Four UPI Debits, a Silent Alert Gateway, and a Fifth-Day Complaint
On 14 June, Ramesh, a savings account holder at your semi-urban branch with an average balance of about ₹42,000, walks in with a written complaint. Four UPI debits totalling ₹38,500 left his account on 9 and 10 June. He says his phone never left his pocket, that he did not share his PIN or any OTP with anyone, and that he was travelling and could reach the branch only today. The branch's system check shows the debits went to four different mPayee handles, all created the same evening. Your operations officer insists the bank has complied because "SMS alerts are enabled on the account" - but the SMS gateway report shows no alerts were generated for those two days because of a vendor outage, and the customer was never informed. The account is otherwise KYC-compliant, and the customer has never reported a fraudulent transaction before. You must decide liability, communicate it in writing, and close the complaint before it escalates to the RBI Ombudsman.
1. Apportion liability between the bank and the customer, and state the principle you are applying rather than just the conclusion.
Read the worked answer
Principle. Under RBI's framework for limiting customer liability in unauthorised electronic banking transactions, the burden of proving that a transaction was authorised, or that the customer was negligent, lies on the bank, not the customer.
Apply the tests in order:
- Was the breach a third-party breach without customer negligence? The four mPayee handles created in one evening, the absence of any prior fraud history and the KYC-compliant account all point to an external compromise; nothing on record shows the customer shared a PIN or OTP.
- Was there a deficiency on the bank's side? Yes - and this is decisive. The customer was never alerted because the bank's own SMS gateway was down for two days. The officer's defence ("alerts are enabled") confuses a configured feature with a delivered message.
Conclusion. Where the deficiency lies with the bank, liability is zero for the customer, regardless of the fact that he reported on the fifth working day. The three-working-day reporting window becomes relevant only when the customer is alleged to be negligent. Credit the full ₹38,500 and record the finding as bank liability in the fraud register.
(Note: the exact rupee caps in the limited-liability slabs should always be taken from the circular currently in force and from the bank's board-approved policy; do not quote them from memory.)
2. Set out the procedural steps and timelines the branch must now follow, and identify one step that would itself create a fresh regulatory exposure.
Read the worked answer
Immediate (same day): acknowledge the complaint in writing with a complaint reference number; block or report the four mPayee handles through the UPI/merchant ecosystem; preserve CBS, UPI switch, gateway and mPayee logs before retention windows roll over.
Financial closure: the customer's account must be made good within the prescribed short window (shadow credit/reversal within 10 working days of the complaint is the commonly applied benchmark). The bank cannot levy any charge on the customer for reporting an unauthorised transaction.
Complaint closure: resolve and communicate within 30 days of receipt; if the bank fails, the customer acquires the right to approach the RBI Ombudsman under the integrated ombudsman scheme. The reply must be a reasoned one - citing the gateway outage, admitting the notification failure and stating the credit reference - not a template denial.
Compliance follow-ups: report the incident in the fraud monitoring returns, and fix the alert-delivery monitoring so a vendor outage raises an exception rather than being discovered by a customer.
The trap: asking the customer to sign an indemnity or a "no further claim" letter as a condition of the refund. Consent extracted as a precondition to reversing a fraudulent debit converts a closed case into a fresh grievance and a likely ombudsman award.
3. The forensic report later shows a remote-access app on the customer's own phone, installed after he clicked a link in a courier SMS. How does the answer change, and what does the fifth-day reporting do to it?
Read the worked answer
The liability finding flips direction, but not automatically. The forensic finding establishes customer negligence (clicking an unknown link and installing a remote-access tool), so the case moves from the zero-liability branch to the limited-liability branch of the framework. The bank must still prove the negligence with evidence - the forensic report is that evidence; an officer's suspicion is not.
Reporting date now matters. If a negligent customer reports within 3 working days, liability is capped at the prescribed limited amount, with the balance borne by the bank. If the report comes after 3 working days, the liability is governed by the bank's board-approved policy for delayed reporting, which must be applied as written and disclosed to the customer.
But two bank-side facts survive. First, the gateway outage means the bank failed in its own notification duty, which is a mitigating factor the ombudsman will weigh even in a negligence case. Second, the bank cannot use the delay to escape scrutiny of its own conduct.
Practical answer: recover the credited amount only to the extent the board policy permits, explain the forensic basis in writing, and do not attempt a full clawback in a case where the bank's alerts never fired.