ENCO Legal | Legal Insights | 20 October 2026
Quick Answer: Can a Bank Refuse a Refund If You Shared an OTP?
Sharing an OTP can amount to customer negligence, but it does not automatically resolve every dispute about an unauthorised banking transaction. Under the applicable RBI framework, liability depends on the circumstances, the cause of the loss, the evidence of negligence and prompt reporting. In Remadevi T.L. v. Reserve Bank of India & Others, 2026:KER:76636, the Kerala High Court directed SBI to reimburse ₹3,73,000 after finding that the bank had not established the customer’s responsibility for the fraudulent withdrawals. This judgment does not guarantee refunds in every OTP-sharing case.
What Happened in the Kerala High Court Case?
Remadevi T.L., a retired college principal and SBI account holder, received communications in July 2019 suggesting that her debit card required reactivation. A caller persuaded her to share an OTP for registration of an application described as the State Bank Secure App. She believed a further authentication step would be needed before funds could be debited. Subsequently ₹3,73,000 was withdrawn from her account. She immediately contacted the bank, later complained to the branch and police, and approached the Banking Ombudsman after reimbursement was refused.
A police investigation identified a suspected fraudster who allegedly created four digital wallets and transferred the funds. The Ombudsman rejected the complaint, treating the petitioner as responsible for the transactions. She challenged that decision in the Kerala High Court.
What Was the Legal Question?
The central issue was whether the case fell under the zero-liability provision for qualifying third-party breaches in Clause 6(ii) of the RBI circular dated 6 July 2017, or under Clause 7(i), which addresses losses caused by customer negligence, including disclosure of payment credentials.
Clause 6(ii): Zero liability for certain third-party breaches
Where the deficiency lies neither with the bank nor the customer but elsewhere in the system, a customer may have zero liability if the unauthorised transaction is reported within three working days of receiving the bank’s communication, subject to the circular’s conditions.
Clause 7(i): Customer negligence
Where loss is caused by customer negligence, such as sharing payment credentials, the customer bears the loss until reporting the unauthorised transaction to the bank. Subsequent losses are borne by the bank. Reporting within three working days does not automatically remove liability where customer negligence caused the loss.
What Did the Kerala High Court Decide?
Justice Harisankar V. Menon examined the petitioner’s explanation, the bank’s response, prompt reporting and police investigation. The Court noted that material aspects of the petitioner’s account had not been specifically denied and that the bank had not established her complicity in the fraudulent withdrawals. It found that Clause 6(ii) applied, set aside the Ombudsman’s rejection and directed SBI to reimburse ₹3,73,000 within four weeks.
Case: Remadevi T.L. v. Reserve Bank of India & Others; Case number: W.P.(C) No. 28970 of 2021; Neutral citation: 2026:KER:76636; Judgment date: 5 October 2026; Judge: Justice Harisankar V. Menon.
Does Sharing an OTP Always Mean Customer Negligence?
Sharing an OTP is a serious security risk and may constitute negligence under the RBI framework. But the bank must substantiate its position with evidence rather than rely on unsupported assumptions. The legal analysis can involve the manner in which credentials were obtained, the transaction authentication process, warnings, any third-party breach and the customer’s actions. The Kerala High Court did not declare OTP sharing harmless; it assessed the particular evidence.
Two situations can have different legal consequences
If a customer knowingly discloses credentials to an unknown caller despite warnings and that disclosure causes the loss, Clause 7(i) may be relevant. Where a sophisticated deception and disputed application-registration process are involved, the bank’s evidence and the customer’s prompt complaint may lead to a different assessment. Neither outcome is automatic.
What Does RBI’s Three-Working-Day Rule Say?
The 6 July 2017 circular provides zero liability for contributory fraud, negligence or deficiency by the bank, irrespective of reporting. For qualifying third-party breaches, reporting within three working days may result in zero liability. Reporting after four to seven working days can result in limited liability under prescribed account-based limits. For reporting beyond seven working days, the bank’s board-approved policy becomes relevant. Customer negligence is separately addressed in Clause 7(i).
Who Must Prove Customer Liability?
The RBI circular places the burden of proving customer liability on the bank. Relevant evidence can include transaction logs, authentication records, complaint timestamps, communications, investigation reports and police findings. Customers should provide accurate information and cooperate with the investigation.
What Should You Do Immediately After Cyber Fraud?
1. Notify your bank immediately
Use an official fraud-reporting channel, ask for blocking of affected credentials or instruments where necessary and obtain a complaint reference number.
2. Report the suspected cybercrime
Call 1930 or report through the official National Cyber Crime Reporting Portal. Quick reporting may assist tracing or freezing funds.
3. Preserve evidence
Keep transaction alerts, statements, screenshots, messages, call records and complaint acknowledgements.
4. Submit a written complaint
Follow any telephone complaint with a written report identifying disputed transactions and the relief sought.
5. Request the bank’s liability assessment
Ask whether the bank attributes the loss to its own deficiency, a third-party breach or customer negligence, and seek reasons for its conclusion.
6. Examine further remedies
Where a complaint is unresolved or rejected, examine eligibility for the RBI Ombudsman process, consumer remedies or appropriate judicial proceedings. A police complaint does not replace notification to the bank.
How Long Does the Bank Have to Reverse an Unauthorised Transaction?
Under the 2017 framework, banks must provide the prescribed provisional credit or shadow reversal within 10 working days of notification, subject to the circular. Liability determination must be completed within the prescribed period, not exceeding 90 days. A provisional credit is not necessarily the final decision on customer liability.
What If the Bank Rejects Your Complaint?
The RBI Integrated Ombudsman Scheme offers a cost-free route for eligible complaints after the required initial complaint process with the bank. A customer may examine the RBI Complaint Management System. Depending on the facts, the Consumer Protection Act, 2019, and appropriate court proceedings may also be relevant. The Kerala case demonstrates that an Ombudsman decision may be judicially scrutinised in appropriate circumstances.
What Changes Under RBI’s Revised Framework From January 2027?
Revised RBI directions have been described as applying to covered fraudulent electronic banking transactions undertaken on or after 1 January 2027. The reported framework includes different reporting arrangements and a conditional small-value compensation mechanism. Readers should consult the operative RBI directions applicable to their bank and transaction date before relying on any future-rule entitlement. These later requirements should not be retrospectively assumed to govern a transaction occurring in October 2026.
Does the Kerala Judgment Guarantee a Refund in Every OTP Fraud?
No. The result depends on the applicable regulatory directions, evidence, transaction circumstances and reporting. A further distinction may arise between unauthorised transactions and payments a customer knowingly initiated after being deceived about the recipient or underlying purpose.
Frequently Asked Questions
Can I recover money after sharing an OTP?
Possibly, but not automatically. The circumstances, applicable RBI directions and evidence of negligence matter.
What did the Kerala High Court order?
It directed SBI to reimburse ₹3,73,000 after finding that the customer’s liability had not been established in the case.
What is RBI’s zero-liability rule?
It protects customers in specified cases involving bank deficiency or qualifying third-party breaches reported within the prescribed period.
Is reporting within three working days enough in every case?
No. The rule is conditional, and losses caused by customer negligence are addressed separately.
Does OTP authentication prove customer authorisation?
Authentication is relevant, but disputed authorisation and negligence may require additional evidence.
Who must prove customer liability?
Under the 2017 RBI circular, the burden lies on the bank.
Where should I report online financial fraud?
Immediately notify the bank and report through 1930 or cybercrime.gov.in.
Can I complain to the RBI Ombudsman?
Eligible complaints can be brought after complying with the initial complaint requirements.
Do future RBI rules apply to older transactions?
The applicable rules depend on the transaction date and the commencement provisions of the relevant directions.
Does every fraud victim receive ₹25,000?
No. Any small-value compensation mechanism is subject to eligibility and prescribed conditions.
What is the Kerala case citation?
Remadevi T.L. v. Reserve Bank of India & Others, 2026:KER:76636, W.P.(C) No. 28970 of 2021, decided 5 October 2026.
Conclusion
The Kerala High Court’s judgment illustrates why cyber-fraud liability must be determined from evidence rather than assumptions about OTP disclosure. Sharing credentials may amount to negligence, but banks must apply the RBI framework and substantiate their conclusions. Customers should report unauthorised transactions immediately, preserve evidence and examine available remedies.
Legal Authorities and Sources
Remadevi T.L. v. Reserve Bank of India, judgment text, 5 October 2026. RBI Circular RBI/2017-18/15, Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 6 July 2017. RBI Complaint Management System. National Cyber Crime Reporting Portal.
Legal Disclaimer
This article is for general legal information and educational purposes only. It is not legal advice, an invitation to engage legal services or an advocate-client relationship. Liability and remedies depend on the transaction date, applicable directions, institution and facts of each case.
ENCO Legal | Legal Insights