Woman loses Rs 5.44 lakh after ‘sharing’ mobile screen with fraudsters, bank to refund

Holding that in online fraud cases, the mere fact that OTPs or other credentials were shared by the victim cannot conclusively establish “voluntary authorisation”, a Delhi District Consumer Commission has asked the bank to pay the complainant the unrecovered amount of Rs 4.14 lakh.

The commission also awarded Rs 1 lakh as compensation towards mental agony, harassment and inconvenience suffered by her.

A bench of president Poonam Chaudhary and member Bariq Ahmad ruled that the fact that the transactions were authenticated through the customer’s credentials does not, by itself, establish that the transactions were voluntarily authorised by the complainant.

“An electronic transaction may be authenticated through credentials which have been obtained, disclosed or compromised as a consequence of fraudulent inducement. Therefore, authentication and authorisation cannot, in every case, be treated as synonymous,” it held.

The commission said that the bank has not produced any material demonstrating that the complainant consciously and voluntarily instructed the bank to transfer the disputed amounts to the beneficiaries.

Pointing out that the bank has relied heavily upon the fact that the complainant interacted with the alleged fraudsters and shared her mobile screen, the ruling said, “The mere fact that OTPs or other credentials were used cannot conclusively establish voluntary authorisation.”

The commission empathised with the woman and said that such conduct may constitute negligence for the purpose of examining customer liability under the applicable RBI framework. However, the bank cannot stop at merely establishing that the customer interacted with fraudsters.

Story continues below this ad

The order stated that even where customer negligence is established, the framework provides that the customer’s liability extends only until the unauthorised 14th transaction is reported to the bank, and that loss occurring after such reporting is to be borne by the bank.

Rs 5.44 lakh debited fraudulently

In April 2024, two unauthorised transactions of Rs 5 lakh and Rs 44,488 were made from the complainant’s account. She stated that he immediately reported the matter to the cybercrime helpline and lodged a formal complaint. She also approached the nearest branch of the bank and requested immediate assistance for blocking the account.

However, she alleged that the branch officials failed to provide timely assistance and directed the complainant to approach his particular branch. According to him, by the time he reached the branch, a total of Rs 5.44 lakh had been debited from his account. The complainant stated that despite repeated follow-ups, only Rs 1.30 lakh had been held and recovered. The remaining amount of Rs 4.14 lakh has not been refunded.

She alleged that, even after April 7, 2024, and April 8, 2024, fraudulent incidents and unauthorised transactions occurred and continued thereafter due to the alleged failure of the bank to take timely and appropriate steps upon being informed of the fraud. She claimed that the bank failed to take prompt and effective action upon being informed of the fraudulent transactions and the complainant’s request to block the account.

Story continues below this ad

She interacted with fraudsters: Bank

The bank contended that the complainant had compromised her confidential credentials and the transactions were completed through the prescribed authentication mechanism.

It was argued that she interacted with the alleged fraudsters and shared her mobile screen with them. The disputed transactions were allegedly authenticated through the requisite banking credentials and OTPs.

It is further contended that the bank had provided requisite security mechanisms and transaction alerts and blocked the account immediately upon receiving the complaint.

Bank failed to establish security safeguards

The commission said that the bank has not placed sufficient material on record to demonstrate the precise safeguards triggered in relation to the beneficiary addition and subsequent transfer, including whether any applicable transaction limits, cooling-off periods, fraud alerts or risk controls were activated.

Story continues below this ad

“Banking institutions providing electronic banking facilities are expected to maintain appropriate security mechanisms and fraud-monitoring systems,” the ruling observed.

The commission said that when a customer disputes a transaction as fraudulent and promptly reports the same, the bank is required to examine the transaction comprehensively rather than merely relying upon successful credential authentication.

Rejecting the bank’s argument that this cannot be adjudicated in summary consumer proceedings, the order said that the mere existence of a cybercrime investigation does not automatically oust the jurisdiction of the consumer commission.

Takeaway

This judgment establishes that OTPs do not equate to voluntary customer authorisation in cyber fraud. When fraud is promptly reported, banks cannot automatically shift losses onto customers without producing complete audit trails, device logs, and proof of active fraud-mitigation controls.

Story continues below this ad

Consumers facing similar grievances may contact the consumer helpline in their respective states (Delhi helpline: 011-23379146) or dial the National Consumer Helpline at 1915 for assistance.

Do not miss out on these stories: 

Kolkata man wins Rs 65,000 payout after sharing OTP on fraud call, losing Rs 41,000

Man loses Rs 1.64 lakh in online ‘fraud’, bank ordered to refund amount, pay Rs 25,000

Bank fails to act after woman flags ‘cyber fraud’ in account, she wins Rs 1 lakh payout