SIM Swap and Unauthorised UPI Debits
A 34-year-old salaried customer's mobile phone loses network for about three hours on 12 June. The next morning, four UPI debits of ₹9,800 each, totalling ₹39,200, are made from her savings account to four different virtual payment addresses. She did not receive SMS alerts because her SIM had been swapped at a telecom store using a copy of her Aadhaar. The bank's records show that her registered mobile number was changed and UPI was re-registered on a new device. She emails the bank on 15 June, within three working days, saying she did not authorise the transactions and did not share any OTP. The bank replies that OTPs were sent to her registered number and refuses refund. The account is frozen only on 18 June, after she visits the branch. An FIR is filed on 20 June. The bank has not yet raised a chargeback with the payment service provider.
1. Who should bear the loss? Apply the limited-liability framework and explain the bank's evidential burden.
Read the worked answer
On these facts, the bank should bear the loss unless it can prove customer negligence.
RBI's limited-liability framework for unauthorised electronic banking transactions gives zero liability to a customer where the transaction is due to a third-party breach and the customer reports it within three working days without negligence. The customer reported on 15 June, within three working days of the 13 June debits, and says she did not share an OTP. The SIM swap explains why the OTP went to the fraudster. The bank's statement that 'OTPs were sent to the registered number' is not proof that the customer authorised the transaction; after a SIM swap, that number was controlled by the fraudster.
The bank must investigate the SIM-swap records, device registration and VPA logs. It should give provisional credit within the RBI timeline (generally 10 working days of notification) and complete the investigation. The delay in freezing the account until 18 June is a separate service deficiency. If the bank proves the customer shared credentials or ignored alerts, liability may shift, but the burden is on the bank.
2. What immediate steps should the bank and the customer take, and what evidence must be preserved?
Read the worked answer
Immediate steps:
- Hotlist the account and block UPI and card; record the exact time of the customer's report.
- Ask the telecom provider for SIM-swap records and the bank's own logs for mobile-number change, device ID, IP address and VPA.
- Raise chargeback or dispute with the PSP and NPCI for the four UPI transactions; preserve evidence.
- Advise the customer to file an FIR and a telecom complaint, and to check for identity-document misuse.
- Give a written response with the provisional-credit decision and the expected timeline.
- If unresolved, tell the customer about the RBI Ombudsman and the bank's grievance process.
A refund should not be refused merely because OTPs were generated. The question is whether the authentication was robust and whether the customer was negligent. The bank should also check whether its own mobile-number change process required a cooling period or additional verification.
3. Recommend preventive controls to stop a repeat of this fraud.
Read the worked answer
Preventive controls:
- Enforce SIM binding and device binding for UPI: a new SIM or device should trigger a cooling period and additional verification, not immediate re-registration.
- Use risk-based additional factors for high-risk events such as mobile-number change, new-device login and high-velocity UPI payments.
- Send alerts to a secondary channel (email or app) and make them easy to act on.
- Train staff not to treat 'OTP sent' as conclusive proof of customer consent.
- Educate customers: network loss, sudden no-service or a SIM-swap SMS should prompt an immediate call to the bank and telecom provider.
The bank's own change-management process is the weak point. A fraudster should not be able to walk into a telecom store with an Aadhaar copy, obtain a SIM and re-register UPI without a strong challenge. The control objective is to break the chain before the debit, not to argue after it.