Cyber Fraud and the Allocation of Loss
India’s digital payments ecosystem has witnessed remarkable growth over the past decade, driven by the widespread adoption of internet banking, Unified Payments Interface (UPI), mobile banking applications and real-time payment systems. While these innovations have transformed financial accessibility and convenience, they have also altered the nature of cybercrime. Today’s fraudsters rarely attack banking infrastructure directly; instead, they exploit vulnerabilities within the broader authentication ecosystem through SIM swap fraud, phishing, vishing, malware-enabled credential theft and sophisticated social engineering attacks. In many instances, the technology itself functions exactly as intended, but the surrounding network of telecom operators, financial institutions and end-users becomes the point of compromise.
This evolving threat landscape has presented courts with a fundamental question:
-
When an unauthorised electronic banking transaction occurs, who should ultimately bear the loss?
-
Should liability rest with the bank that processed the transaction, the telecom service provider whose failure compromised the authentication process, or the customer whose conduct facilitated the fraud?
Although the Reserve Bank of India’s Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions Circular dated 6 July 2017 (“RBI Circular”), the Information Technology Act, 2000 and sectoral regulatory directions provide the broad framework governing digital banking security, judicial guidance on allocating liability among multiple stakeholders has remained comparatively limited.
Recent High Court decisions suggest an emerging judicial approach to allocating liability for unauthorised electronic banking transactions. Read together, these decisions indicate that liability is increasingly determined by identifying the participant whose conduct first compromised the integrity of the digital authentication process, rather than merely identifying who executed or processed the fraudulent transaction. This article examines two recent High Court decisions through this analytical lens to explore how Indian courts are approaching the allocation of loss in an increasingly interconnected digital banking ecosystem.
In Sri Basaveshwara Pattana Sahakara Bank Niyamitha v. Canara Bank & BSNL
[1], the Karnataka High Court imposed liability on a telecom service provider whose negligent issuance of a duplicate SIM card enabled the diversion of OTPs and subsequent fraudulent banking transactions. In another recent decision, the Delhi High Court, in
State Bank of India v. Hare Ram Singh & Anr.
[2], declined to hold the bank liable where the customer had interacted with a malicious link, holding that customer negligence extends beyond the conscious disclosure of passwords or OTPs. Read together, these decisions suggest an emerging approach
[1] Sri Basaveshwara Pattana Sahakara Bank Niyamittha v. Canara Bank & Connected Matter 2026:KHC:25587
[2] State Bank of India v. Hare Ram Singh & Anr. 2026: DHC:4833-DB
to allocating liability by identifying the participant whose conduct first compromised the integrity of the authentication process, offering important guidance for financial institutions, telecom service providers, regulators and customers navigating India’s rapidly evolving cyber fraud landscape.
India’s Legal Framework for Digital Banking Liability
The allocation of liability for unauthorised electronic banking transactions in India is governed by a combination of banking regulations, cyber laws and data protection obligations rather than a single comprehensive statute. At the centre of this framework is the RBI’s Circular, which categorises liability according to the source of the security failure. The Circular recognises three broad scenarios: institutional deficiency attributable to the bank, third-party breaches beyond the control of both the bank and the customer, and losses arising from customer negligence. Rather than focusing solely on the occurrence of fraud, the Circular requires an examination of where the compromise originated.
This regulatory framework is complemented by the Information Technology Act, 2000, which imposes obligations on organisations handling sensitive personal information to maintain reasonable security practices and criminalises offences such as identity theft and cheating by personation through computer resources. More recently, the Digital Personal Data Protection Act, 2023 (“DPDPA”) has reinforced these obligations by requiring Data Fiduciaries, including banks and telecom service providers, to implement reasonable security safeguards for protecting personal data processed during digital transactions.
Digital banking security is no longer viewed as the exclusive responsibility of financial institutions but as a shared obligation extending across banks, telecom service providers and customers. Until recently, however, the practical application of these principles remained uncertain, particularly in cases where multiple participants contributed to the compromise of the authentication process. The Karnataka and Delhi High Court decisions address this uncertainty by clarifying how liability should be allocated when different stakeholders fail at different stages of the digital authentication process.
Karnataka High Court: Expanding Institutional Responsibility for SIM Swap Fraud
The Karnataka High Court’s decision in Sri Basaveshwara Pattana Sahakara Bank Niyamitha v. Canara Bank & BSNL represents one of the most significant judicial pronouncements on institutional liability arising from SIM swap fraud. The case concerned a co-operative bank that suffered substantial financial loss after fraudsters obtained a duplicate SIM card linked to its registered mobile number, enabling them to intercept OTPs and execute unauthorised RTGS and NEFT transactions. While the dispute originated as a claim for compensation against BSNL, the Court’s reasoning extended far beyond the facts of the case, redefining the role of telecom service providers within India’s digital banking ecosystem.
The Court recognised that a registered mobile number has evolved into a critical component of digital banking authentication. Since OTP-based verification forms the backbone of electronic banking transactions, the negligent issuance of a duplicate SIM card effectively compromises the integrity of the entire authentication process. By characterising telecom operators as
integral participants in the financial authentication ecosystem rather than peripheral service providers, the Court significantly expanded the scope of their accountability.
Building on this reasoning, the Court articulated a heightened duty of care applicable to telecom service providers while processing SIM replacement requests. Identity verification was no longer viewed as a routine contractual obligation merely owed to subscribers, but as an essential safeguard against financial fraud. Consequently, failures in subscriber verification capable of facilitating unauthorised banking transactions were held to attract civil liability for the resulting losses.
The judgment also reinforces established principles of vicarious liability by holding BSNL accountable for the negligent acts of its employee who issued the duplicate SIM card without proper verification. The Court observed that the issuance of SIM cards forms part of the telecom operator’s core business functions, and therefore negligence committed by employees in the course of performing those functions cannot be disassociated from the organisation itself. This aspect of the decision is particularly significant as it places responsibility on institutions to strengthen internal compliance mechanisms rather than attributing liability solely to individual employees.
Beyond determining liability in the individual dispute, the judgment carries broader implications for India’s digital financial ecosystem. By treating telecom infrastructure as an indispensable component of banking security, the Karnataka High Court makes it clear that institutional responsibility for cyber fraud extends beyond banks alone. The decision signals that telecom service providers, whose systems facilitate digital authentication, may be held to the same standards of accountability where failures in their processes enable financial fraud. In doing so, the Court lays the foundation for a more integrated approach to cybersecurity governance, recognising that the security of digital banking depends as much on the integrity of the authentication network as it does on the banking system itself.
Delhi High Court: Redefining Customer Negligence in the Digital Age
If the Karnataka High Court expanded the scope of institutional responsibility in cases of SIM swap fraud, the Delhi High Court’s decision in State Bank of India v. Hare Ram Singh & Anr. revisited the other end of the digital banking ecosystem, i.e., the customer. The judgment is significant because it clarifies the meaning of customer negligence in an era where cyber fraud increasingly relies on social engineering rather than direct credential theft.
The dispute arose after the customer clicked on a fraudulent hyperlink purportedly issued by the bank, following which unauthorised transactions were executed from his account. Although the customer consistently maintained that he had never disclosed his passwords or OTPs to any third party, the Division Bench declined to impose liability on the bank, holding that the absence of conscious disclosure does not, by itself, eliminate the possibility of customer negligence.
The Court’s interpretation further clarified that Clause 7(i), which refers to situations where a customer has “shared payment credentials”, is illustrative rather than exhaustive. Consequently, customer negligence is not confined to the deliberate disclosure of passwords, PINs or OTPs.
It may equally arise where a customer, despite repeated security advisories, interacts with suspicious hyperlinks, downloads malicious applications or otherwise compromises the security of the authentication process through avoidable digital conduct.
This interpretation reflects an important recognition of the changing nature of cybercrime. Modern phishing and vishing attacks rarely depend upon customers voluntarily handing over confidential information. Instead, malware, fake banking portals and session hijacking techniques are designed to silently capture credentials without the victim’s knowledge. By acknowledging these realities, the Court aligned the standard of customer negligence with the technological sophistication of contemporary cyber fraud.
The judgment also carefully distinguished the Kerala High Court’s decision in Tony Enterprises v. Reserve Bank of India[1], where the fraud had been facilitated through a proven instance of SIM swapping. Unlike Tony Enterprises, the Delhi High Court found no evidence that the bank’s systems or the telecommunications infrastructure had been compromised. While Tony Enterprises and the Karnataka High Court decision involve institutional failures external to the customer, the Delhi High Court decision concerns a compromise originating from customer interaction with a malicious link.
An Emerging Framework for Allocating Liability
At first glance, the Karnataka and Delhi High Court decisions appear to reach opposing conclusions. However, a closer examination reveals that both Courts adopted a remarkably similar analytical approach. Rather than asking who ultimately suffered the financial loss or who processed the disputed transaction, both Courts focused on identifying where the integrity of the digital authentication process was first compromised. Liability, therefore, was determined by locating the earliest point of failure within the authentication ecosystem.
In Karnataka High Court’s decision, the interception of OTPs was not viewed as a consequence of the fraud but as the event that rendered the banking authentication process fundamentally unreliable. Since the breach arose from the telecom provider’s failure to follow adequate verification procedures, responsibility appropriately rested with the institution that enabled the compromise. Conversely, the Delhi High Court found no evidence that either the bank’s systems or the telecommunications infrastructure had been compromised. Instead, the authentication process was disrupted when the customer interacted with a malicious hyperlink that facilitated the capture of banking credentials. In the absence of any institutional deficiency supported by technical evidence, the Court declined to transfer the resulting loss to the bank. Viewed together, the decisions establish that digital banking liability is no longer determined solely by identifying the institution involved in the transaction but by identifying the participant whose failure first compromised the security architecture of the transaction itself.
This approach reflects the practical realities of modern cyber fraud, where unauthorised transactions are rarely attributable to a single isolated event but instead arise from failures occurring at different stages of the digital authentication process.
[3] Tony Enterprises v. Reserve Bank of India AIRONLINE 2019 KER 674
Along with Banks and Telecom service providers, the customers are equally expected to exercise reasonable digital vigilance by avoiding conduct that unnecessarily exposes authentication credentials to compromise. Liability therefore follows the participant whose omission or negligence first breaks the chain of digital trust. Ultimately, the combined effect of these decisions is not to expand or restrict liability for any single stakeholder, but to provide a more coherent methodology for resolving cyber fraud disputes.
As digital payment systems become increasingly sophisticated and cyber threats continue to evolve, this emerging approach is likely to play an increasingly important role in resolving disputes arising from unauthorised electronic banking transactions. In that sense, these decisions mark an important shift in Indian cyber jurisprudence. Liability for unauthorised electronic banking transactions is increasingly being determined not by identifying who executed the transaction, but by identifying whose failure first compromised the chain of digital trust upon which modern banking depends.
The article is authored by Ms. Tripti Vini (Senior Partner), Mr. Rahul Jain (Partner), Ms.Yashica Dhawan (Associate)
