The Bombay High Court has ruled that HDFC Bank must refund Rs 38 lakh to a Pune businessman who fell victim to cyber fraud, emphasising the bank's responsibility in protecting customers from unauthorised online transactions and SIM swapping scams.
Key Points
- Bombay High Court orders HDFC Bank to refund Rs 38 lakh to a businessman defrauded via unauthorised online transactions.
- The court cited the businessman's lack of fault and relied on RBI guidelines regarding customer protection in electronic banking transactions.
- The fraud involved SIM swapping, where fraudsters duplicated the user's mobile number to gain access to OTPs.
- The court emphasised that the burden of proving customer negligence lies with the bank, and prompt reporting of fraud entitles the customer to zero liability.
- HDFC Bank is directed to refund the amount with interest, highlighting the importance of bank security measures and customer protection against cybercrime.
The Bombay High Court has ordered HDFC Bank to refund Rs 38 lakh to a Pune-based businessman, who lost the amount to a digital fraud, observing that the account holder was not at fault.
A bench of Justices Bharti Dangre and Manjusha Deshpande, in its order of April 6, held that account holder Subodh Korde was entitled to zero liability under guidelines issued by Reserve Bank of India (RBI) as the online transactions transferring money from his account to beneficiaries added unauthorizedly were not initiated by him.
Korde lost the amount through eight unauthorized online transactions executed within just 40 minutes on July 15, 2021. The fraud was preceded by the addition of three unknown beneficiaries and a sudden increase in his transaction limit from Rs 4 lakh to Rs 40 lakh a day earlier.
Korde claimed he had not authorised the transactions, nor had he received OTPs. However, the bank denied liability claiming it had sent OTPs and intimation messages to the account holder.
The HC, in its order, relied on a police investigation report which clearly stated that Korde had not received any messages from the bank.
The man had claimed he was facing network issues on his SIM card at the time.
Interestingly, BSNL, the petitioner's network provider, confirmed that Korde's SIM card had been swapped fraudulently multiple times between July 12 and July 15, 2021.
SIM Swapping and Fraudulent Transactions
The court noted it was a "clear case of SIM swapping", where fraudsters gain access to OTPs by duplicating a user's mobile number.
"This is precisely the methodology adopted. The petitioner did not receive any OTP as the SIM card was cloned," the court noted.
RBI Guidelines and Customer Protection
Relying on the RBI's July 6, 2017 circular on 'Customer Protection - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions', the HC said, "The burden to prove customer negligence lies on the bank. If a customer is not at fault and reports promptly, the liability is zero."
The court pointed out that Korde had acted swiftly after learning about fraudulent transactions from his account.
The court directed HDFC Bank to refund Rs 38.04 lakh within eight weeks with 6 per cent annual interest, which would increase to 8 per cent in case of delay.
© 2026