Someone calls a person, claiming to be from the bank. The caller requests their name, is confident and states that their bank account will be deactivated unless they follow a rushed verification procedure.
The OTP is received by customer on his/her mobile phone. The caller asks for the number. It is a customer’s responsibility.
In just a few minutes, cash vanishes from the bank account.
When the customer comes to the bank for a refund, usually, the answer is that it was a valid OTP and the loss was due to the customer divulging confidential information.
However, does it automatically mean that the customer has to take the entire financial burden if an OTP is shared?
According to Indian banking regulations, it is dependent on how the fraud occurred, if the customer was responsible for the loss, if the bank did not meet security requirements and when the unauthorised transaction is reported.
Need Help With Your PhD or LLM Thesis?
Explore our thesis and dissertation writing support services for PhD and LLM students. Get subject-specific academic assistance for your research project.
Explore Our Services →In a recent Delhi High Court order, these questions have been discussed, such as when a user clicks on a fake link without having to provide an OTP directly.
The RBI rules do not mention anything about sharing of OTP.
The Reserve Bank of India has prescribed guidelines related to the liability of the customers in case of unauthorised transactions in electronic banking.
A customer may be liable if it is determined that such losses were caused by the customer’s negligence, such as disclosing private banking information to another party, under its July 6, 2017 circular.
OTP is one of these types of credentials.
The customer may be liable for the full loss of any transaction made before the fraud is reported to the bank, if the disclosure of the OTP to the fraudster results in a transaction.
But the important constraint is that there is one.
Under RBI rules, losses after the unauthorised transaction has been reported by the customer to the bank will be borne by the customer negligence bank.
Similarly, there is a similar distinction in the RBI’s Commercial Banks Responsible Business Conduct Directions, 2025.
This could make the reporting time critical when looked at in terms of who was responsible for the money being missing.
Notifications
+1
But sharing an OTP doesn’t automatically mean you are negligent?
Sharing an OTP to an unknown number is a sure sign of carelessness, especially from banks that, time and again are asking their customers to not share this information with any unknown number.
However, the bank has to look into the circumstances of the transaction.
A customer can claim that the transaction took place prior to the OTP disclosure, the code was not associated with the transaction or more withdrawals were made after notification to the bank.
There can also be disagreements as to whether the OTP has been handed out or acquired by using malicious software.
The RBI guidelines shift the responsibility burden to the bank in proving the customer’s liability.
Hence, the generation and delivery of the OTP to the registered mobile number does not answer all questions of the transactions.
All the records, correspondence with customers, transactions, and proof of any security breach can be pertinent.
Reserve Bank of India
Delhi High Court reviews ₹2.60 lakh cyber fraud case.Delhi High Court reviews ₹2.60 lakh cyber fraud case.
The Delhi High Court issued a significant judgment on May 29, 2026 in the case of State Bank of India v. Hare Ram Singh & Anr.
The controversy over the money concerned ₹2.60 lakh that had been debited from an SBI customer’s bank account in two unauthorized transactions during April 2021.
The customer had received a message with an unknown link. If he did not comply with the instructions, the message said, banking services may be suspended.
He took the plunge and clicked the link.
In a matter of moments, a sum of money was withdrawn from his account. The customer claimed that he never shared his OTPs with anyone.
SBI claimed that it had completed the transactions with proper internet banking details and OTP authentication.
In November 2024, one of the judges of the Delhi High Court had ordered SBI to pay ₹2.60 lakh with interest and litigation fees.
The bank appealed this decision.
So what did the Delhi High Court rule?
The Division Bench of Chief Justice Devendra Kumar Upadhyaya and Justice Tejas Karia has quashed the earlier order issued directing SBI to refund the money.
The judges clarified that the situation of customer negligence didn’t require that any person explicitly give an OTP or password.
Suspecting links may lead to user’s financial data being compromised, and may be considered negligence depending on the evidence.
It is contended that the Court should not have assumed that the failure of the security system at SBI was due to negligence in the absence of any technical examination.
It also mentioned that SBI had denied access to the internet banking facility after receipt of the complaint and thereafter no such unauthorised transaction was made by the customer.
The judgment did not require that any customers clicking on a suspicious link be found ineligible for a refund automatically. It emphasized that issues with malware, failed authentication and security systems at banks needed to be examined in line with evidence.
Indian Kanoon
What Does the “zero liability” Rule Mean?
RBI rules also take into account the cases where the customer should not be put to loss for unauthorised transactions.
In case of a loss owing to fraud, negligence or inadequacy of the bank, the customer shall be considered completely exempt from any liability within the framework in question.
The third scenario is when the transaction is a victim of a third-party break, neither the customer nor the bank was at fault.
In those instances the customer should have no liability if reported within three working days of the bank’s notification of the transaction.
Limited liability provisions are in effect in case of a report, made between four and seven working days.
However, such protections cannot be automatically transferred to a case where the customer caused the loss through his/her own negligence.
If the rules deem that a customer has been negligent, that negligence is not removed by the three-day reporting period.
Reserve Bank of India
What If Money is Withdrawn After the Bank is Informed?
Imagine a customer who provides an OTP and finds that his ₹40,000 has been deducted.
The customer calls the bank at once, informs them of the fraud and asks for the account to be closed.
Nevertheless, the bank receives the report and another ₹60,000 is deducted.
According to RBI’s customer-negligence rule, the customer could be held responsible for the first ₹40,000 if this disclosure led to that loss.
