Bank bears the burden of proving customer negligence to avoid liability for unauthorized electronic transactions.

The petitioner’s daughter, the proforma respondent, held an add-on credit card issued by Axis Bank (Respondent No. 2).

On October 20, 2024, while in Dublin, Ireland, her card was stolen, and two unauthorized transactions of 1,000 Euros each were executed at 22:48 and 22:49 IST

She lodged a police complaint the same day, and the petitioner reported the fraud to the bank within 24 hours on October 21, 2024

Respondent No. 2 rejected the claim, alleging the transactions occurred because the holder divulged the card and PIN numbers

The petitioner appealed to the RBI Ombudsman (Respondent No. 1), who closed the complaint under Clause 16(2)(a) of the RBI Integrated Ombudsman Scheme, 2021, without providing reasons

The petitioner challenged these decisions via a writ petition

The court primarily applied the Reserve Bank of India Circular dated July 6, 2017, regarding "Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions"

Specifically, it relied on Clause 6, which establishes "Zero Liability" for customers in cases of third-party breaches reported within three working days, and Clause 12, which mandates that the burden of proving customer liability lies solely on the bank

The court also considered Clause 9 regarding the timeline for reversal of funds

Clause 16(2)(a) of the Reserve Bank of India-Integrated Ombudsman Scheme, 2021

The court further cited the precedent of State Bank of India v. Pallabh Bhowmick (2024 SCC OnLine Gau 1519), affirming that banks cannot absolve themselves of liability based on perceived negligence without concrete proof

The court found that the petitioner reported the unauthorized transactions within 24 hours, fulfilling the criteria for "Zero Liability" under the 2017 RBI Circular

It observed that the bank failed to produce any evidence proving negligence or that the cardholder had shared credentials; the bank's mere assertion that a card without PIN/OTP requires "extra caution" was insufficient to meet the burden of proof under Clause 12

The court noted that since the card was stolen and immediate police and bank reports were made, the incident fell under "third-party breach" where the deficiency lies elsewhere in the system

Furthermore, the RBI Ombudsman’s order was found to be arbitrary as it closed the complaint without assigning reasons or addressing the petitioner's rejoinder

The court determined that the bank had a duty to exercise reasonable care and reverse the unauthorized charges once reported within the prescribed timeframe

It held that the bank failed to establish customer negligence and disregarded the mandatory "Zero Liability" protections afforded by the RBI Circular

Respondent No. 2 (Axis Bank) was directed to forthwith refund the amount of the fraudulent electronic transactions dated October 20, 2024, along with any associated charges, to the petitioner’s account