Zero-liability protection for unauthorised digital transactions upheld where the bank failed to prove customer negligence.

Delhi territorial jurisdiction was upheld because the impugned Banking Ombudsman decision was passed in Delhi, the SBI Regional Office was located there, and part of the remittance trail linked to Delhi. On the merits, the Court applied the RBI framework on unauthorised electronic transactions and held that a customer who did not share OTPs or payment credentials fell within the zero-liability protection. The bank bore the burden to prove customer negligence and, having failed to act promptly to block, trace, or recover the funds, was found deficient in service and liable to reimburse the loss with interest and costs. The Banking Ombudsman's order was set aside for ignoring material facts and RBI directions.

---

---

Issues: (i) Whether the writ petition was maintainable before the Delhi High Court on the ground of territorial jurisdiction; (ii) whether the petitioner's loss from the unauthorised electronic transactions fell within zero liability and whether SBI was liable to reimburse the amount on account of deficiency in service; (iii) whether the Banking Ombudsman's order was sustainable.

Issue (i): Whether the writ petition was maintainable before the Delhi High Court on the ground of territorial jurisdiction.

Analysis: The cause of action was found to have substantial links with Delhi because the Banking Ombudsman passed the impugned decision at Delhi, the SBI Regional Office was located at Delhi, and part of the remittance trail also connected to Delhi. On these facts, the objection to territorial jurisdiction was rejected.

Conclusion: The writ petition was maintainable before the Delhi High Court.

Issue (ii): Whether the petitioner's loss from the unauthorised electronic transactions fell within zero liability and whether SBI was liable to reimburse the amount on account of deficiency in service.

Analysis: The Court held that the petitioner was a victim of phishing and vishing and had not shared his OTPs or payment credentials. Under the RBI circular on limiting customer liability for unauthorised electronic banking transactions, the burden to prove customer liability lay on the bank. The Court also relied on the RBI's digital payment security framework and the obligation of regulated entities to provide immediate fraud-reporting and corrective mechanisms. SBI's failure to act promptly, to block, trace, or recover the funds, and to secure the transaction environment was treated as a deficiency in service. The case was therefore treated as falling within the zero-liability framework rather than customer negligence.

Conclusion: The petitioner was held not liable for the loss, and SBI was held liable to reimburse the amount with interest and costs.

Issue (iii): Whether the Banking Ombudsman's order was sustainable.

Analysis: The impugned order was found to have ignored the material facts and the governing RBI directions, and the Banking Ombudsman was held to have misdirected itself in law.

Conclusion: The Banking Ombudsman's order was set aside.

Final Conclusion: The petition succeeded, the bank was directed to compensate the petitioner for the unauthorised debits with interest, and the impugned ombudsman decision was annulled.

Ratio Decidendi: In unauthorised electronic banking transactions, once the customer has not shared payment credentials and the bank fails to prove customer negligence, the bank bears the burden of loss and must act promptly under the RBI's customer-protection and digital-security framework.

---