₹46,000 lost in three UPI transfers: who bears the loss?

Partly right in principle, wholly inadequate in process - and there may be a bank-side angle.

Under the RBI's 2017 framework on limiting customer liability:

• Zero liability applies where the deficiency is on the bank's side, or where it is a third-party breach and the customer reports within three working days.
• Limited liability applies where the loss is due to the customer's own negligence, such as sharing payment credentials. In that case the customer bears the entire loss up to the point of reporting, and the bank bears anything after reporting.

Sunita read out the OTP, so the bank is on defensible ground for the ₹46,000 lost before 9:30 am. But three things must still be established, and the bank cannot skip them:

1. The burden of proving negligence is on the bank. It must show the OTP was delivered to her registered mobile and that she was warned not to share it.
2. A reasoned written reply is mandatory - the transaction trail, the investigation findings, the specific clause relied on, and the escalation route. A one-line letter invites an Ombudsman adverse finding on procedure alone.
3. Check the system angle. Three transfers to two brand-new beneficiaries inside four minutes at night should have tripped the new-beneficiary cooling-period limit and the fraud-monitoring rules. If the PSP allowed transactions above the permitted cap for new beneficiaries, or if real-time alerts failed, there is a bank/PSP deficiency and zero liability may apply after all.

First 24 hours - the golden hour is about freezing, not paperwork.

1. Block the account and the UPI handle immediately so no further debits occur.
2. Raise the dispute on the UPI/NPCI portal and request the beneficiary banks to place a lien on the two accounts. Money recovered in the first 24–48 hours is often still sitting there; after that it is withdrawn.
3. File the cyber complaint on cybercrime.gov.in or the 1930 helpline, and get the acknowledgement number on record - banks and the Ombudsman both ask for it.
4. Preserve evidence: the call detail record, the WhatsApp link, the APK, the SMS log, and the device.
5. Issue a written acknowledgement with a complaint reference and a timeline, not a verbal 'we will see'.

Now: the branch must reopen the case, complete the investigation report, and reply in writing with reasons. If the reply confirms customer liability, tell Sunita clearly that she can approach the RBI Integrated Ombudsman if the bank does not resolve within 30 days or if she is dissatisfied. Given her clean record and same-morning reporting, a goodwill settlement or partial refund is also a legitimate commercial decision - the cost of an Ombudsman case on a defective rejection letter usually exceeds ₹46,000.

Message to customers - concrete, not 'be careful'.

• No bank, and no RBI, ever asks you to install an app, share a screen, or read out an OTP. The OTP is the signature on the transaction.
• Never install an APK from a WhatsApp or SMS link. Apps come from the official store; screen-sharing and remote-access apps give the fraudster your screen and your SMS.
• Act within hours, not days. Call the bank's official number, use the app's 'block card/account' function, and dial 1930. Reporting speed decides who pays.

Internal changes:

1. Real-time alerts that are impossible to miss for debits above a threshold, plus a night-time velocity check.
2. Enforce the new-beneficiary cooling-period limit and flag multiple transfers to new beneficiaries within minutes.
3. Front-load complaint handling: a written acknowledgement within a day, a named owner, and a hard 30-day closure clock.
4. Stop writing one-line rejections. Standard template must state the finding, the clause, and the escalation route.
5. Staff training so a branch does not convert a fraud victim into a complainant by treating her as an accused.