A pensioner, six identical debits, and a branch that says the OTP settles it
On a Monday a 71-year-old pensioner visits a Nagpur branch with a statement showing six UPI debits of ₹24,000 each - ₹1,44,000 - executed the previous Thursday afternoon. She says she did not make them: a caller claiming to be a bank officer told her a credit card was being fraudulently issued in her name and she read out the OTP he asked for. She reported the matter to the branch helpline at 4 p.m. on Friday, which logged the call. The account had a customer-set daily UPI limit of ₹1 lakh, and the branch notes the transactions were 'authenticated by OTP' and that she shared credentials, so liability is hers. Her pension is credited on the 1st and she has ₹3,700 left. The bank has 30 days to respond to her written complaint.
1. Determine liability. Is the branch right that the OTP authentication and the shared credential end the matter?
Read the worked answer
Authentication by OTP begins the analysis; it does not end it. The liability framework for unauthorised electronic transactions turns on two things: whether the bank's systems were compromised or the breach was third-party, and whether the customer shared credentials - and if she did, how quickly she reported.
She was induced by a vishing call impersonating a bank officer, and she disclosed the OTP. That is customer negligence, so this is not a zero-liability case. But it is a limited-liability case, graduated by the reporting delay: the debits occurred on Thursday afternoon and she reported on Friday afternoon, within three working days. Her share is therefore capped at the limited amount in the bank's Board-approved policy, and the bank bears the balance. The branch's position that liability is entirely hers is wrong on the reporting delay alone, and would not survive scrutiny by the Ombudsman.
Then apply a second test the branch has not asked: six identical debits of ₹24,000 within minutes against a daily limit of ₹1 lakh - that is, transactions that breach the customer's own limit across the burst - should have been caught by the bank's transaction monitoring or velocity rules. If the bank's monitoring was inadequate, that reduces the customer's share further, possibly to zero.
Credit the admissible amount within 10 working days of the complaint, with a written response stating the liability, the amount credited, the basis, and what remains open. Do not require her to sign any indemnity or waiver as a condition of the refund.
2. What evidence must be preserved and what procedural steps govern the complaint, including escalation if the bank's answer is unfavourable?
Read the worked answer
Evidence to preserve now, before retention windows lapse: the calling number and its call detail records, the SMS/OTP logs with timestamps and delivery status, the device ID, IP address and UPI transaction IDs, the beneficiary VPA and bank details, the helpline recording and ticket reference for the Friday 4 p.m. call, and the customer's written complaint. Preserve the OTP message text for the warning wording, since a weak or generic OTP message affects the bank's own responsibility. File an STR if the beneficiary accounts display mule characteristics, and report the incident to the fraud monitoring unit.
Procedure. Acknowledge the complaint in writing, investigate, and respond within 30 days. If the bank proposes to reject the complaint in whole or in part, the rejection must be reviewed by the Internal Ombudsman before it is communicated to her, under the Internal Ombudsman Scheme. That step is a condition precedent, not a courtesy.
Escalation. She may approach the RBI's Integrated Ombudsman if she receives no reply within 30 days, or within one year of the bank's reply. If she does, expect the Ombudsman to ask three questions: was liability assessed under the Board-approved policy, was the reporting date correctly established, and was the Internal Ombudsman review evidenced.
Vulnerability. She is 71, on pension, with ₹3,700 left until the 1st. A provisional credit pending investigation, and a senior-citizen escalation to the branch head, are prudent and cost the bank very little.