Courts order banks to refund victims of unauthorised transfers

What the Record Shows

A consistent line of Indian courts and consumer forums has, over 2024 to 2026, ordered banks to return money taken from customers in unauthorised electronic transactions, applying the Reserve Bank of India's circular dated 6 July 2017 on limiting customer liability. The circular, numbered RBI/2017-18/15 (DBR.No.Leg.BC.78/09.07.005/2017-18), fixes two propositions that these decisions treat as settled: the burden of proving a customer's negligence lies on the bank, and a customer who reports an unauthorised transaction within three working days bears zero liability for a third-party breach.

In the leading decision, the Bombay High Court, in Jaiprakash Kulkarni v. The Banking Ombudsman (Writ Petition No. 1150 of 2023, neutral citation 2024:BHC-OS:8627-DB), on 13 June 2024 quashed the Banking Ombudsman's rejection and directed Bank of Baroda to refund Rs 76,90,017 within six weeks, with interest at 6 per cent from 2 October 2022. The court recorded that beneficiaries were added and transfers executed on a corporate account without any SMS or email alert reaching the registered contact details, and held the customer bore zero liability.

Three further forums reached the same result on different facts. The Gauhati High Court, in State Bank of India v. Pallabh Bhowmick (WA/364/2022), on 13 September 2024 dismissed the bank's appeal and upheld a refund of Rs 94,204.80. The Madras High Court, in Bhushan Goyal v. The Banking Ombudsman (W.P. No. 28100 of 2022), on 23 September 2025 directed Indian Bank to restore Rs 7,50,085, with liberty to recover from the identified offenders. And the National Consumer Disputes Redressal Commission (NCDRC), in State Bank of India v. Prodosh Kumar Banerjee (Second Appeal No. 540 of 2025), on 15 April 2026 dismissed the bank's appeal and confirmed a re-credit of Rs 1,99,000 with Rs 25,000 compensation.

How It Worked

The framework these decisions apply is the RBI circular's tiered liability scheme. Where the loss arises from a bank's own fault, or from a third-party breach that the customer reports within three working days, the customer's liability is zero and the bank must re-credit the amount. For reports made within four to seven working days, liability is capped by account type, ranging up to Rs 25,000 for a premium account. Beyond seven working days, the outcome follows the bank's board-approved policy. Crucially, the circular places the burden of proving customer negligence on the bank, so a bank that cannot show the customer shared credentials or otherwise failed to protect them must bear the loss.

The four matters illustrate the recovery side of very different frauds, each described here as the record sets it out. In Kulkarni, per the judgment, additions of beneficiaries and outward transfers ran on a corporate current account without the alerts that would have let the customer react. In Bhowmick, the court recorded that the customer was induced by what appeared to be a customer-care call to download a malicious application, after which his savings account was debited in October 2021. In Goyal, per the record, a duplicate SIM was issued in 2016 and a debit of Rs 7,50,085 followed, the classic pattern of a SIM-swap, with the bank pleading that the customer had shared an OTP. In Banerjee, the consumer had downloaded a fraudulent application and money was debited, yet he recovered because he reported the loss promptly, which the forum held defeated the bank's plea of negligence.

Across all four, the common thread is procedural: the customer told the bank quickly, the bank sought to deny liability by alleging negligence, and the forum held that the bank had not discharged the burden the RBI circular places on it.

Who Lost Money

The people at the centre of these cases are ordinary account holders and a small business, precisely the customers the criminal process rarely makes whole. The individual sums were substantial for those who lost them, from just under a lakh in Bhowmick to nearly Rs 77 lakh from the corporate account in Kulkarni. In each case the money had already left the account by the time the dispute began; what the forums ordered was its restoration by the bank, not its recovery from the perpetrators.

That distinction matters. Catching the person who operated a mule account or issued a duplicate SIM is a separate, slower and often unsuccessful exercise. These decisions gave the victims their money back from the bank first, leaving the bank to pursue the offenders, an approach the Madras High Court made explicit by granting Indian Bank liberty to recover from those identified. For the customer, the practical effect is that recovery does not wait on a criminal outcome.

Where It Stands Now

The Kulkarni direction required Bank of Baroda to pay within six weeks with interest from October 2022. The Bhowmick line has hardened further: after the Gauhati High Court dismissed the bank's appeal, the Supreme Court dismissed the bank's Special Leave Petition (SLP (C) No. 30677/2024), leaving the High Court's refund order final. The Madras High Court's direction in Goyal required restoration within four weeks, and the NCDRC's order in Banerjee, the most recent, added compensation of Rs 25,000 and interest on any delay beyond four weeks.

The RBI circular of 6 July 2017 remains the operative framework, and the official notification shows no superseding amendment. Because these are directions to institutional litigants to refund customers, and not findings of criminal conduct against any bank or individual, they carry no question of anyone's guilt; they are civil and regulatory determinations of where the loss must fall under the RBI's rules.

What It Means

For a customer, the single most valuable takeaway from this line of authority is the three-working-day rule. Reporting an unauthorised debit to the bank in writing within three working days of noticing it engages zero liability for a third-party breach, and, as Banerjee shows, prompt reporting can secure a refund even where the customer was tricked into downloading a fraudulent application. Keeping the dated acknowledgement of that report is what later shifts the burden onto the bank.

The escalation path is also settled. A customer whose bank refuses a refund can approach the RBI's Ombudsman scheme, and, failing that, a consumer forum or a writ court, as each of these litigants did. None of this is investment advice or a guarantee of any outcome; it is a description of how an existing protection has been applied. Readers can follow related regulatory actions through the enforcement archive and reports such as UP RERA's de-registration of Ansal API projects and the NCLAT ruling in the Wave Megacity insolvency.

FAQ

Do banks have to refund unauthorised electronic transactions?

Per the RBI circular dated 6 July 2017, a customer bears zero liability for a third-party breach that is reported within three working days, and the burden of proving customer negligence lies on the bank. As the Bombay, Gauhati and Madras High Courts and the NCDRC have held, a bank that cannot discharge that burden must re-credit the amount.

What is the three-working-day rule?

The RBI circular provides that if a customer notifies the bank within three working days of a communication about an unauthorised transaction, the customer's liability is zero for a third-party breach. For reports within four to seven working days, liability is capped by account type; beyond that, the bank's board-approved policy applies.

Who has to prove that the customer was negligent?

The bank. The RBI circular expressly states that the burden of proving customer liability in an unauthorised electronic banking transaction lies on the bank. In the reported decisions, banks that alleged negligence, such as OTP sharing, but could not establish it were ordered to refund.

I downloaded a fraudulent app. Can I still recover?

Possibly. In the NCDRC's Banerjee decision, the customer had downloaded a fraudulent application yet recovered, because he reported the loss promptly and the forum held the bank had not proved negligence. Prompt reporting is central; the outcome turns on the facts of each case.

How do I report and escalate a disputed debit?

Notify your bank in writing or by email as soon as you notice the debit, ideally within three working days, and keep the acknowledgement. If the bank refuses relief, you can approach the RBI's Ombudsman scheme, and thereafter a consumer forum or a High Court, as the customers in these cases did.

Where can I read the official record?

The RBI circular and the four decisions are on the public record. The circular is on rbi.org.in, and the judgments are reported on Indian Kanoon.

This report is based on the RBI circular dated 6 July 2017, the Bombay High Court judgment in Jaiprakash Kulkarni v. Banking Ombudsman and the NCDRC order in State Bank of India v. Prodosh Kumar Banerjee, reviewed on 30 July 2026.