The ₹18,400 UPI loss: who bears it when the bank's own alerts sat unactioned

Step 1 - Is it unauthorised? Yes. The customer did not initiate the debits and did not part with her UPI PIN; control of her registered number was taken over by a SIM swap. Entry of a correct PIN does not by itself make a transaction authorised; the question is whether the customer shared credentials.

Step 2 - Timing. Reporting on 23 March is nine days after the debits, outside the 3-working-day window. On timing alone, the bank would move from zero liability to limited liability under its board-approved policy, and a customer-negligence argument (failure to update the mobile number) would be available.

Step 3 - Whose negligence caused the loss? This displaces the timing analysis. The bank had flagged the beneficiary VPA as a mule three days earlier and did nothing; its own rule fired on the third debit and no one acted. Had either control worked, debits two and three (₹10,400) would not have occurred. A bank cannot invoke the delayed-reporting clause to defeat liability where its own monitoring failure is the operative cause. The customer's failure to update her number is a contributory lapse, but it did not create the loss.

Step 4 - Conclusion. The bank should bear the loss on the first debit and certainly on the two that followed its own unactioned alert; on these facts the defensible outcome is to make the customer whole. Even where liability is limited, the customer's share must follow the board policy, not a discretionary 'goodwill' figure.

Step 5 - Process. The disputed amount must be credited within 10 working days of notification without waiting for investigation, with reversal only if fraud by the customer is established. A ₹4,000 offer with no written acknowledgement, complaint number or ombudsman reference is itself a process failure.

Detection and actioning

• Mule-VPA flagging exists but has no consequence. A flag must trigger an automated rule - velocity blocks, beneficiary cooling-off, step-up authentication - and a named owner with a clock.
• The 'three debits in 30 minutes' rule fired and nothing happened. Real-time rules need an action path: hold, call-back, or block; an alert that no one owns is worse than no rule, because it proves the bank knew.

Authentication and contact data

• SIM swap went undetected for two days. The bank should consume SIM-swap/telecom signals, apply a cooling period after a number change, and not treat SMS OTP to a new number as a second factor.
• Device binding and beneficiary cooling-off (e.g., a first-transfer cap to a new VPA) would have broken this pattern.

Customer-facing process

• 24x7 reporting channel - app, IVR, email, branch - with immediate written acknowledgement bearing a complaint number, and a nodal officer.
• A board-approved customer liability policy, published, with staff trained to apply it rather than improvise.

Governance

• Root-cause review of the mule VPA and the missed alert, reported to the board's risk committee; alert-to-action ratio as a monitored metric.
• The bank should also have considered whether the failure is reportable and should strengthen its mule detection using network-level data shared with other banks and the payments ecosystem.