Tilak Shankar Mazumder vs Office Of R.B.I. Ombudsman, Reserve Bank Of Inda & Anr

Krishna Rao, J

The petitioner has filed the present writ application challenging the impugned order dated 29th January, 2025, passed by the respondent no.1 wherein the complaint made by the petitioner was treated as, dealt with and closed under Clause 16(2)(a) of the Reserve Bank of India-Integrated Ombudsman Scheme, 2021.

The proforma respondent is the daughter of the petitioner and the holder of add-on credit card with the petitioner's credit card. In the month of October, 2024, the daughter of the petitioner visited Dublin, Ireland as a tourist. The daughter of the petitioner had a Citi Bank credit card, which is now an Axis Bank credit card, ending with card No. 1045, which was an add-on card to the petitioner's credit card. On 20th October, 2024, when the daughter of petitioner was on trip to Dublin, Ireland, she realized that her credit card has been stolen and immediately, she received two successive e-mails from the Axis Bank Limited about the use of credit card for two transactions of 1,000 Euros each at a store in Dublin at 22:48 IST and 22:49 IST respectively. Immediately, the daughter of the petitioner made a complaint to the concerned police station on 20th October, 2024. The petitioner has also lodged a complaint to the respondent no.2 on 21st October, 2024, about the said transactions and the respondent no.2 has acknowledged the said complaint. On 23rd October, 2024, the respondent no.2 registered the said complaint formally. The respondent no.2 also requested the petitioner to provide the details of the last four digits of the credit card number and the same was provided by the petitioner to the respondent no.2. On 25th October, 2024, the daughter of the petitioner also sent a detailed email of the incident to the respondent no.2. On 30th October, 2024, the respondent no.2 closed the complaint of the petitioner without assigning any reason.

The respondent no.2 by an email dated 7th December, 2024, casts an aspersion upon the petitioner alleging that the fraudulent transactions in question could not have been done unless the credit card holder had divulged the credit card number and PIN number to a third party. The daughter of the petitioner protested against the said allegation by an email dated 13th December, 2024 but on the same day, the respondent no.2 rejected the objection raised by the daughter of the petitioner.

The petitioner being aggrieved with the decision of the respondent no.2 made a complaint to the respondent no.1 on 16th December, 2024 and the respondent no.2 has also filed a reply before the respondent no.1 which was communicated to the petitioner by a communication dated 24th January, 2025. The petitioner has submitted a rejoinder to the allegation to the respondent no.1 and on 29th January, 2025, the respondent no.1 passed the impugned order dismissing the complaint of the petitioner without assigning any reason.

Mr. Sourojit Dasgupta, Learned Advocate representing the petitioner submits that the respondent no.1 has closed the complaint of the petitioner without assigning any reasons and only on the pretext that the petitioner has not furnished any additional points in response to the reply submitted by the respondent no. 2.

Mr. Dasgupta submits that the respondent no.1 has no authority to dismiss the complaint of the petitioner by invoking Clause 16(2)(a) of the Reserve Bank of India- Integrated Ombudsman Scheme, 2021, as the said provision is not applicable in the facts and circumstance of the case of the petitioner.

Mr. Dasgupta submits that the petitioner has informed about the fraudulent use of credit card of the petitioner within 24 hours of the fraudulent transactions. He submits that add-on credit card of the daughter of the petitioner was stolen, thus the petitioner did not have any liability in relation to the fraudulent transaction. There is no negligence on the part of the petitioner or on the part of the daughter of the petitioner.

Mr. Dasgupta submits that while rejecting the complaint of the petitioner, the respondent no.1 did not follow the guidelines of the Reserve Bank of India dated 6th July, 2017.

Mr. Dasgupta has relied upon the judgment in the case of Hare Ram Singh Vs. Reserve Bank of India and Others reported in 2024 SCC OnLine Del 8039 and submits that the bank cannot refuse to process an online transfer if it appears to be authorized by the customer and upon detecting fraud, the bank has an implied duty to exercise reasonable care and take prompt action.

Mr. Dasgupta further relied upon the judgment in the case of State Bank of India, rep. by Asstt. General Manager Vs. Pallabh Bhowmick and Others reported in 2024 SCC OnLine Gau 1519 and submits that the banks cannot absolve themselves of the liability towards losses suffered by the customers on account of unauthorized electronic transactions based on perceived negligence of the customers. He submits that the judgement passed by the Hon'ble Division Bench of Guwahati High Court is affirmed by the Hon'ble Supreme Court.

Ms. Sayani Roy Choudhury, Learned Advocate representing the respondent no.2 submits that immediately on receipt of complaint of the alleged fraudulent transfer of fund from the account of the petitioner through the add-on credit card, the respondent bank blocked the card of the petitioner. She submits that there is no deficiency of service on the part of the respondent bank.

Ms. Roy Choudhury submits that on receipt of complaint from the petitioner, the bank conducted matching of the transactions of the account of the petitioner and the matching cannot prove, who has used the card.

Ms. Roy Choudhury submits that the case of the petitioner is covered under Clause 7(i) of the guidelines dated 6th July, 2017, as the said transactions have been done on the negligence of the petitioner and his daughter, and there is no negligence or deficiency of service on the part of the bank.

Ms. Roy Choudhury submits that the credit card is without OTP and the petitioner or his daughter have never approached for OTP facilities in their add-on credit card, thus the bank has no responsibility with regard to the alleged fraudulent transaction.

Ms. Roy Choudhury submits that the daughter of the petitioner initiated a criminal case with regard to the alleged fraudulent transactions, the case is still pending and unless and until it is decided who is at fault for the said transactions, the bank cannot be held liable for the said transactions.

The issue in the present case whether the decision of the respondent no.1 and respondent no.2 by rejecting the complaint of the petitioner, is legal or is liable to be interfered with.

There is no dispute with regard to receipt of two successive emails by the daughter of the petitioner from the respondent no.2 that her credit card has been used for two transactions of 1,000 Euros each at a store in Dublin at 22:48 IST and 22:49 IST, respectively. It is also not in dispute that immediately the credit card was blocked and within 24 hours the petitioner registered a complaint with the respondent no.2 on 21st October, 2024.

The stand taken by the respondents that the credit card which requires no PIN, neither OTP to be used with extra caution. The petitioner had two other cards from the State Bank of India and ICICI Bank, those cards could not be used by any unauthorized persons as the permission for their use was in disabled mode, thus the unauthorized transactions on the stolen card of the respondent bank cannot be a liability of the bank.

The petitioner as well as the respondent bank relied upon the standing circular of the Reserve Bank of India dated 6th July, 2017, which lays down certain guidelines for the customers' protection limiting liability of the customers in case of unauthorized electronic banking transactions. The petitioner has relied upon Clauses 6, 9 and 12 which reads as follows:

"Limited Liability of a Customer

(a) Zero Liability of a Customer

A customer's entitlement to zero liability shall arise where the unauthorized transaction occurs in the following events:

(i) Contributory fraud/negligence/deficiency on the part of the bank (irrespective of whether or not the transaction is reported by the customer).

(ii) Third party breach where the deficiency lies neither with the bank nor with the customer but lies elsewhere in the system, and the customer notifies the bank within three working days of receiving the communication from the bank regarding the unauthorized transaction.

Reversal Timeline for Zero Liability/ Limited Liability of customer

On being notified by the customer, the bank shall credit (shadow reversal) the amount involved in the unauthorized electronic transaction to the customer's account within 10 working days from the date of such notification by the customer (without waiting for settlement of insurance claim, if any). Banks may also at their discretion decide to waive off any customer liability in case of unauthorised electronic banking transactions even in cases of customer negligence. The credit shall be value dated to be as of the date of the unauthorised transaction.

Burden of Proof

The burden of proving customer liability in case of unauthorised electronic banking transaction shall lie on the bank."

The respondent bank issued credit card to the petitioner with add-on facilities to the petitioner without any PIN or OTP. The respondent bank has not placed any documents or evidence to show that if the credit card is issued without any PIN or OTP facilities, the liability is upon the card holder for any fraudulent transactions is made by using the said card. It is true that the customer should be cautious while using credit card facilities either it is with or without OTP or PIN facilities, but in the present case, it is the specific case of the petitioner that the credit card was stolen and used for fraudulent transactions and immediately when the petitioner received about the intimation about the fraudulent transactions, the petitioner made complaint to the bank and bank has blocked the card. It is not the case of the bank that the petitioner has made a false complaint to the concerned police authorities with regard to theft of the credit card and concocted a false story and no fraudulent transaction was made. The documents which the petitioner has relied upon, reveals that within 24 hours of the incident, the petitioner has made a complaint to the bank and the bank has acknowledged the same.

In the case of State Bank of India, rep. by Asstt. General Manager (supra), the Hon'ble Division Bench of the Gauhati High Court interpreted Clause 9 of the circular dated 6th July, 2017 as follows:

"36. Clause 9 deals with reversal timeline of zero liability/limited liability of customers in case of unauthorized electronic banking transaction, it would be the discretion of the bank to waive off any customer liability even in case of negligence of the customer. On a reading of the above clauses, it can be inferred that in case of un-authorized electronic transactions the Bank would have a duty to reverse the payment and credit the amount involved in the un-authorized transaction within a time frame, provided the fraudulent transaction is reported by the Customer within the time frame provided in the Circular. In an appropriate case, even the negligence, if any, on the part of the customer, can be waived by the Bank."

The respondent bank relied upon Clause 7(i) of the said Circular which reads as follows:

"7. A customer shall be liable for the losso ccurring due to unauthorized transactions in the following cases:

(i) In cases where the loss is due to negligence by a customer, such as where he has shared the payment credentials, the customer will bear the entire loss until he reports the unauthorized transaction to the bank. Any loss occurring after the reporting of the unauthorized transaction shall be borne by the bank."

The respondent bank failed to bring any documents to establish that the loss is due to negligence of the petitioner. The only contention made by the respondent bank is that the credit card, which requires no PIN or OTP to be used, must have been put on extra caution. It is the specific case of the petitioner that the credit card was stolen and used for unauthorized transactions and police complaint was also made. The bank has not proved that the said complaint is false or at no point of time, the card was stolen or any unauthorized transaction was made.

Clause 8 of the Circular deals with third party breaches, where the deficiency lies neither with the bank nor with the customer but lies elsewhere in the system. By a plain reading of Clause 8, it appears that in case of unauthorized electronic banking transaction occurred due to third party breaches i.e. where the deficiency neither lies with the customer or the bank, the customer liability is "Zero" if the fraudulent transaction is reported within 3 (three) days from the date on which the customer receives the communication.

Clause 12 of the Circular provides for burden of proof. As per the said clause, the burden of proving customer liability in case of unauthorized electronic banking transactions shall lie on the bank.

In the present case, there was two unauthorized electronic transactions on 20th October, 2024, at 22:48 IST and 22:49 IST and immediately the same was informed to the bank and within 24 hours, the petitioner has made complaint to the bank but except blocking the card, the bank has not taken any steps and rejected the complaint of the petitioner. The respondent no.1 by the impugned order dated 29th January, 2025, closed the complaint of the petitioner only on the ground that the petitioner has not submitted any additional points to the reply of the respondent no.1.

This Court finds that the respondents failed to establish that the unauthorized electronic transactions were made due to the negligence of the petitioner. The respondents failed to consider the complaint of the petitioner with regard to unauthorized electronic transactions in accordance with the Circular dated 6th July, 2017.

In view of the above, the impugned orders dated 29th January, 2025, passed by the respondent no. 1 and 7th December, 2024, by the respondent no. 2 are set aside and quashed. The respondent no.2 is directed to refund the amount of fraudulent electronic transactions dated 20th October, 2024, along with charges in the account of the petitioner forthwith.

WPO No. 260 of 2025 is allowed.