Cyber fraud drains woman’s bank account; Canara Bank ordered to pay Rs 5.64 lakh

AI generated image used for representative purposeNEW DELHI: A district consumer commission in Delhi has directed Canara Bank to refund Rs 4.14 lakh to a woman who lost Rs 5.44 lakh in two unauthorised transactions after receiving a fraudulent call. It held that the bank could not shift the entire loss onto her merely because the transactions were authenticated using her banking credentials, as it failed to produce complete technical records establishing her voluntary authorisation or negligence.Case backgroundAs per the commission order, Vinita, a savings account holder with Canara Bank, received a fraudulent call on April 7, 2024, around 4 pm. The following morning, two unauthorised transactions of Rs 5 lakh and Rs 44,488 were made from her account through IMPS.She immediately reported the fraud to the Cyber Crime Helpline and approached the bank, requesting that her account be blocked. However, she alleged that the officials at the nearest branch failed to provide timely assistance and directed her to the Ganga Ram Hospital branch.By the time the account was blocked, Rs 5.44 lakh had been debited. Despite repeated follow-ups, only Rs 1.30 lakh, which had been placed on hold, was recovered and credited to her account. The remaining Rs 4,14,488 was not refunded.Vinita approached the commission, alleging deficiency in banking services and seeking a refund of the unrecovered amount with interest, compensation for mental agony and litigation expenses.In its written statement, the bank argued that she had interacted with the fraudsters and shared her mobile screen with them, compromising her confidential banking credentials. It said the disputed transactions were authenticated using her MPIN/UPIN and OTPs and that it had blocked her account immediately after receiving her complaint.The bank relied on the RBI's July 6, 2017, circular on customer liability for unauthorised electronic banking transactions, arguing that losses arising from customer negligence had to be borne by the account holder until the fraud was reported.Commission's findingsThe bench comprising president Poonam Chaudhry and member Bariq Ahmad held that the bank had failed to establish that Vinita had voluntarily authorised the disputed transactions. It said authentication through banking credentials did not, by itself, prove that the account holder had consented to the transfers."Therefore, authentication and authorization cannot, in every case, be treated as synonymous," the bench observed.Relying on the national consumer commission's ruling in State Bank of India v. Pradosh Kumar Banerjee, the commission said technical authentication could not be equated with voluntary authorisation in cases involving deceptive cyber fraud.It noted that the bank had failed to produce IP logs, device verification records, beneficiary-addition logs, transaction audit trails and evidence showing whether the applicable cooling-off and fraud-monitoring safeguards had been followed.The bench also said that although sharing her mobile screen could amount to negligence under the RBI framework, the bank could not simply rely on credential authentication without establishing the precise circumstances in which the transactions were initiated."The complainant, on the other hand, reported the transactions promptly and approached the bank on the same date. The bank's reliance solely upon credential authentication, without producing the complete transaction audit trail and relevant security records, is insufficient to discharge its evidentiary burden in the facts of the present case," the bench added.The commission rejected the bank's argument that the pending cybercrime investigation prevented it from deciding the consumer complaint. It said criminal proceedings against the fraudsters and proceedings concerning deficiency in banking services operated in different fields.It held that the bank had failed to establish that the entire loss resulted solely from the woman's negligence and that its failure to satisfactorily address the unauthorised transactions amounted to deficiency in service.Final orderAnnounced on October 28, 2026, the order allowed the complaint. The commission directed Canara Bank to pay:Rs 4,14,488, the unrecovered amount, with 9 percent annual interest from April 8, 2024, until realisation.Rs 1 lakh as compensation for mental agony, harassment and inconvenience.Rs 50,000 as litigation expenses.The bank must make the payment within 45 days, failing which the amount payable will carry further interest at 12 percent per annum from the date of default until realisation.