Twenty-Seven UPI Debits, Eight New Merchant VPAs, and a Bank Policy That Is Silent
On a Monday morning the fraud-control cell of a 42-branch urban co-operative bank logs 27 complaints in 36 hours. Every complainant was debited between ₹9,200 and ₹9,850 through UPI to eight different merchant VPAs registered in the names of small grocery outlets. In each case the customer had, hours earlier, installed an .apk file sent over WhatsApp by someone posing as a discom officer; the app requested 'screen access' and the customer then read out an OTP. The bank's SOC confirms the OTPs were genuine and were entered on the customer's own handset, and that the eight VPAs were onboarded nine days earlier with PAN and Aadhaar matching names of persons with no business footprint. Total disputed amount is ₹2.54 lakh; the oldest complaint is 31 hours old. The bank's board-approved policy is silent on remote-access fraud, and one branch has already told two customers they were 'negligent' and closed their tickets.
1. How should the bank determine liability for these 27 disputed UPI transactions? Apply RBI's customer-protection framework for unauthorised electronic banking transactions, classify the cases, and state the payout decision.
Read the worked answer
Step 1 - classify, do not default to 'customer negligence'. The RBI framework on limiting customer liability in unauthorised electronic banking transactions creates three buckets: (a) fraud or negligence by the bank - zero customer liability; (b) third-party breach where neither customer nor bank is at fault - zero liability if reported within three working days, and the bank's board policy governs if reported later; (c) customer negligence in sharing payment credentials - the customer bears the loss until the bank is notified and the bank bears everything after notification.
Step 2 - apply the facts. Both features are present here. The customer installed a screen-sharing APK and read out an OTP, which on its face is sharing of credentials. But the OTP was not the operative cause of loss - the remote-access session was. More importantly the bank's own control chain failed twice: eight merchant VPAs were onboarded nine days before the fraud using PAN and Aadhaar of persons with no business footprint (a merchant-KYC failure that sits squarely on the bank), and 27 structured debits of roughly ₹9,500 each to brand-new VPAs in 36 hours did not trip any velocity rule (a monitoring failure). That contribution moves the case out of a pure bucket-(c) analysis into contributory fault.
Step 3 - decision. Reimburse the 27 customers in full, pursue recovery from the PSP/PA through the chargeback route, and book the payout as a control-failure loss rather than a customer-liability case. Denying claims on a bare 'you shared your OTP' line is defensible on paper and indefensible before the RBI Ombudsman and in consumer forums.
Step 4 - process discipline. Acknowledge every complaint in writing, record the liability determination and its reasons, and respect the 30-day resolution discipline under the Ombudsman scheme; silence is treated as denial.
2. What containment and reporting actions are due within the first 24 hours, and who must be told what?
Read the worked answer
T+0 to T+6 hours - contain. (1) Fraud operations: place a hold on the eight merchant VPAs through the PSP/NPCI channel, raise disputes for all 27 transactions, and ask the beneficiary banks to freeze proceeds. (2) SOC: block the APK hash and download URLs, push a customer advisory over SMS and app in the local language ('no utility company asks you to install a file or share your screen'), and add device-binding and session-anomaly rules at the UPI switch for screen-sharing applications. (3) Preserve evidence: APK samples, device fingerprints, switch logs, and the full merchant-onboarding files - these serve the police case and the forensic audit.
Reporting map. The APK campaign is a cyber security incident, not merely a batch of customer disputes. Report it to CERT-In within the 6-hour timeline in CERT-In's directions, and to RBI within the incident-reporting window in the cyber security framework - hours, not days. Register the customer complaints on the NCRP/1930 portal so that the beneficiary accounts are flagged in the system. Because the eight VPAs behave as mule accounts, file an STR with FIU-IND on the network, and feed the accounts into the fraud registry so other banks can see them.
T+24 hours - internally. Brief the board risk committee, enter the event in the incident register, and decide on provisional credit now rather than waiting out the chargeback cycle; the framework expects zero-liability cases to be credited promptly. Non-reporting is a violation; late reporting is a supervisory finding that outlives the ₹2.54 lakh loss.
3. Two complaints were closed with a verbal 'you were negligent' verdict. Assess the regulatory and conduct risk of that response and state what the bank must do now.
Read the worked answer
Risk assessment. (i) Conduct: closing a ticket with an unwritten negligence finding is a denial without a reasoned reply - precisely what the Ombudsman examines - so two closed tickets become two awards and a systemic-supervision finding. (ii) Regulatory: the framework requires a written liability determination against a board-approved policy, and a policy silent on remote-access fraud is a governance gap in itself. (iii) Evidentiary: a closure note that reads 'negligent' can be characterised as the bank's admission that it never investigated the merchant side of the transaction.
What to do now. Reopen both complaints, issue a written determination that records both the customer's acts (installing the APK, reading out the OTP) and the bank's lapses (merchant onboarding and velocity monitoring), and pay. Then remediate the cause, not just the cases: (a) amend the board policy to name remote-access and screen-sharing fraud as a defined scenario with a pre-approved payout matrix; (b) mandate re-verification - site visit or video KYC - of every merchant VPA onboarded in the last 90 days; (c) set velocity rules so that multiple debits to a VPA under 30 days old trigger a hold and manual review; (d) run a local-language awareness campaign through branches and the app; (e) place the episode before the board with the loss figure, the root causes and named control owners with dates, so remediation is auditable.
Judgement point. The instinct to protect the P&L is understandable, but an unreasoned closure converts a ₹2.54 lakh loss into a conduct finding, and conduct findings scale with the size of the customer base, not the size of the fraud.