A State Bank of India consumer commission order from October reminds us of a right most people do not know they have: if a bank ignores a cyber-fraud complaint, the bank is liable.
Most people who are defrauded online go through the same sequence: they call the bank, file a complaint, wait, and hear nothing. The customer is told that since the transaction was technically authorised by an OTP sent to their device, the bank cannot be held responsible. Consumer commissions across India have consistently rejected this position, and October produced another clear example. A forum directed SBI to compensate a customer after it failed to respond adequately to a reported cyber-fraud complaint. A bank's obligation does not end when a fraud is reported; it must act promptly to attempt to reverse or freeze the transfer, and failure to do so is a deficiency in service.
What the Law Requires Banks to Do
The RBI's framework on customer liability in unauthorised electronic transactions sets out obligations clearly. Where fraud occurs through the bank's own negligence, the customer bears no liability. Where it occurs through third-party breach without contributory fault by the customer, and the customer reports within three working days, the customer's liability is limited or zero. The moment you discover an unauthorised transaction, the clock starts. You are triggering a legal framework that determines how much, if anything, you must absorb.
How to File and What to Expect
File with the bank's published grievance channel first, in writing, with the exact date, time and amount. Keep the acknowledgment. If the bank does not respond within thirty days, approach the Banking Ombudsman through the RBI's Integrated Ombudsman Scheme, which is free. If that does not produce a satisfactory outcome, a consumer commission complaint is the next step.
October also saw orders against a holiday provider for Rs 1.75 lakh in refund plus Rs 1.5 lakh in compensation, an insurance company for Rs 38,000 over a fifty-nine-day delay on a stolen-motorcycle claim, and a technology firm for a Rs 400 digital-lock service fee that produced no service. The pattern is consistent: commissions are applying the Consumer Protection Act, 2019 to hold service providers accountable for deficiency and negligence alike.