Customer negligence in compromising digital credentials through suspicious links precludes bank liability for unauthorized transactions.

Respondent No. 1, a Professor of Computer Science, held a savings account with the Appellant-Bank. On 18.04.2021, an aggregate sum of ₹2,60,000/- was unauthorizedly withdrawn via Internet Banking (INB) following two transactions.

The Respondent had clicked a suspicious link received via SMS, after which Two-Factor Authentication (2FA) transactions were completed using OTPs sent to his registered mobile.

The Respondent reported the fraud promptly.

The Banking Ombudsman (BO-RBI) found the Respondent was a victim of "vishing" and held him partially negligent, directing the Bank to pay only one-third of the ₹1,00,000/- transaction (₹33,340/-).

The learned Single Judge set aside the BO-RBI order, directing the Bank to refund the full amount with interest, holding that the Bank failed to prove the customer shared OTPs and was thus deficient in service.

1. Whether the learned Single Judge was justified in exercising writ jurisdiction under Article 226 to determine disputed questions of fact regarding cyber fraud and customer negligence.

2. Whether the unauthorized transactions fell under the "Zero Liability" or "Limited Liability" framework of the RBI Circular dated 06.07.2017.

RBI Master Circular on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (2017): Clause 6 mandates "Zero Liability" for customers if the fraud is due to bank deficiency or third-party breaches where the customer notifies the bank within three days.

Clause 7(i) of the 2017 RBI Circular stipulates that if the loss is due to customer negligence, "such as where he has shared the payment credentials," the customer bears the entire loss until the fraud is reported.

Master Direction on Digital Payment Security Controls (2021) regarding minimum security standards.

Principle from London Joint Stock Bank Limited v. Macmillan and Arthur regarding a customer's duty to take reasonable precautions.

The Court observed that the Single Judge erred by assuming "negligence" under Clause 7(i) of the 2017 Circular is restricted only to the active sharing of OTPs.

It clarified that interacting with suspicious links despite bank advisories can constitute negligence, as it compromises the device and credentials.

The court noted that the transactions were secured by 2FA and successful logins occurred via the Respondent's specific User ID/Password.

Crucially, the court held that complex technical questions—such as whether the safety apparatus failed or if malware bypassed security—require forensic examination and evidence.

Such disputed factual matters are not suitable for summary determination in writ proceedings under Article 226.

The Bank’s immediate action in blocking the account upon notification further mitigated claims of deficiency.

The Court allowed the appeal and set aside the Impugned Judgment of the Single Judge, effectively upholding the closure of the complaint by the Banking Ombudsman.