Unauthorised UPI Debits: Zero Liability, Burden of Proof and Consumer Forum
A customer holding a savings account with a scheduled bank found six UPI debits totalling ₹2.4 lakh between 2:13 a.m. and 2:19 a.m. He was asleep, his phone was on the bedside table, and he received no call or SMS. At 9:30 a.m. he reported the transactions, blocked the UPI ID, and filed a police complaint. The bank's investigation said the transactions were authenticated with the customer's UPI PIN and that he must have shared it, so it rejected the claim after 30 days. The customer had not shared the PIN. The bank's log shows the transactions came from a device fingerprint not previously linked to the account. The customer files a complaint before the District Consumer Commission seeking ₹2.4 lakh with interest and compensation.
1. Is the customer entitled to zero liability under RBI's customer protection circular on unauthorised electronic banking transactions? Who must prove negligence?
Read the worked answer
The customer is likely entitled to zero liability. RBI's 2017 circular on customer protection for unauthorised electronic banking transactions creates a three-tier liability: zero liability where the fraud is due to a third-party breach and the customer is not negligent, provided the customer reports within three working days. Here the customer reported at 9:30 a.m. the same day, so the reporting condition is met. The bank cannot rely only on the fact that the UPI PIN was used; it must prove customer negligence. The log showing a new device fingerprint, the absence of any SMS or call, and the timing of the debits all support the customer. The burden of proving negligence is on the bank, not on the customer. The bank's rejection after 30 days is also contrary to the circular's requirement to resolve and credit within 10 working days. The bank should therefore refund ₹2.4 lakh unless it can produce concrete evidence of sharing.
2. Can the complaint be maintained before the District Commission? Consider pecuniary jurisdiction and deficiency in service.
Read the worked answer
The District Consumer Commission has jurisdiction. Under the Consumer Protection Act, 2019, the District Commission can entertain complaints where the consideration paid for the service does not exceed ₹1 crore; ₹2.4 lakh is well within that limit. A bank account and UPI service are services under the Act, and the bank's refusal to refund after a deficient investigation can amount to deficiency in service. The complaint is within the two-year limitation from the cause of action. The bank may argue that the customer is not a consumer for a fraud claim, but banking services are covered. The customer should plead the RBI circular, the transaction log, the police complaint, and the bank's rejection letter. The Commission can award refund, interest, compensation, and costs.
3. What relief can the Commission grant, and what should the bank have done during investigation?
Read the worked answer
The Commission can direct refund of ₹2.4 lakh with interest from the date of debit, compensation for mental agony and financial loss, and litigation costs. The bank should have provisionally credited the amount within 10 working days of the report, conducted a forensic device/IP analysis, and given a reasoned written decision instead of a bare rejection. It should also have treated the complaint as a fraud case and coordinated with the police and NPCI. The bank cannot use the PIN as a conclusive defence when its own log shows an unfamiliar device. A reasoned investigation and prompt provisional credit would have reduced the compensation exposure. The bank should also review its UPI risk controls for new-device binding and SMS alerts.