A High Court has set aside a bank's rejection of a customer's complaint regarding an unauthorised UPI transaction, holding that the RBI's July 2017 circular on customer liability in unauthorised electronic banking transactions applies with equal force to UPI-based fraud, and that a bank cannot mechanically attribute the loss to customer negligence merely because a UPI PIN was entered to complete the transaction. The customer, Rohan Bhatia, lost a substantial sum after being induced through a phishing call to approve what he believed was a routine KYC-update request on his UPI app.
The Court held that the RBI framework distinguishes between transactions resulting from the customer's own negligence in sharing credentials for personal gain, and transactions resulting from social-engineering fraud where the customer was misled about the true nature of the transaction being authorised, a distinction the bank's internal grievance process had collapsed by treating any customer-side PIN entry as conclusive proof of negligence. Where the customer reports the fraud within the prescribent time window and there is no evidence of complicity, the RBI framework's limited or zero liability protections apply regardless of the specific authentication mechanism, whether PIN, OTP, or biometric, used to complete the fraudulent transaction.
The Court directed the bank to reprocess the complaint applying the correct liability framework, and observed that as digital payment fraud increasingly relies on inducing victims to authorise transactions themselves rather than stealing credentials outright, banks' internal grievance processes must be updated to actually examine the fraud mechanism rather than treating any customer-authenticated transaction as automatically the customer's fault.