Who Pays for the OTP Fraud?
On 7 June 2025 a savings account holder at a semi-urban branch, Mrs. Kulkarni, receives a call from someone posing as a bank officer who says her debit card will be blocked unless she confirms a one-time password. She reads out the OTP at 10:12 p.m. and ₹18,000 is debited at 10:15 p.m. from an e-commerce merchant. At 9:00 a.m. on 8 June she telephones the branch and asks for the card to be blocked; the branch records the request, but the card is hotlisted only at 3:40 p.m. Meanwhile, at 2:05 p.m. on 8 June, a second debit of ₹4,500 is posted on the same card to the same merchant. Hers is an ordinary savings account, not a basic savings bank deposit account, and she was never given the bank's liability policy in writing. The branch manager says 'she gave away the OTP, so she bears everything' and declines to entertain her complaint, which was formally logged on 9 June 2025.
1. Apportion liability for the ₹18,000 and the ₹4,500 between the customer and the bank, giving the reason for each.
Read the worked answer
The two debits fall on opposite sides of the reporting line, and must be treated separately.
₹18,000 (10:15 p.m., 7 June) - customer bears it. Under RBI's customer-protection framework for unauthorised electronic transactions, where the loss arises from the customer's own negligence - here, voluntarily disclosing the OTP to an unknown caller - the customer bears the entire loss until the incident is reported to the bank. The time-based protections (zero liability if a third-party breach is reported within three working days; capped liability of ₹5,000 for basic savings bank deposit accounts and ₹10,000 for other accounts if reported within four to seven working days) are designed for breaches where the customer is not at fault. They do not rescue a customer who parted with the credential herself.
₹4,500 (2:05 p.m., 8 June) - bank bears it. The customer reported at 9:00 a.m. on 8 June. From that moment the bank was on notice and was obliged to act. Hotlisting only at 3:40 p.m. let a further debit through, so this loss is attributable to the bank's own failure, and the customer's earlier negligence cannot be stretched to cover a transaction that occurred after she had done what the framework asks of her.
Provisional split: ₹18,000 customer, ₹4,500 bank - subject to the bank being able to prove the OTP was shared; call records, not assertion, are the evidence.
2. What are the bank's procedural obligations once the complaint is logged on 9 June 2025, and where did the branch go wrong?
Read the worked answer
Obligations once the complaint is logged:
- Acknowledge and record the complaint in the prescribed register, with a complaint number given to the customer; she must not be turned away or asked to come back later.
- Resolve within 90 days - from 9 June 2025 that runs to about 7 September 2025. If the bank fails to resolve within that period, it must pay compensation of ₹100 per day for the delay.
- No charge may be imposed on the customer for reporting an unauthorised transaction, and she must not be asked to bear the cost of proving it.
- Keep the liability policy visible - the framework requires banks to inform customers in writing of their rights and liability limits, and to display the policy.
Where the branch went wrong: it treated a telephone request as information rather than an instruction, leaving a three-hour-plus gap before hotlisting; it refused to entertain a written complaint on the manager's personal view of fault; and it had never given the customer the written liability policy, which undermines any reliance on her 'knowledge' of the rules. Each of these is a service and control lapse that will be examined if she escalates to the RBI's Integrated Ombudsman.
3. The manager argues that because the OTP was shared, the bank owes nothing at all. Assess that position and state the LBO's recommended action.
Read the worked answer
The manager is over-reading the negligence rule. The rule shifts the pre-reporting loss to the customer; it does not switch off the bank's duty after the report, nor does it erase the bank's own operational failure. On these facts the most the bank can defend is the ₹18,000, and even that is at risk for two reasons:
- the bank must actually prove the disclosure (a call recording, an SMS trail), not simply assert it;
- the bank never gave her the written liability policy, so its own compliance with the framework is imperfect.
Recommended action: (a) refund the ₹4,500 immediately and record why; (b) examine the ₹18,000 on evidence, and if the disclosure cannot be proved, treat it as a third-party breach reported within three working days - which means zero liability for the customer; (c) close the complaint within the 90-day window with a written reply stating the reasons; (d) fix the process - written hotlisting authority at branch level, same-day action on telephonic blocking requests, and a counter display plus account-opening handout on customer liability; (e) coach the manager that 'customer fault' is a finding to be evidenced, not a first response to a complaint.