SIM-Swap UPI Fraud and Customer Liability
On 3 July, Mr. Kale, a salaried savings account holder, lost mobile network for about two hours while on night shift. Between 01:10 and 01:40, four UPI transfers totalling ₹1,18,000 left his account to four unknown beneficiaries. He discovered the debits on 4 July, but could file a written complaint with the bank only on 8 July after getting a duplicate SIM. He filed an FIR on 9 July. The bank's investigation shows the transactions were authenticated with his UPI PIN; his SIM was replaced at a retailer on 2 July without his knowledge, and the bank's system sent alerts to the registered mobile number, which the fraudster controlled. The bank proposes to reject the claim on the ground that the customer shared his UPI PIN. The customer claims he never shared it and wants full reimbursement.
1. Determine the customer's liability under the RBI customer-protection framework. Explain the effect of the 8 July complaint and the bank's burden of proof.
Read the worked answer
Under RBI's framework for unauthorised electronic transactions:
- Zero liability applies where the fraud is due to the bank's negligence, or where a third-party breach is reported within three working days and the customer is not negligent.
- Limited liability applies where the customer reports after three but within seven working days, and the customer is not negligent; the bank's board-approved policy fixes the cap.
- Full liability can be imposed only where the bank proves customer negligence.
Here the transactions occurred on 3 July and the written complaint was made on 8 July - about five calendar days later, within the 4–7 working-day band. So, if the customer is not negligent, the case falls in the limited-liability band, not zero and not full. The bank cannot reject the claim merely because the UPI PIN was used: it must prove that the customer shared the PIN or otherwise acted negligently. The SIM replacement on 2 July without the customer's knowledge and the alerts going to the fraudster's SIM weaken the bank's case. The bank should investigate the SIM-swap process and the retailer verification; if its own controls failed, zero liability may apply.
2. What steps must the bank take after the complaint, including timelines and provisional credit?
Read the worked answer
- Acknowledge the complaint in writing and give a complaint reference.
- Immediately block UPI/device access and freeze further debits on the account.
- Verify the SIM-swap records, call detail records, device ID, IP logs, and beneficiary accounts.
- Treat it as an unauthorised transaction, not a customer dispute, and investigate within the RBI timeline; the bank should resolve within 90 days.
- If unable to resolve within the prescribed period, provide provisional credit within 10 working days as per its board-approved policy, without waiting for the FIR.
- Communicate the liability decision in writing with reasons.
- Report the fraud to the RBI/NPCI reporting system and the cybercrime portal; preserve logs.
- Inform the customer of the RBI Ombudsman remedy if aggrieved.
The bank must not insist on a police complaint as a precondition for provisional credit.
3. Recommend controls to prevent SIM-swap-led UPI fraud.
Read the worked answer
- Enforce telecom-bank coordination for SIM replacement: a cooling period before UPI activation on a new SIM, and real-time SIM-swap alerts.
- Bind UPI registration to device and SIM; require re-authentication on SIM change.
- Send alerts on multiple channels, not only SMS; use in-app and email alerts.
- Apply velocity limits and beneficiary cooling periods for new payees.
- Verify retailer KYC and biometric authentication for SIM replacement.
- Monitor unusual night-time transactions and multiple new beneficiaries.
- Educate customers to report loss of network or SIM immediately.
These controls address the root cause; customer PIN confidentiality alone is not sufficient.