Lost money after sharing an OTP? Kerala High Court orders SBI refund under RBI zero liability rule
The Kerala High Court told SBI to refund ₹3.73 lakh to a fraud victim who shared an OTP. What RBI's zero liability rule says and how to claim a refund.
Many people think that once you share an OTP with a fraudster, the bank owes you nothing. A ruling of the Kerala High Court, reported on 19 and 20 October 2026, shows it is not always that simple. Here is what happened and what the rule says.
What the court decided
A retired college principal in Kannur district held an SBI savings account. On 13 July 2019 she got an SMS saying her debit card would be blocked, then a call from the same number. The caller asked for an OTP to "register" the bank's security app. She shared it, and ₹3,73,000 was taken from her account.
She called the bank's customer care at once, and her internet banking was blocked. She complained to the branch and to the police the same day. A police inquiry traced the money to a person in West Bengal. The Banking Ombudsman still rejected her complaint, so she went to the High Court.
On 5 October 2026, Justice Harisankar V. Menon set aside the Ombudsman's order. The court held that she was not part of the fraud, that the bank had not proved she was negligent, and that she had reported the fraud the same day. So she was entitled to zero liability under RBI's rules. SBI was told to restore ₹3,73,000 within four weeks. This is under the judgment in WP(C) No. 28970 of 2021, as reported by LiveLaw and Financial Express.
This is one judge's decision on the facts of one case. It does not mean every customer who shares an OTP will get the money back.
What RBI's zero liability rule says
RBI's rules on unauthorised electronic transactions, first set in a circular of 6 July 2017, decide who bears the loss:
- Bank at fault: if the fraud happened because of the bank's negligence or a gap in its systems, you lose nothing, whenever you report it.
- Third-party breach: if neither you nor the bank is at fault, you lose nothing if you tell the bank within 3 working days of getting its alert.
- Reported in 4 to 7 working days: your loss is capped. It is ₹5,000 for a basic savings (BSBD) account, ₹10,000 for other savings accounts and credit cards with a limit up to ₹5 lakh, and ₹25,000 for most other accounts, or the transaction amount if that is lower.
- Your negligence: if the loss is due to your negligence, such as sharing your card details or OTP, you bear the loss until you report it. Anything taken after you report is the bank's loss.
Two more points matter. The bank must prove that you were negligent, you do not have to prove you were not. And once you report, the bank must credit the disputed amount to your account, at least for the time being, within 10 working days, and settle the complaint within 90 days.
What to do if money is taken from your account
- Report at once. Use the bank's app, toll-free number or the reply option in its SMS alert, and block your card or net banking. Note the complaint number.
- Call 1930 or file a complaint at cybercrime.gov.in. Also tell the police in writing.
- Keep proof: the SMS alerts, call records, screenshots, complaint numbers and the time you reported.
- Ask the bank in writing for a temporary credit under RBI's rule on limiting customer liability.
- If the bank says no or does not reply within 30 days, complain to the RBI Ombudsman at cms.rbi.org.in.
The safest rule is still the simplest: no bank, RBI, police or government officer will ever ask for your OTP, PIN or CVV. Do not share it, even if the call or SMS looks real.
Sources: Kerala High Court: judgment in WP(C) No. 28970 of 2021, 5 October 2026, LiveLaw: Kerala High Court orders SBI to refund ₹3.73 lakh to cybercrime victim, Financial Express: Kerala HC orders bank to refund Rs 3.73 lakh, RBI: Limiting liability of customers in unauthorised electronic banking transactions, 6 July 2017, RBI Complaint Management System, National Cyber Crime Reporting Portal.
Rules, rates and limits change. Check the official source linked above before you rely on a figure here. Posts never contain referral or affiliate links from the writer.
Want to write for Saifu? Here is how.