The Bombay High Court has ruled that a customer bears no liability for unauthorized transactions resulting from a third-party breach, provided that neither the bank nor the customer is at fault.

“..a customer has zero liability when the unauthorized transactions occur due to a third party breach where the deficiency lies neither with the bank nor with the customer but elswhere in the system and the customer notifies the bank regarding the unauthorized transactions within a certain time frame,” the court said.

A division bench of the Bombay High Court, consisting of Justice GS Kulkarni and Justice Firdosh Pooniwalla, was hearing a petition challenging the banking ombudsman's decision not to compel Bank of Baroda to refund Rs. 76 lakhs lost by a customer due to cyber fraud.

The petitioner stated that on October 1, 2022, individuals were added as beneficiaries to their bank account without sending any OTP or notifying the petitioner. Subsequently, on the following day, Rs. 76 lakhs were transferred to various individuals from the petitioner’s account.

The petitioner approached the cyber police and filed a complaint. Concurrently, he approached the bank to initiate the process of recovering the money under the guidelines outlined in the 2017 RBI Circular titled "Customer Protection - Limiting Liability of Customers in Unauthorized Electronic Banking Transactions."

The petitioner also approached the banking ombudsman seeking the recovery of the money, but the application was rejected by the ombudsman.

The bank argued before the high court that only individuals with access to the bank account could add a beneficiary, suggesting negligence on the petitioner's part in adding the beneficiary, and attributing the loss to this negligence.

However, the high court reviewed the cyber cell report and determined that there was no negligence on the petitioner's part.

Consequently, the bench ordered the bank to reimburse Rs. 76 lakhs to the petitioner within six weeks.