SIM swap fraud and disputed banking transactions attracted zero customer liability under the RBI framework.

SIM swap fraud leading to unauthorised online banking transfers was treated as a disputed transaction under the RBI framework, because the police material showed impersonation, duplicate SIM issuance and OTP misuse. On that basis, the customer-protective zero-liability principle applied and the burden lay on the bank to disprove customer fault. The Court also stated that a bank cannot unilaterally debit the customer's account or shift the loss to the customer without establishing responsibility in appropriate civil proceedings. Amounts already debited could not be retained absent such proof, and the bank's remedy lay against the fraudsters.

---

---

Issues: (i) Whether SIM swap based unauthorised online banking transactions constituted disputed transactions attracting zero customer liability under the RBI circular. (ii) Whether the banks could debit the petitioners' accounts and shift the loss to them without establishing their responsibility through civil proceedings.

Issue (i): Whether SIM swap based unauthorised online banking transactions constituted disputed transactions attracting zero customer liability under the RBI circular.

Analysis: The transactions were found, on the police investigation placed before the Court, to have been carried out by fraudsters who obtained duplicate SIM cards by impersonation and used OTPs to gain access to the petitioners' online banking facilities. The Court treated such transactions as prima facie tainted by fraud and therefore as disputed transactions. The RBI circular on unauthorised electronic banking transactions was applied as a customer-protective regime in such cases, and the burden was held to lie on the bank to disprove the customer's lack of liability.

Conclusion: The transactions fell within the category of disputed transactions and attracted zero liability for the petitioners.

Issue (ii): Whether the banks could debit the petitioners' accounts and shift the loss to them without establishing their responsibility through civil proceedings.

Analysis: The Court held that a bank cannot unilaterally recover such loss from a customer once the transaction is shown to be disputed. The bank's remedy is to proceed against the fraudsters through civil court and establish the customer's responsibility, if any, in appropriate proceedings. Any debit already made from the petitioners' loan or deposit accounts, in the absence of such proof, could not be sustained.

Conclusion: The banks could not fasten liability on the petitioners or retain the debits without proving their case in civil proceedings.

Final Conclusion: The writ petitions were allowed in substance, the petitioners were held entitled to protection under the zero-liability principle, and the banks were directed to restore the amounts and pursue remedies against the wrongdoers in civil court.

Ratio Decidendi: Where online banking loss is prima facie established to have resulted from fraud by third parties through SIM swap and identity theft, the transaction is a disputed transaction under the RBI framework, the customer bears no liability absent proof of his complicity, and the bank's remedy lies against the fraudsters in civil proceedings.

---