Lost Money to Cyber Fraud After Sharing an OTP? When Your Bank May Still Have to Refund You

"You shared the OTP, so it is your fault." Cyber fraud victims hear this line from banks all the time, and most of them accept it. A judgment reported on 19 October 2026 shows that the answer is not always that simple. The Kerala High Court directed the State Bank of India to refund Rs 3.73 lakh to a customer who lost the money after sharing OTPs with a fraudster, because the bank could not show that she was a party to the fraud.

What happened in the case

As reported, the customer received an SMS saying her old, non-chip debit card would be blocked and could be reactivated online. A caller from the same number told her that her help was needed to reactivate the card and asked for OTPs to register the "State Bank Secure App". She shared them. Within moments, about Rs 3.73 lakh was debited from her savings account.

She reported the fraud to the bank's customer care the same day, her internet banking was blocked, and she also complained to the branch and to the police. The police identified the person who had taken the money. Even so, the money was not returned, and the Banking Ombudsman rejected her complaint on the ground that she was privy to the transaction. She then approached the High Court (Remadevi T.L. v. Reserve Bank of India and Others, W.P.(C) No. 28970 of 2021, decided by Justice Harisankar V. Menon).

What the High Court decided

• The bank did not dispute her account of how the fraud happened, and the police report supported her.
• She reported the fraud promptly, on the same day.
• The bank did not prove that she was privy to the fraudulent transaction.
• Her case therefore fell under the RBI's "zero liability" protection for third-party breaches, not under the clause that makes a negligent customer bear the loss.
• The court also criticised the bank for not re-crediting the amount after the complaint and for taking no further steps even after the police identified the fraudster.

The court set aside the Ombudsman's order and directed SBI to make good the loss within four weeks. It relied on an earlier 2024 Division Bench judgment of the Gauhati High Court in a similar case, against which the Supreme Court had dismissed the bank's appeal.

The RBI rules behind the judgment

The key document is the RBI circular "Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions" dated 6 July 2017. In simple terms:

• Zero liability applies where the fraud is due to the bank's own fault or deficiency, or where it is a third-party breach (the fault lies neither with the bank nor with the customer) and the customer informs the bank within three working days of receiving the bank's message about the transaction.
• Limited liability applies if the customer reports after four to seven working days. The customer's loss is then capped (for most savings accounts, at Rs 10,000 per transaction).
• Where the loss is due to the customer's own negligence, such as sharing payment credentials, the customer bears the loss until it is reported. Any loss after reporting is the bank's.
• The bank must provisionally credit (a "shadow reversal") the disputed amount within 10 working days of the customer's report, and must resolve the complaint within 90 days.
• Most importantly: "The burden of proving customer liability in case of unauthorised electronic banking transactions shall lie on the bank."

Does this mean every OTP fraud will be refunded?

No. This is the part that is easy to get wrong. Each case turns on its own facts. Banks regularly argue that sharing an OTP is negligence, and in many cases that argument succeeds. The Kerala case went the customer's way because she reported at once, the bank did not dispute her version, the police record backed her, and the bank could not prove she was in on the fraud. Frauds where the victim knowingly transfers money to someone, for example in fake investment schemes or "digital arrest" calls, are usually treated differently. The bank may also choose to challenge the judgment.

What the judgment does show is that "you shared the OTP" is not the end of the matter. The bank has to prove the customer's liability, and a victim who acts quickly is in a much stronger position.

If it happens to you: practical steps

1. Report to the bank immediately, through its official helpline, app or branch, and get a written complaint or reference number. The three-working-day window matters.
2. Call 1930 and file a complaint on cybercrime.gov.in, and keep the acknowledgement number.
3. Preserve everything: the SMS, call logs, the caller's number, screenshots and your bank statement.
4. Ask the bank in writing for a shadow reversal under the RBI circular and for a written decision on your liability.
5. If the bank refuses or does not respond, you can approach the RBI Ombudsman under the RBI's Integrated Ombudsman Scheme. Where that fails, a consumer commission or, in appropriate cases, the High Court may be options.

For the first steps in more detail, see Lost Money to an Online Fraud? What to Do in the First 24 Hours. If your account has been frozen because fraud money passed through it, see Bank Account Frozen by Cyber Police?