Synopsis

The petitioner, a 61‑year‑old freelance consultant, lost Rs. 38,04,000 from his two HDFC Bank accounts through eight unauthorised online transactions within 41 minutes. The fraud was executed through SIM swapping – his BSNL mobile SIM was replaced four times between 12th and 15th July 2021 without his knowledge, enabling fraudsters to receive OTPs. HDFC Bank denied liability, claiming OTPs were sent and the petitioner was negligent. The Banking Ombudsman closed the complaint under Clause 16(2)(a) of the RBI Integrated Ombudsman Scheme, 2021. The Bombay High Court held that: (a) a writ petition under Article 226 is maintainable against a private scheduled bank for violation of RBI circulars issued under Section 35A of the Banking Regulation Act, 1949; (b) the petitioner is entitled to zero liability under the RBI Circular dated 6th July 2017 because the deficiency lay with a third party (BSNL’s SIM swap) and not with the bank or the customer; and (c) the bank failed to discharge its burden of proving customer negligence. The court directed HDFC Bank to refund Rs. 38,04,000 with interest at 6% per annum (8% if delayed beyond eight weeks).

Court: High Court of Bombay (Civil Appellate Jurisdiction)

Coram: Justice Bharati Dangre and Justice Manjusha Deshpande

Date of Judgment: 6th April 2026

Citation: 2026:BHC-AS:16973-DB

Core Law: Constitutional Law (Article 226), Banking Regulation Act, 1949 (Section 35A), RBI Circulars on customer protection, Information Technology Act, 2000

2. Legal Framework

Major laws and provisions involved

• Constitution of India, 1950 – Article 226 (writ jurisdiction)

• Banking Regulation Act, 1949 – Section 35A (RBI’s power to issue directions in public interest)

• Reserve Bank of India Act, 1934 – Section 42 (scheduled banks’ obligations), Section 58(2)(o)

• Indian Penal Code, 1860 – Sections 420, 467, 468, 471

• Information Technology Act, 2000 – Sections 66C, 66D

• RBI Integrated Ombudsman Scheme, 2021 – Clause 16(2)(a)

Key legal principles applied

• Reassessment jurisdiction (not applicable here, but principle from Federal Bank etc.): A writ petition under Article 226 is maintainable against a private body if it discharges a public duty or function.

• Zero liability of customer under RBI Circular dated 6th July 2017: Where an unauthorised electronic transaction results from a third‑party breach and the deficiency lies neither with the bank nor with the customer, and the customer notifies the bank within three working days, the customer has zero liability.

• Burden of proof: Under paragraph 12 of the said circular, the burden of proving customer negligence lies on the bank.

• SIM swapping as third‑p

... Upgrade to a Premium Plan to view the full judgment.