Pallabh Bhowmick v. State Bank of India

Case Comment: Pallabh Bhowmick v. State Bank of India

Written by Vanshika Wadhawan¹ and Ms. Aditi Mishra²

Citation: 2025 Live Law (SC) 22

Bench: Pardiwala, J.B., Mahadevan, R.

Introduction

The growth of digital banking in India has coincided with an equally concerning increase in cyber fraud. Millions of ordinary people use smartphones and online banking platforms for their financial transactions, which makes them more susceptible to sophisticated social engineering attacks capable of emptying a savings account in a matter of minutes. Pallabh Bhowmick v. State Bank of India is one of the most significant recent rulings addressing the rights of a bank customer who falls victim to such cyber theft through no fault of their own.

The case began as a writ petition before the Gauhati High Court and eventually reached the Supreme Court of India; along the way, it raised important questions about the duty of care a scheduled commercial bank owes its clients, how to interpret the Reserve Bank of India’s circular on customer liability for unauthorized electronic transactions, and whether a customer’s act of downloading a third-party application at a fraudster’s request can amount to contributory negligence. The Supreme Court’s decision to reject the State Bank of India’s Special Leave Petition, and to uphold the High Court’s order directing reimbursement of the money that was stolen, sends a strong message to the banking industry about the non-negotiable nature of its fiduciary obligations.

This analysis methodically examines the facts, the legal issues presented, the applicable regulatory framework, the reasoning of the courts at each stage, and the wider implications of this landmark ruling for the evolving landscape of consumer protection in India’s digital banking sector.

Historical Background and Facts

To fully appreciate this case’s significance, it helps to place it within the broader story of India’s rapid transition to digital banking. Digital payment platforms spread across the country following the government’s demonetization initiative in November 2016 and the subsequent push toward a cashless economy. For millions of people, this shift was a convenience; it also, however, created room for a new category of financial crime: social-engineering-based cyber fraud.

The respondent and original petitioner, Pallabh Bhowmick, held a savings account at the Guwahati branch of the State Bank of India. On October 18, 2021, he attempted to return a blazer and obtain a refund after purchasing it from a Louis Philippe store. While searching for customer service contact information, he inadvertently reached an unreliable channel and received a call from someone posing as a Louis Philippe customer care manager. The caller told Bhowmick that, to process the refund, he needed to download a particular mobile application.

Trusting the caller, Bhowmick downloaded the application, unaware that it was malicious and that it granted the fraudster remote access to his bank account and mobile device. Three unauthorized electronic transactions totaling Rs. 94,204.80 (Rupees Ninety-Four Thousand Two Hundred and Four, and Eighty Paise only) were made from his SBI savings account that same day.

Once he discovered the unauthorized debits, the petitioner acted swiftly. He called SBI customer service that same day, October 18, 2021, requesting that the fraudulent transactions be reversed; SBI blocked his debit card and logged a complaint. That same evening, he also filed a First Information Report at the Jalukbari Police Station, registered as Case No. 1229/2021. The following day, October 19, 2021, he lodged a formal written complaint about the fraudulent transactions with SBI’s Guwahati branch. He additionally reported the matter to the Ministry of Home Affairs’ National Cyber Crime Reporting Portal, filed three separate complaints with the Assam Police’s Cyber Cell of the Criminal Investigation Department, and submitted an online complaint through the RBI Integrated Ombudsman Scheme, 2021.

Despite the customer’s prompt and thorough effort to alert every relevant authority within a single working day, the State Bank of India took no significant corrective action. Crucially, SBI neither filed a charge-back request with the beneficiary bank or merchant platform through which the funds were drained, nor lodged a complaint of its own with the cybercrime authorities. Instead, the bank argued that because the transactions were routed through Google Pay — a third-party application SBI did not endorse — it bore no liability for the resulting loss.

After the RBI Ombudsman ruled against him on March 7, 2022, the petitioner approached the Gauhati High Court under Article 226 of the Constitution. By an order dated September 30, 2022, the High Court’s Single Judge set aside the Ombudsman’s ruling and directed SBI to deposit the full sum of Rs. 94,204.80 into the petitioner’s account, while granting SBI liberty to recover the amount from the merchant through whose platform the fraud occurred. On September 13, 2024, the Division Bench of the Gauhati High Court dismissed SBI’s Writ Appeal No. 364 of 2022 challenging that order. SBI then approached the Supreme Court of India by way of a Special Leave Petition, which was likewise dismissed on January 3, 2025.

Issues Raised

The case brought before the courts several interconnected legal issues sitting at the intersection of information technology law, banking law, consumer protection, and constitutional guarantees:

1. Whether a bank can avoid liability by attributing the loss to a customer’s download of a malicious third-party application, where the unauthorized transaction was in fact caused by a third-party breach facilitated through fraudulent impersonation of a brand’s customer care.
2. Whether a customer’s act of downloading a fraudulent application qualifies as “negligence” under the RBI Circular dated July 6, 2017, absent any proof that the customer disclosed an OTP, MPIN, or other authentication credential.
3. Whether the bank breached its duty of care by failing to take prompt corrective action — such as filing a complaint with cybercrime authorities and initiating a charge-back with the beneficiary bank — after learning of the fraud within one working day.
4. What circumstances must be satisfied for a bank’s “zero liability” obligation under the RBI’s 2017 circular to be triggered in cases involving third-party breaches.
5. Whether banks are legally required to safeguard customer deposits against unauthorized third-party involvement under Section 5 of the Banking Regulation Act, 1949, Section 10 of the Reserve Bank of India Act, 1934, and the Consumer Protection Act, 2019.

Applicable Rules and Legal Framework

The legal framework governing this dispute draws on several sources that, together, define the standard of care expected of a commercial bank in cases of unlawful digital transactions.

A. RBI Circular dated July 6, 2017

The Reserve Bank of India’s circular on customer protection in unauthorized electronic banking transactions — issued under the authority of Section 35A of the Banking Regulation Act, 1949 — is the most important instrument in this case. It classifies unauthorized transactions according to whether fault lies with the bank, a third party, or the consumer. Clause 7(1) requires banks to ensure customers are not held liable for unauthorized transactions arising from third-party breaches unconnected to any negligence on the customer’s part. Clause 8 grants the customer zero liability where an unauthorized transaction results from a breach at the bank’s end, or from a third-party breach without customer fault, provided the customer reports the incident to the bank within three working days. Clause 9 limits customer responsibility in cases involving customer negligence, while Clause 10 places the burden of proving customer fault squarely on the bank.

B. Banking Regulation Act, 1949 — Section 5

Section 5 defines banking as, in essence, accepting deposits repayable on demand. The courts in this case relied on this provision to underscore that a bank’s primary responsibility is to protect its clients’ deposited funds from unlawful interference.

C. Reserve Bank of India Act, 1934 — Section 10

Section 10 gives the RBI supervisory jurisdiction over scheduled banks, including the power to issue directives for depositor protection. Read together, the 2017 circular and the courts’ interpretation of this provision form a legally enforceable framework from which banks cannot deviate, even where transactions are technically routed through third-party platforms.

D. Consumer Protection Act, 2019

Under the Consumer Protection Act, 2019, a “deficiency in service” broadly covers any fault, imperfection, or shortfall in the standard of service a provider is bound to maintain. SBI’s failure to take prompt corrective action after learning of the fraud — including its failure to file a charge-back or a cyber complaint — squarely met this standard and exposed the bank to liability under consumer protection jurisprudence.

E. Information Technology Act, 2000 — Sections 66C and 66D

Section 66C penalizes identity theft and the unauthorized use of another person’s electronic signature, password, or other unique identifying feature, while Section 66D penalizes cheating by personation using a computer resource. These provisions were invoked to place the fraudster’s conduct — impersonating Louis Philippe’s customer service — in proper context, confirming that the malicious app download resulted from criminal deception rather than any willful disregard on the customer’s part.

Taken together, these five sources gave the courts a coherent basis for allocating liability away from the customer and squarely onto the bank.

Judgment

At every stage of the dispute, the courts ruled against the State Bank of India and in favor of the customer. The reasoning at each level is set out below.

A. Gauhati High Court — Single Judge (September 30, 2022)

The Single Judge set aside the Ombudsman’s order and directed SBI to reimburse the petitioner the full sum of Rs. 94,204.80. This conclusion rested on undisputed facts: the merchant, Louis Philippe, had admitted a breach of customer data; the petitioner had notified the bank on the very day the fraud occurred; and the bank produced no evidence that the petitioner had disclosed his OTP or MPIN to anyone. The court held that the zero-liability clause of the RBI Circular applied in the absence of any proof of customer negligence, and criticized the bank for its total passivity — in particular, its failure to file a charge-back request with the beneficiary bank or lodge a complaint with cybercrime authorities, two of the most basic remedial steps a bank should take after learning of a theft.

B. Gauhati High Court — Division Bench (September 13, 2024)

The Division Bench, comprising Justices Lanusungkum Jamir and Kardak Ete, dismissed SBI’s writ appeal and upheld the Single Judge’s ruling in full. The bench affirmed that downloading an application at the request of a caller posing as a brand’s customer service representative does not amount to negligence under the RBI Circular, since the fraudster had used a sophisticated social engineering technique to exploit an ordinary customer’s trust. The court emphasized that the burden of proving customer negligence rested solely on the bank, and that burden had not been discharged. The bench cited DAV Public School v. Indian Bank, (2019) 20 SCC 31, for the proposition that banks cannot unilaterally shift liability onto customers absent substantial proof of fault.

C. Supreme Court of India (January 3, 2025)

The Supreme Court bench of Justices J.B. Pardiwala and R. Mahadevan dismissed SBI’s Special Leave Petition, affirming the concurrent findings of both Gauhati High Court benches. The Court held that all three transactions were fraudulent and unlawful; that the customer had reported the fraud within hours, satisfying the requirement for zero liability; and that the bank had breached its duty of care by failing to deploy its own technological resources to identify, flag, and halt the suspicious transactions. In upholding the High Court’s ruling, the Supreme Court sent a clear message that banks cannot absolve themselves of responsibility in cyber fraud cases merely by pointing to a customer’s download of an unverified program or by invoking third-party intermediaries.

Analysis

Pallabh Bhowmick v. State Bank of India merits close examination for several reasons. It is the product of a judicial trajectory that has consistently sought to align the legal obligations of Indian commercial banks with the realities of a rapidly digitizing financial ecosystem.

A. The “Zero Liability” Standard and Its Judicial Interpretation

The RBI’s 2017 circular marked a significant advance in Indian banking consumer protection. Before it, there was no uniform standard for allocating fault between banks and customers in cases of unauthorized transactions, and banks often escaped liability by alleging customer fault. To protect the vast majority of consumers who promptly report fraud, the circular established a three-tiered framework: zero liability for third-party breaches, limited liability where fault is mixed, and full liability on the customer only where gross negligence is proven.

The courts in this case helped define “customer negligence” for the age of modern cyber fraud in clear and principled terms, categorically rejecting the argument that downloading a mobile application is, by itself, careless. This makes analytical sense. Social engineering scams succeed precisely because the perpetrator impersonates a reputable, trusted organization — here, the customer service arm of a well-known clothing brand. It is unrealistic to expect an ordinary, reasonable consumer to independently verify the legitimacy of every caller claiming to represent customer support. Imposing such an expectation would hold the average Indian consumer to an unreasonably high standard of digital literacy, undermining the very protection the RBI Circular was designed to provide.

B. The Bank’s Duty of Prompt Corrective Action

One of the ruling’s most significant contributions is its emphasis on a bank’s duty to respond to customer complaints promptly and effectively. The courts viewed SBI’s conduct as especially troubling not merely because it declined to reimburse the funds, but because it took no proactive steps at all — no cyber complaint, no contact with the beneficiary bank, no attempt to reverse the transaction through the charge-back mechanism customary in the banking sector.

This pushes banks toward an active, interventionist posture once fraud is reported, expanding the duty of care beyond the passive receipt of complaints. A bank cannot, having done nothing after a timely fraud notification, later claim that the customer’s app download was the sole cause of the loss. Here, the bank’s own inaction was itself a contributing cause of the harm — harm that timely charge-back procedures might have prevented, in whole or in part.

C. Relevant Case Law

Several earlier decisions provide a useful comparative backdrop for assessing this judgment’s significance.

In DAV Public School v. Indian Bank,³ the Supreme Court emphasized the fiduciary character of the bank–depositor relationship, holding that a bank is duty-bound to safeguard a customer’s money and act in good faith. The Gauhati High Court applied this same reasoning, citing the decision to reject SBI’s attempt to shift the loss onto the customer.

In Justice (Retd.) Basudev Agarwal v. SBI,⁴ the court similarly held that merely invoking a third-party platform does not absolve a bank of responsibility for unlawful transactions; a bank’s fundamental liability to the consumer is unaffected by its decision to permit third-party applications to interface with its systems.

In Hare Ram Singh v. Reserve Bank of India,⁵ the Delhi High Court clarified that financial institutions bear a legal obligation to protect customers and to balance their adoption of technological innovation with accountability, treating the failure to file a charge-back request after fraud is reported as a clear breach of that obligation.

In ICICI Bank Ltd. v. Pravin Kumar Agarwal,⁶ the principle that a bank cannot rely on bare allegations, and must discharge its burden of proving customer fault with concrete evidence, was reaffirmed — a standard applied directly in the Bhowmick case, where no evidence supported SBI’s claim that the petitioner had disclosed his OTP.

D. The Bank’s Technological Responsibility

Beyond its factual findings, this case raises deeper questions about the technological responsibilities of commercial banks. The Supreme Court expressly noted SBI’s failure to make effective use of its own technological resources to stop the fraud — a significant finding. In the digital era, banks are not passive repositories of money but complex technological institutions equipped with fraud-detection algorithms, transaction-monitoring systems, and real-time alert mechanisms. When three transactions totaling nearly a lakh of rupees are executed from a savings account in rapid succession, a bank’s systems should flag this as unusual activity and trigger security measures.

The failure of such systems, or their inadequate deployment, cannot be treated as a neutral background fact; it forms part of the bank’s own contribution to the customer’s harm. This interpretation brings the Indian position in line with the trajectory of banking regulation in jurisdictions such as the United Kingdom and the European Union, where a bank’s duty of care similarly requires the deployment of appropriate fraud-prevention measures.

Aftermath of the Judgment

The Supreme Court’s dismissal of SBI’s Special Leave Petition on January 3, 2025 has had immediate and significant implications for India’s banking industry and consumer protection law.

First, the ruling establishes a clear, repeatable precedent: a bank customer is entitled to a full refund of any amount lost to cyber fraud caused by a third-party breach, provided the fraud is reported within three working days and the customer did not share authentication credentials such as an OTP or MPIN. A bank cannot defeat this entitlement by alleging vague, unsupported negligence.

Second, banks now have a compelling incentive to strengthen their internal fraud-response systems. SBI’s specific criticism for failing to file a cyber complaint and initiate charge-back proceedings will likely prompt banks generally to review and improve their standard operating procedures for handling fraud complaints.

Third, the ruling reinforces the legal force of RBI circulars as a source of enforceable consumer rights. Although the 2017 circular was issued under regulatory authority, its practical effect depended on courts’ willingness to treat it as imposing binding obligations — and both the Gauhati High Court and the Supreme Court have now made that unambiguous.

Fourth, legislative change has further strengthened the surrounding legal framework. The Bharatiya Nyaya Sanhita, 2023, which replaced the Indian Penal Code with effect from July 1, 2024, introduced Section 320, addressing the fraudulent removal or concealment of property intended to injure creditors and carrying a mandatory minimum sentence of six months — a reflection of the legislature’s recognition that financial fraud warrants more robust deterrence than the previous penal framework provided.

Conclusion

Pallabh Bhowmick v. State Bank of India marks an important turning point in the development of consumer rights within India’s digital financial landscape. It tells the story of an ordinary citizen who was deceived by a fraudster and who promptly complied with every reporting requirement — notifying the bank, the police, the cyber cell, and the RBI — yet still had to endure years of litigation before a bank acknowledged its duty to compensate him.

The ruling affirms several crucial principles: that zero liability means zero liability, not negotiable liability; that promptly reporting fraud discharges the customer’s obligation and triggers the bank’s duty to act; that downloading an application as a result of criminal deception does not constitute negligence; and that a bank cannot, having received a timely fraud complaint and done nothing further, later shift the blame onto the victim.

At every level, the courts displayed both a clear-eyed understanding of the realities of digital banking fraud and a welcome clarity of purpose. This ruling sets a standard for how the Indian banking sector as a whole must approach its responsibilities to the millions of customers who entrust it with their savings in an increasingly digital, fraud-prone environment — it does far more than resolve a dispute between one consumer and one bank.

Looking ahead, it remains desirable for the RBI and the legislature to further strengthen the statutory framework: by mandating real-time fraud-detection systems, setting firm deadlines for banks to initiate charge-back requests, and establishing a dedicated fast-track adjudicatory mechanism for cyber fraud claims. The ruling in Pallabh Bhowmick is a significant advance — but it is the beginning of that journey, not its end.

Reference(S):

1. State Bank of India v. Pallabh Bhowmick, SLP (C) No. 30677 of 2024, Supreme Court of India, January 3, 2025; 2025 Live Law (SC) 22.
2. State Bank of India v. Pallabh Bhowmick & Ors., Gauhati High Court, September 13, 2024 (GAHC010232752022), WA No. 364/2022.
3. WP(C) No. 1900/2022 (Single Judge Order), Gauhati High Court, September 30, 2022.
4. RBI Circular RBI/2017-18/15 DBR.No.Leg.BC.78/09.07.005/2017-18 dated July 6, 2017 — Customer Protection: Limiting Liability of Customers in Unauthorized Electronic Banking Transactions.
5. DAV Public School v. Indian Bank, (2019) 20 SCC 31, Supreme Court of India.
6. Hare Ram Singh v. Reserve Bank of India & Ors., Delhi High Court, W.P.(C) 13497/2022; 2024 SCC Del 8039.
7. ICICI Bank Ltd. v. Pravin Kumar Agarwal, O.A. No. 71 of 2018, July 23, 2019.
8. Justice (Retd.) Basudev Agarwal v. State Bank of India, WP(C) No. 3474/2022.
9. Banking Regulation Act, 1949 — Section 5.
10. Reserve Bank of India Act, 1934 — Section 10.
11. Consumer Protection Act, 2019.
12. Information Technology Act, 2000 — Sections 66C and 66D.
13. Bharatiya Nyaya Sanhita, 2023 — Section 320 (replacing Indian Penal Code Section 421, with effect from July 1, 2024).

Footnote(S):

1. Vanshika Wadhawan, 2nd-year student, 5-year BBA.LL.B (H), Quantum University, Roorkee.

2. Ms. Aditi Mishra, Assistant Professor, Quantum University.

3. DAV Public School v. Indian Bank, (2019) 20 SCC 31.

4. Justice (Retd.) Basudev Agarwal v. SBI, WP(C) No. 3474/2022.

5. Hare Ram Singh v. Reserve Bank of India, W.P.(C) 13497/2022, 2024 SCC Del 8039.

6. ICICI Bank Ltd. v. Pravin Kumar Agarwal, O.A. No. 71 of 2018.