HC orders bank to remit ₹38L lost in SIM swap fraud; says no customer liability without negligence

Korde told the court that on July 15, 2021, he received an alert about a ₹2.14 lakh transfer he had not authorised. On checking his net banking account, he discovered that ₹38.04 lakh had been siphoned off through eight transactions within a span of about 40 minutes

MUMBAI: Holding that a customer cannot be penalised for cyber fraud without negligence, the Bombay high court has ordered HDFC Bank to return ₹38.04 lakh to a Pune resident duped in a SIM swap scam. The court noted that banks are liable in unauthorized transactions if the customer has not contributed to the fraud, relying on RBI guidelines that fix zero liability in such cases.

HC orders bank to remit ₹38L lost in SIM swap fraud; says no customer liability without negligence

A division bench of Justices Bharati Dangre and Manjusha Deshpande passed the order on a petition filed by Subodh Korde, a business consultant, who maintained savings and current accounts with the bank’s Wakad branch.

Korde told the court that on July 15, 2021, he received an alert about a ₹2.14 lakh transfer he had not authorised. On checking his net banking account, he discovered that ₹38.04 lakh had been siphoned off through eight transactions within a span of about 40 minutes.

He found that three beneficiaries had been added to his account and the daily transaction limit increased from ₹4 lakh to ₹40 lakh without his knowledge. The funds were subsequently withdrawn through unauthorised transactions.

On July 28, the bank responded to his complaint and denied responsibility, claiming OTPs were sent to his registered mobile number. However, Korde argued he never received any such alerts.

Korde approached the high court after receiving no relief from the bank or the banking ombudsman. He maintained that he had not received any OTPs or alerts for the transactions. He argued that the bank was liable to return the amount to his accounts.

The bank contended that OTPs were generated for all transactions and sent to the petitioner’s registered mobile number; therefore, it could not be held liable.

Referring to a 2017 Reserve Bank of India circular, the court then held that in cases of unauthorised transactions, customer liability is zero if there is no negligence and the fraud is promptly reported within three working days.

An affidavit from BSNL, Korde’s mobile service provider, also confirmed the fraud involved SIM swapping, where criminals obtain a duplicate SIM, disabling the original and gaining control over banking access.

Against this backdrop, the bench ruled that all transactions, including the addition of beneficiaries and enhancement of limits, were unauthorised and directed the bank to refund the amount within eight weeks with 6% annual interest from the date of the fraud. Failure to comply will attract 8% interest, the bench noted.