Nine UPI Debits, an OTP Read Out Loud

Apply the RBI framework step by step.

Step 1 - Is the transaction unauthorised? Yes, in the legal sense: the customer never intended those nine debits. It is a third-party fraud, not a dispute about a merchant.

Step 2 - Is there customer negligence? The circular's structure is that where the loss arises from the customer's negligence, the customer bears the entire loss until the bank is informed of the unauthorised transaction; loss after reporting is the bank's. Sharing an OTP and installing a screen-sharing app at a stranger's instruction is textbook negligence - the OTP is the customer's authentication credential and the bank's communication says so. Nine SMS alerts over two days reinforce it.

Step 3 - The reporting clock. He reported on day 6. Under the tiered rule, reporting within three working days gives zero liability where the customer is not at fault; reporting in days 4–7 limits liability per the bank's board-approved policy; beyond seven days, the board policy governs with the customer bearing the loss. But the negligence finding in Step 2 overrides the zero-liability tier here.

Step 4 - Who proves it? The burden of proving customer negligence lies with the bank. SMS delivery logs and call records must be produced, not merely asserted.

Assessment. The outright rejection is defensible on liability but is not a good decision. The bank must give a written, reasoned reply, credit the ₹40,000 it recovered, and - because the beneficiary accounts were opened on forged KYC, indicating mule accounts that the system failed to stop - consider a discretionary, board-policy-approved partial settlement rather than a flat refusal. A blanket rejection invites an Ombudsman award that will also examine whether the bank's monitoring was negligent.

Control lapses.

1. No velocity or behavioural monitoring. Nine debits in 48 hours to three new beneficiaries from an account that presumably had a modest transaction history should have been flagged; a 61-year-old first-time UPI user is a high-risk profile.
2. No first-time-beneficiary cooling period or step-up authentication for high-value transfers to newly added beneficiaries.
3. No outbound call or hold despite the pattern being visible in real time; alerts were sent to the customer but no one in the bank acted on its own data.
4. Onboarding gap. A first-time UPI user was not educated on OTP confidentiality or screen-sharing fraud at registration.
5. Mule accounts. The beneficiary accounts passed KYC at other banks - the fraud is systemic, and the bank's own fraud-reporting discipline (cyber incident reporting to CERT-In and RBI, and reporting to the beneficiary banks) is part of its obligation.

Operational steps and timelines.

• Acknowledge the complaint in writing immediately and complete the investigation within the prescribed period; the customer must be told the outcome and the reasons.
• Since liability rests with the customer, no 10-working-day credit obligation is triggered, but that exemption must be documented, not assumed.
• Return the ₹40,000 recovered from the frozen beneficiary account, and pursue the balance ₹1,46,000 with the beneficiary banks.
• File the cyber fraud complaint and give the customer the acknowledgement, which he needs for any Ombudsman or police filing.
• Remediate the rule engine: velocity caps, cooling periods for new beneficiaries, device binding checks and outbound-call triggers.

Recourse. Under the RBI Integrated Ombudsman Scheme, 2021, the customer can file a complaint free of cost, online or by post, after giving the bank a reasonable opportunity to respond - generally 30 days. The Ombudsman can award compensation for direct loss and, separately, for mental agony and harassment. The bank must also maintain a documented complaints register and its internal escalation route, or the Ombudsman will treat the complaint as having been ignored.

Assessing the exposure. Three factors cut against a clean win for the bank:

• Evidence quality. If SMS delivery logs show nine delivered alerts and the app was installed by the customer, negligence is well evidenced. If any alert failed, the bank's case weakens sharply.
• Proportionality. The Ombudsman tends to ask whether the bank's board policy is reasonable and consistently applied, and whether the bank's own systems were negligent. Mule accounts funded by forged KYC and no velocity check are facts the bank would have to explain.
• Conduct. A flat, unexplained rejection is more likely to convert into an award than a reasoned reply that credits the recovered ₹40,000 and offers a discretionary share under board policy.

Recommended stance. Reply in writing within the timeline, prove the alerts, apply the negligence rule, but offer a discretionary settlement within the board-approved policy band - for instance a partial refund of the unrecovered amount - and document that the offer is goodwill, not an admission of liability. Fix the monitoring gaps in parallel, because the second such case will be far harder to defend.