Private banks are liable for unauthorized transactions absent proof of customer negligence under RBI guidelines.

The Petitioner, a senior citizen and freelancer, maintained savings and current accounts with HDFC Bank (Respondent No. 3).

On July 14, 2021, unknown fraudsters added three beneficiaries to his accounts and enhanced the daily net-banking transfer limit from Rs. 4,00,000 to Rs. 40,00,000

On July 15, 2021, a sum of Rs. 38,04,000 was unauthorizedly withdrawn through eight transactions within 41 minutes

The Petitioner alleged that he never received One-Time Passwords (OTPs) for beneficiary addition or limit enhancement

HDFC Bank refused to reverse the debits, claiming the transactions were authenticated via OTPs and the Petitioner must have compromised his credentials

The Banking Ombudsman closed the Petitioner’s complaint, finding no deficiency in service

BSNL (Respondent No. 5) filed an affidavit revealing that the Petitioner’s SIM card had been "swapped" four times in four days between July 12 and 15, 2021, using forged documents and impersonation at various service centers

Article 226 of the Constitution of India regarding the High Court's power to issue writs to any person or authority for the enforcement of rights

Section 35A of the Banking Regulation Act, 1949, which empowers the RBI to issue binding directions in the public interest

RBI Circular “Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions” (July 6, 2017), which establishes "Zero Liability" for customers in cases of third-party breaches where the customer notifies the bank within three working days

the "function test" from S. Shobha v. Muthoot Finance Ltd.

principles from Federal Bank Ltd. v. Sagar Thomas, distinguishing between purely private contracts and duties involving a public law element

while HDFC is a private entity and not "State" under Article 12, it is a scheduled bank operating under the regulatory control of the RBI.

Since the RBI issued the 2017 Circular under Section 35A in the "public interest" to protect customers in the digital ecosystem, the enforcement of these mandatory guidelines involves a public law element, making the bank's refusal to comply amenable to writ jurisdiction

under the 2017 Circular, the burden of proof lies solely on the bank to establish customer negligence

The BSNL evidence of "SIM Swapping" confirmed that the Petitioner’s mobile signal was intercepted by fraudsters; thus, any OTPs sent by the bank were received by the cloned SIM, not the Petitioner

the bank's own internal logs showed that the transactions originated from IP addresses in Chennai, whereas the Petitioner’s genuine transactions originated from Pune

The court found that the bank failed to prove the Petitioner shared his password or acted negligently, and the fraud occurred due to a system breach elsewhere

It held that the Petitioner was a victim of cyber fraud with "Zero Liability" under the RBI Circular dated July 6, 2017, as he reported the fraud promptly and no negligence was proven against him

The High Court directed HDFC Bank to remit Rs. 38,04,000 to the Petitioner’s account within eight weeks, along with interest at 6% per annum from the date of the unauthorized transactions

Failure to remit within the stipulated time would attract an enhanced interest rate of 8% per annum