On 31 October 2020, Mr. Srikanth Subramanian, a Bengaluru resident and IndusInd Bank customer since 2012, logged into his accounts and discovered a financial nightmare. Over ten days he had not been watching, fraudsters had systematically drained his savings account and credit card — through UPI transfers, international card transactions, and repeated attempted attacks — totalling Rs. 9,46,320. The order that emerged from the Karnataka Adjudicating Officer's proceedings on 28 April 2023 is the first settled cyber banking adjudication in Karnataka, and it now proceeds to final hearing at TDSAT, New Delhi.
Argued by Roots Cyber Law Firm, this case establishes how Indian adjudicators weigh a customer's duty of vigilance against a bank's non-negotiable obligation to detect and prevent fraud through its own promised security systems.
The Fraud: Ten Days, Multiple Fronts
The attack was not a single event but a sustained, multi-vector assault. From 16 to 26 October 2020, unauthorised transactions swept through both the complainant's savings account — via Paytm and Google Pay UPI — and his credit card, including two successful international transfers of USD 5,000 each to an entity in Kabul.
The complainant discovered the fraud only on 31 October 2020 and raised a complaint the same day. That four-day delay in reporting after the final transaction would become a key factor in the adjudicator's reasoning on contributory negligence.
The Bank's Defence — and Where It Failed
IndusInd Bank argued that all transactions were authenticated by OTP sent to the complainant's registered mobile and email, that the UPI transactions occurred through RBI-regulated third-party apps beyond the bank's control, and that since the complainant had sole access to his OTPs, any compromise was on his end alone.
"It is like someone trying to rob the house and tries to break the door 3 times and the 4th time he/she will be successful in breaking — and the security is watching without any action."
Written arguments of Complainant, adopted by Adjudicating OfficerThe decisive blow came from the bank's own Customer Protection Policy §4.2, which promised a "robust and dynamic fraud detection and prevention mechanism." The complainant demonstrated that despite multiple failed attempts over the credit limit, repeated reversals, and over 16 UPI transactions in a single 24-hour window — exceeding NPCI Circular NPCI/2018-19/UPI OC NO/061's 10-transaction daily cap — the bank's fraud system raised no alarm, made no call, and blocked no card.
Key Findings
Division of Liability
Liable for the credit card fraud sum of Rs. 7,66,920 — the amounts transferred on 26 October 2020 to Sherzad Idealistic Logistic Kabul. Fraud detection systems failed despite ten days of red-flag events. UPI savings account transactions excluded as bank's role in TPAP transactions is limited.
Protected as intermediaries under §§2(w) and 79 of the IT Act. No specific relief sought against them. The Supreme Court's ruling on eBay and the Karnataka High Court's order in Kunal Bahl v. State of Karnataka applied. Paytm cooperated by blocking the merchant account involved.
Compensation restricted to the credit card fraud sum of Rs. 7,66,920 (the 26 October 2020 international transfers). Mental agony (Rs. 50,000), pocket expenses (Rs. 1,00,000) and 18% interest were not awarded, the Adjudicating Officer noting that the complainant's failure to monitor accounts and report promptly contributed to the loss.
Case Update: Appeal Before TDSAT
Posted for Final Hearing at TDSAT, New Delhi
The matter is currently before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), New Delhi, in appeal against the order of the Karnataka Adjudicating Officer dated 28 April 2023. The case has been posted for final hearing.
The TDSAT appeal presents an opportunity to revisit and potentially expand the scope of relief — including the savings account UPI transaction losses and the full quantum of damages that were denied at the first instance. The appeal also raises broader questions on whether a bank's limited role as a PSP Bank in third-party UPI transactions can entirely shield it from liability when its own NPCI compliance failures directly enabled the fraud.
Roots Cyber Law Firm continues to represent the complainant's interests in the appellate proceedings.
Why This Case Matters
Legal Team
Conclusion
The Srikanth Subramanian case draws a new accountability map for the UPI era. Banks cannot route customer money through third-party apps and then claim they have no visibility when fraud occurs. Their fraud detection systems remain fully obligated to flag anomalous patterns — multiple failed attempts, over-limit transactions, repeated reversals, foreign currency bursts — regardless of what application layer the transaction uses.
Equally, customers now have a legal obligation, not just good practice, to monitor transaction alerts and report suspicion promptly. Where a customer fails to do so, adjudicators will apportion responsibility accordingly.
With the matter now posted for final hearing at TDSAT, the outcome of the appeal may further sharpen these principles — and potentially extend liability to the UPI savings account transactions left unaddressed at the first instance. Roots Cyber Law Firm continues to pursue the full measure of relief on behalf of the complainant.