Bombay HC Upholds RBI’s Zero Liability Framework in Cyber Fraud Case Against Bank of Baroda

The Bombay High Court has held that where a customer falls victim to cyber fraud caused by a third-party breach such as SIM swapping, without any negligence on the customer’s part, the customer is entitled to “zero liability” protection under the Reserve Bank of India’s July 6, 2017 circular on unauthorised electronic banking transactions.

The Court ruled that in such circumstances, the bank is liable to restore the amount fraudulently debited from the customer’s account.

A Division Bench of Justice Bharati Dangre and Justice Manjusha Deshpande directed Bank of Baroda to refund Rs 1.24 crore along with 6% interest to PNP Polytex Private Limited after finding that the company had promptly reported the fraud and that no negligence could be attributed to it.

The Court held that the burden to establish customer negligence lies on the bank and emphasised that RBI circulars meant for customer protection must receive a purposive interpretation.

The case arose from a large-scale cyber fraud committed through SIM swapping.

PNP Polytex, a Mumbai-based company engaged in import and trade, maintained multiple current accounts with Bank of Baroda and used online banking facilities for transactions.

According to the company, a dedicated mobile number registered with the bank for receiving OTPs was kept securely in a locker and used exclusively for banking transactions.

On January 13, 2020, one of the company’s employees discovered that approximately Rs 1.24 crore had been siphoned from two cash credit accounts through multiple online transactions carried out between January 12 and January 13, 2020.

The amount had been transferred into several accounts across different cities.

The company immediately informed the bank, sought freezing of its accounts, lodged an FIR with the police, and also filed a complaint on the National Cyber Crime portal.

The petitioner contended that the fraud had occurred due to SIM swapping, wherein fraudsters procured a duplicate SIM card linked to the company’s registered mobile number and intercepted OTPs required for online banking transactions.

The company relied heavily on the RBI circular dated July 6, 2017, which provides that where an unauthorised electronic banking transaction occurs due to a third-party breach and the customer reports it within three working days, the customer bears “zero liability.”

During the proceedings, Vodafone Idea Limited acknowledged that the SIM replacement had indeed taken place after a request was received by its call centre.

The telecom company maintained that it had followed its corporate SIM exchange policy and processed the request only after receiving approval through the authorised email address associated with the account.

However, the petitioner argued that the duplicate SIM had been activated without its consent and enabled the fraudsters to receive all OTPs and transaction alerts.

Bank of Baroda opposed the petition, arguing that it had implemented multiple layers of security for online transactions, including customer IDs, passwords, OTPs, beneficiary confirmations, and cooling periods before transactions could be completed.

The bank maintained that the fraudulent transfers could not have occurred without compromise of customer credentials and claimed there was no deficiency in banking service.

The Court, however, noted that the police investigation and charge-sheet clearly established that the fraud had been orchestrated by third parties who manipulated banking credentials and procured a duplicate SIM card to divert OTPs.

The Bench observed that the investigation did not attribute any negligence or connivance to the petitioner company.

Referring extensively to the RBI circular, the Court underscored that the objective of the framework was to instil confidence in electronic banking systems and protect customers from unauthorised electronic transactions.

It held that the RBI circular operates independently of criminal proceedings and squarely places the burden on banks to prove negligence on the customer’s part.

The Bench also criticised the approach of the bank and telecom service provider. It observed that the SIM replacement request was processed on January 11, 2020, and the fraudulent transactions were carried out on a Sunday and during early morning hours before banking operations commenced on Monday.

The Court remarked that these transactions should have appeared suspicious, especially considering the company’s prior banking patterns and the large amounts involved.

The Court relied upon earlier judgments dealing with cyber fraud and unauthorised banking transactions, including decisions of the Guwahati High Court and previous rulings of the Bombay High Court concerning SIM swapping frauds.

It reiterated that merely because OTPs were used for transactions does not automatically establish negligence by the customer, particularly where fraudsters had unlawfully gained control of the registered mobile number.

Holding that the petitioner was a victim of third-party cyber fraud and had acted promptly upon discovering the unauthorised debits, the Court concluded that the company was entitled to the RBI’s “zero liability” protection.

It accordingly directed Bank of Baroda to credit the debited amount to the petitioner’s account after adjusting the amount that had already been frozen during the investigation. The Court further ordered payment of interest at 6% from the date of the complaint and directed compliance within eight weeks.

For the Petitioner: Ms. Shilpi Jain with Mr. Sumit Raghani, instructed by Agrud Partners

Case Title: PNP Polytex Private Limited v. Reserve Bank of India & Ors.

Bench: Justice Bharati Dangre and Justice Manjusha Deshpande

Date of Judgment: April 28, 2026