore transaction alerts or expect that the issue will fix on its own.
The first step is to contact your bank promptly using its customer care service, mobile banking application, or branch. Inform the bank that the transaction is unauthorized and request that your account, debit card, credit card, or online banking services be stopped or temporarily suspended to prevent any further loss. For future correspondence, request that the bank file your complaint and give you a complaint or reference number.
Next, report the occurrence to the National Cyber Crime Helpline by calling 1930. Additionally, as soon as you can, you should submit an online complaint through the National Cyber Crime Reporting Portal. Early notification enables the authorities to take fast action and may boost the chances of tracing or freezing the unlawfully transferred monies.
Preserving all relevant evidence is equally crucial. Keep copies of bank statements, transaction alerts, SMS messages, emails, screenshots, payment details, complaint numbers, and any correspondence with the bank or the fraudster. During the inquiry or legal processes, these records could prove to be important pieces of evidence.
You should also file a First Information Report with the police or the cybercrime police station if the amount involved is significant or if more investigation is necessary. This facilitates the inquiry and establishes an official record of the incident.
Early legal counsel is equally crucial. In addition to communicating with the bank and the investigating authorities, an advocate can help you navigate the legal system and provide you with advice on the proper legal remedies. Additionally, you should be aware of your rights under the Reserve Bank of India Customer Protection Framework for Unauthorized Electronic Banking Transactions, which outlines the guidelines for assessing liability and the situations in which clients may be eligible for compensation or protection. Your prospects of receiving a successful remedy might be greatly increased by acting quickly and according to the correct legal process.
Advocate’s Perspective
An advocate’s role in unlawful electronic banking transactions goes beyond giving legal counsel. An advocate evaluates the case’s facts, determines the legal remedies that are accessible, and assists the client throughout the entire dispute process. The first stage is to ascertain whether the loss was caused by a third party engaged in cyber fraud, a malfunction in the bank’s security system, or consumer error.
An advocate represents the client before the bank by issuing legal notices, answering correspondence, and pursuing a just settlement of the conflict. Depending on the nature of the dispute and the relief sought, the advocate may file the proper legal action before the Consumer Commission, the High Court in relevant situations, or the appropriate civil court if the issue is not settled through the bank’s internal grievance procedure. When there is a legal foundation for a claim for reimbursement or compensation, the advocate also helps clients during the recovery process.
An attorney thoroughly investigates the accusations and crafts a suitable defense if the client is charged with carelessness. This could entail proving that the customer behaved reasonably or that the bank’s security flaws caused the illegal transaction to happen. In these situations, technological and documentary evidence are crucial. Bank statements, transaction data, complaint acknowledgements, device details, server logs, call records, emails, SMS messages, and images might assist establish the true sequence of events.
Timely legal advice and good documentation often make a big difference in the result of a cyber fraud claim. The advocate can successfully defend the client’s rights and make the best case possible before the relevant authorities with a well-prepared case backed by solid evidence.
Conclusion
Financial transactions are now more convenient because to the growing usage of digital banking, but cybercriminals now have more options. Customers must be vigilant when utilizing online banking services because incidents of phishing, UPI fraud, phony links, and unauthorized electronic transactions are becoming increasingly frequent. It’s critical to take quick action if funds are taken out of a bank account without authorization. The likelihood of stopping additional loss and obtaining a workable solution might be increased by promptly notifying to the bank and the cybercrime authorities.
It is evident from the judgement in State Bank of India v. Hare Ram Singh & Anr. that banks are not always held accountable for instances of cyber fraud. It also acknowledges that banks have an obligation to uphold safe financial systems and adhere to legal requirements. Only after reviewing the circumstances, the customer’s behavior, the bank’s security protocols, and the relevant technological evidence can liability be established.
The judgement is a crucial reminder that users of digital banking services must use reasonable caution. Preventing financial loss requires avoiding dubious links, safeguarding private banking information, and reporting fraud as soon as possible. Most essential, anyone facing a cyber fraud case should seek timely legal guidance. Early legal aid, supported by sufficient documentation and technical proof, can help protect individual rights and guarantee that the situation is addressed in line with the law.
