Unauthorized UPI Withdrawals: SBI Faulted for Non-Compliance With RBI Guidelines by Chandigarh Commission
Pranav B Prem
The District Consumer Disputes Redressal Commission, Chandigarh, presided over by Amrinder Singh Sidhu (President) and B.M. Sharma (Member), has held the State Bank of India (SBI) liable for deficiency in service after it failed to reverse unauthorized UPI withdrawals from a customer’s account and did not comply with mandatory RBI guidelines relating to electronic banking fraud.
The complaint was filed by Sanjeev Kumar Sharma, who held a savings account with SBI’s High Court Branch. On 21 July 2021, at around 2:50 PM, he received alerts showing five unauthorized UPI transactions—₹25,060, ₹25,060, ₹25,060, ₹24,560 and ₹200—totalling ₹99,940, debited from his account. The complainant immediately blocked his account and mobile number and reported the matter on the same day to the Cyber Crime Investigation Cell, Sector 9, Chandigarh. He then lodged written complaints with SBI and also approached the Reserve Bank of India (RBI) the very next day. Although SBI initially assured him that the amount would be refunded after approval from the head office, no resolution was provided despite repeated follow-ups, including a reminder dated 9 February 2022.
SBI, in its written statement, claimed that all five disputed transactions were executed through the UPI mode, where no OTP is required and payment is authenticated solely through the customer’s confidential UPI PIN. It argued that the complainant must have either personally carried out the transactions, shared his UPI PIN, or failed to maintain its secrecy. SBI maintained that it bore no liability because the transactions were validated through the customer’s PIN and registered mobile number. RBI, made a party to the complaint, was later removed from the proceedings as withdrawn.
The Commission examined the evidence and found that the complainant had promptly reported the unauthorized transactions to both the Cyber Cell and the bank, which SBI did not dispute. The Commission noted that the RBI Circular dated 6 July 2017, titled Customer Protection – Limiting Liability of Customers in Unauthorized Electronic Banking Transactions, clearly places the burden of proving customer negligence on the bank once the customer reports an unauthorized transaction within the prescribed time. SBI failed to produce any evidence showing that the complainant had shared his UPI PIN or had otherwise contributed to the fraudulent debits. Instead, the bank relied solely on conjecture.
The Commission held that SBI violated the mandatory RBI requirement to credit back the disputed amount within ten working days of receiving the complaint and to complete its investigation within ninety days. Its failure to take timely action and refusal to refund the amount constituted clear deficiency in service, especially when the complainant had acted diligently and without delay.
The Commission also relied on precedents, including the Bombay High Court’s ruling in Jaiprakash Kulkarni & Pharma Search Ayurveda Pvt. Ltd., where the Court held that customers have zero liability for third-party fraud not attributable to the bank or customer. It further referred to decisions from the National Consumer Commission and the Chandigarh State Commission, which consistently held banks accountable for unauthorized electronic transactions when customers promptly report them.
Finding SBI guilty of deficiency in service, the Commission directed the bank to refund the entire amount of ₹99,940, along with interest at 9% per annum from the date of unauthorized deduction (21 July 2021) until realization. SBI was also ordered to pay ₹10,000 towards compensation for mental harassment and litigation expenses. The bank must comply with the order within 45 days from the date of receiving the certified copy.
Cause Title: Sanjeev Kumar Sharma Vs. SBI & Others
Case No: DC/AB1/44/CC/359/2023
Coram: Amrinder Singh Sidhu (President), B.M. Sharma (Member)
