HC tells BoB to refund ₹1.24 crore in SIM-swap fraud, affirms ‘zero liability’ for customer

The order came from a bench of Justices Bharati Dangre and Manjusha Deshpande on Tuesday while hearing a plea by PNP Polytex Pvt Ltd

MUMBAI: Reinforcing its stance in similar SIM-swap fraud case, the Bombay high court has directed Bank of Baroda to refund ₹1.24 crore to PNP Polytex Pvt Ltd, a Mumbai-based firm that lost funds in January 2020, holding that the customer had “zero liability” as the fraud was carried out by third parties and reported without delay.

(Shutterstock)

The order came from a bench of Justices Bharati Dangre and Manjusha Deshpande on Tuesday while hearing a plea by the firm. The bench noted that under the RBI’s July 6, 2017 circular on unauthorised electronic banking transactions, customers are entitled to zero liability if they report such fraud within three days.

The firm, engaged in import and trade, approached the court after losing ₹1.24 crore through a series of unauthorised online transactions. The company claimed that it had immediately informed the bank and sought a freeze on its accounts. While the bank managed to block ₹47.8 lakh, the remaining amount had already been withdrawn by the fraudsters.

The company submitted that the fraud was carried out through SIM swapping, a method where the fraudster gains access to the victim’s registered mobile number, which enables them to receive one time passwords (OTP) and operate the bank account undetected.

Subsequently, a complaint was registered at the Borivali police station. Following the investigation, it was confirmed that third parties had breached banking credentials and diverted OTPs to execute the fraud.

Citing the RBI’s July 6, 2017 circular on customer protection in unauthorised electronic banking transactions, the court held that customers face zero liability if they report such incidents within three days.

“The burden to establish that the customer is at fault is on the bank and once a customer has notified the bank about the fraudulent transaction, from the date when he received communication from the bank, it is imperative for the bank to credit the amount involved in the unauthorised electronic banking transaction to the customer’s account”, the bench noted.

The court dismissed the bank’s defence that its security protocols were followed, calling it a “lame excuse” as such systems fail once a SIM is fraudulently replaced.

Referring to a similar ruling involving HDFC Bank, the bench said banks cannot avoid liability in cases where customers do not receive transaction alerts due to SIM swaps.

The court directed the bank to refund the remaining amount with 6% interest from the date of complaint within eight weeks, after adjusting the frozen sum.