Sarwar Raza v. Ombudsman Reserve Bank of India

15. Despite the protection that was granted by the Court on 5th December, 2022, a demand notice was sent by the Bank to the Petitioner on 2nd January, 2023, reflecting a total outstanding amount of Rs.1,00,972/-. The said amount included the principal amount of Rs.76,777/-, and late payment fee and interest charges.

16. Further, the Petitioner also received several calls from the Bank for the payment of late payment fee and penalties and vide email dated 17th January 2023, a final reminder was issued to the Petitioner to pay the outstanding dues with respect to credit card no. 2.

17. Aggrieved by the coercive steps taken by the Bank despite the Court’s clear direction to the contrary, the Petitioner filed a contempt petition being CONT.CAS. (C)150/2023.

18. In the said contempt case, i.e. CONT.CAS. (C)150/2023, vide order dated 10th February, 2023, the Court had directed as under:

is no mention of the individual who is sending these communications. The e-mail dated 13th January, 2023 is from Service@indiacommunications.citi.com whereas the e-mail dated 17th January, 2023 is from CitiAlert.India@citicorp.com. The demand notice is signed by Manager-Customer Service.

7. Since none of the communications have any individual who can be held responsible for these communications, it is deemed appropriate to direct the General Manager (Credit Card), Division of Citibank who is based in Chennai to remain present in Court on the next date of hearing.

8. In addition, this Court notices that as in the present case, in communications written by Banks to customers, the customers find it extremely difficult, to contact the concerned bank official. In view of the same, the Respondent No.2 shall file an affidavit in this regard as to who was the individual who is in control of the above mentioned e-mail addresses and under whose instructions these e-mails as also the demand notice dated 2nd January, 2023 have been issued. The said affidavit shall be filed by 15th February, 2023.

19. In terms of the above order, the Court directed the personal presence of the General Manager (Credit Card), Division of Citibank, for the next date of hearing.

20. On 17th February, 2023, various officials from the Bank appeared before the Court. It was submitted on behalf of the Bank that it is willing to reverse all the charges which were raised against the Petitioner.

21. However, at that stage, the Petitioner apprised the Court that a collection agent had visited his residence, and informed that a sum of ₹80,000/- was required to be paid for settling the dispute.

22. In view of the above, the Court vide order dated 17th February, 2023 directed the Bank to answer the following queries:

respond to both the affidavits which have been filed today by way of a common rejoinder so that the same can be considered on the next date of hearing. A Senior Official handling this matter shall join the proceedings on the next date of hearing physically and other officials may join virtually.”

23. Thereafter, an unconditional apology was issued by the Bank, and it was stated that incorrect amounts that were levied as penalty, would be reversed by the Bank. Vide order dated 10th July, 2023, the Court records that the Bank had reversed the amounts and the contempt proceedings against the Bank stood discharged. Thereafter the main petition has been heard from time to time. The operative portion of the said order reads as under: “[…]

8. An unconditional apology has also been tendered by Citi Bank, and it is submitted that the incorrect amounts, which have been levied as penalty, would be reversed by the Bank. It is now confirmed that the same has been reversed.

9. The intention of the Court was, obviously, to ensure that CITI Bank does not trouble its customers in this manner, especially when the person is a victim of cyber fraud. Till date, the generation of OTP on an unregistered mobile number is itself shrouded in mystery and a convincing explanation for the same is not yet forthcoming. The main writ petition would have to be heard. However, subject to Ms. Megha Ghosh, Senior Vice President, CITI Bank, appearing before this Court either virtually or physically on every date, the contempt notice for the time being stands discharged. If any proceedings are to be initiated by the Court, the Court would consider the same at the later stage.

10. The contempt petition is disposed of in the above terms.”

SUBMISSIONS ON BEHALF OF THE PARTIES:

24. On the specific facts of the case, the stand taken by the Respondent No.2 i.e., the Bank as per the counter-affidavit dated 9th February, 2023 is as under: a) The Internet Personal Identification Number (hereinafter, ‘IPIN’) of the Petitioner was used for accessing his account through Citibank Online and was changed on 3rd April 2022 at 17:59:15 hours, pursuant to which an OTP was sent to the registered mobile number of the Petitioner i.e.,9953692225. b) After the aforesaid change in the IPIN, the registered mobile number of the Petitioner i.e., 9953692225 was changed to 8710055661 (hereinafter, ‘new mobile number’) on 3rd April, 2022 at 18:04 hrs, allegedly at the instance of the Petitioner. In accordance with Bank’s standard practice, an SMS alert notifying the change of registered mobile number was sent to the old registered mobile number of the Petitioner, on same date. c) The Bank records reveal that on 5th April 2022 at 18:09:22 hours, the credit card No.1 was blocked by the Bank, based on an internal review. d) Thereafter, a fresh credit card ending with xxxxxx9319 i.e., credit card No.2 was issued to the Petitioner on 6th April 2022, allegedly at the Petitioner’s request. e) After the blocking of credit card No.1, the IPIN and APIN were again changed on 6th April 2022, and an OTP was sent to the new mobile number, which was registered against the Petitioner’s account. f) The interactions reveal that this change of mobile number was not in the knowledge of the Petitioner, and he came to know about the same only on 12th April, 2022. According to the Bank, this happened only because the Petitioner may have compromised his own OTP, and other details. g) Further, it is alleged that ‘virtual card view’ for the newly issued credit card No.2 was assessed by the Petitioner on 6th April, 2022, and transaction limits were modified, and thereafter, the Paytm rent payment transaction amounting to the disputed amount i.e. Rs. 76,777/was conducted. h) The Paytm rent payment transaction amounting to the disputed amount of Rs. 76,777/-, conducted on 6th April 2022 at 11:58:50 hours was honoured by the Bank, considering that it was a genuine transaction. i) It is further stated that the Bank undertakes all necessary precautions, and maintains adequate systems to prevent and detect fraudulent activities. j) In view of the foregoing, it is stated that, since the OTP was sent to the registered mobile number of the Petitioner, and thereafter the IPIN and APIN were changed, and credit card No.2 was duly issued, after which the Paytm transaction was executed, the Bank cannot be held liable for the transaction. In view of the above, it is the stand of the Bank that it cannot be blamed as all the requisite precautions have been taken.

25. The above position taken by the Bank is controverted by the Petitioner in the rejoinder dated 13 June, 2023 in the following terms: a) It is stated that the registered mobile number was changed without any permission or authorisation from the Petitioner. b) Thereafter, the credit card No.1 was blocked without any approval of the Petitioner, and a new credit card i.e., credit card No.2 was issued, without any request or application made by the Petitioner. c) The Petitioner states that he has not validated the user ID or PIN for issuance of a new card. The Petitioner denies having accessed the online account or virtual card view on 6th April, 2022, to modify any transaction limits. d) Further, the Petitioner did not receive any OTP for the transaction of Rs.76,777/-. It is stated that the same was sent on different mobile number, and not the Petitioner’s registered mobile number.

26. Pursuant to the directions issued by the Court, in CONT.CAS. (C)150/2023, affidavits dated 15th February,2023 and 10th April, 2023 were filed by Bank to the following effect: a) The Bank’s consumer business was transferred to Axis bank on 1st March, 2023. Prior to such transfer also, the Bank had been following the Reserve Bank of India (hereinafter, ‘RBI’) circulars and guidelines from time to time. b) A customer can contact the Bank only through modes such as email, letters, phone etc. There is no one concerned bank official assigned for such communication. Since the Bank’s collection team receives approximately 11 million emails daily, owing to the sheer volume of correspondence, no one person under whose instructions the emails are sent, can be mentioned by the Bank. c) Multiple departments of the Bank work to resolve the grievance of the customer. The customer care executive who may be dealing with a customer, may not even be an accountable employee of the Bank. Additionally, there are various relationship managers who also reach out to the customer for assistance. Thus, no one person’s name can be mentioned. In addition, relationship managers are appointed who reach out to the client for assistance. d)The customers can contact the Bank through Citi phone helpline which is available for customer assistance 24/7. In 2022, Citi phone received 41 lakh calls, and the average time taken to talk to a phone banking officer was 26.[2] seconds, after the customer has chosen the option. e) The customer can write to the head of the customer care, in case the customer wishes to follow up on the queries raised. If the customer is still not satisfied by the response, they can write to the Principal Nodal Officer. f) That the registered mobile number of the customer can be changed either by physically visiting the Bank or by way of One time Password (hereinafter, ‘OTP’). If the registered mobile number is changed, an alert is also sent to earlier registered mobile number of the customer. g) That frauds are committed due to sharing of OTPs, PIN, passwords, CVV number on the credit cards, etc, for which sensitisation programmes are undertaken by the Bank. h) That collection agents for the purposes of collection of outstanding charges/amounts from customers, are appointed by third party agencies, as per guidelines laid down by RBI. Pre-hiring and Post hiring checks also undertaken for their appointment.

27. In CONT.CAS. (C)150/2023, vide affidavit dated 12th April, 2023, RBI contends that it has issued guidelines and circulars from time to time, regarding recovery agents engaged by Banks. a) Vide Circular no. RBI/2022-23/108, dated 12th August 2022, titled Outsourcing of Financial Services – Responsibilities of regulated entities employing Recovery Agents, the RBI has taken a position that banks and other regulated entities must ensure that their recovery agents do not resort to intimidation or harassment in their debt collection efforts. Further, such recovery agents must not intrude upon the privacy of debtor’s family members, or send inappropriate messages, or make threatening calls. b) The aforesaid position taken by RBI in affidavit dated 12th April, 2023 reads as under:

28. Heard the submissions made on behalf of all parties, including the Petitioner, the Bank and the RBI Ombudsman.

29. Ld. Counsel for the Petitioner has, throughout the course of proceedings, maintained their stance that that the fraudulent transactions which were undertaken were not intimated to the Petitioner on the registered mobile number.

30. In response, the Bank, has placed on record a list of the SMS alerts and a chart of messages by the Bank showing that there has been continuous intimation from the bank from 3rd April 2022 till 7th April 2022.

31. The list of the SMS alerts which were issued to the Petitioner on behalf of the Bank show that an updating of the registered mobile number linked with the bank account of the Petitioner took place on 3rd April 2022 and on the said date, multiple messages were sent by the Bank to the Petitioner on the registered mobile number, with respect to the said updation process.

32. On 5th April 2022, the online password associated with credit card NO. 1 was disabled due to multiple wrong attempts and eventually, the credit card no.1 was disabled by the Bank on 6th April 2022 due to security reasons.

33. The chart of messages placed on record by the Bank shows that due to the repeated wrong login attempts that took place on 6th April 2022, the credit card no. 1 was disabled and a new card i.e. credit card no. 2 was generated on 7th April 2022.

34. For reasons not specified, the Petitioner did not lodge any complaint on that date. The alleged transactions were carried out on 7th April 2022 on platforms including Flipkart, Paytm, etc., but even at that stage the Petitioner did not lodge a complaint. It is only on 12th April 2022 that for the first time, the Petitioner lodged a complaint.

35. The manner in which the registered mobile number of the Petitioner got changed is still shrouded in mystery. However, this Court is of the view that a factual analysis of the alleged transactions can’t be undertaken in this writ petition, as to whether mobile phone was misused by anyone known to the Petitioner or was there an inadvertent passing on of the OTP by the Petitioner to anyone. The Court is also not inclined to get into analysing as to whether all the messages set out in the chart produced by the Bank have in fact been received by the Petitioner or not.

36. These facts can only be gone into after a factual analysis of the case and a thorough examination and evidence may be required for the same. The Court, however, notes with some consternation that the recovery agents did send threatening messages to the Petitioner, visited his residence and asked for payments of the alleged outstanding amount. Such conduct of recovery agents, in the opinion of this Court is condemnable and not at all permissible.

37. Moreover, even if there has been an inadvertent sharing of an OTP or a password by any credit card holder, there ought to be some mechanism by which the consumer would be able to immediately contact the concerned bank for blocking of credit card.

38. The charging of late payment of fee, interest, etc., in such cases when customers have lodged complaints and that too without resolving the same, shall not be permissible.

39. The Reserve Bank-Integrated Ombudsman Scheme, 2021, has to be an effective Scheme and not a mere toothless division of the RBI. Clause 10(2) of the Scheme reads as under:

(i) pending before an Ombudsman or settled or dealt with on merits, by an

Ombudsman, whether or not received from the same complainant or along with one or more complainants, or one or more of the parties concerned;

(ii) pending before any Court, Tribunal or

Arbitrator or any other Forum or Authority; or, settled or dealt with on merits, by any Court, Tribunal or Arbitrator or any other Forum or Authority, whether or not received from the same complainant or along with one or more of the complainants/parties concerned;

(c) the complaint is not abusive or frivolous or vexatious in nature;

(d) the complaint to the Regulated Entity was made before the expiry of the period of limitation prescribed under the Limitation Act, 1963, for such claims; (e) the complainant provides complete information as specified in clause 11 of the Scheme; (f) the complaint is lodged by the complainant personally or through an authorised representative other than an advocate unless the advocate is the aggrieved person. Explanation 1: For the purposes of sub-clause (2)(a), ‘written complaint’ shall include complaints made through other modes where proof of having made a complaint can be produced by the complainant. Explanation 2: For the purposes of sub-clause (2)(b)(ii), a complaint in respect of the same cause of action does not include criminal proceedings pending or decided before a Court or Tribunal or any police investigation initiated in a criminal offence.”

40. As noted above, the Ombudsman of the RBI has rejected the complaints filed by the Petitioner on both occasions through system generated responses.

41. Even the Circular No. RBI/2017-18/15 dated 6th July, 2017 on ‘Customer Protection - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions' ought to be strictly implemented by the Banks. Vide the aforesaid circular, the banks are required to undertake the following: “(i) To ask their customers to mandatorily register for SMS alerts and wherever available register for e-mail alerts, for electronic banking transactions. The SMS alerts shall mandatorily be sent to the customers, while email alerts may be sent, wherever registered.

(ii) To ask their customers to notify their bank of any unauthorised electronic banking transaction at the earliest after the occurrence of such transaction and inform that the longer the time taken to notify the bank, the higher will be the risk of loss to the bank/ customer.

(iii) To provide customers with 24x[7] access through multiple channels (at a minimum, via website, phone banking, SMS, e-mail, IVR, a dedicated toll-free helpline, reporting to home branch, etc.) for reporting unauthorised transactions that have taken place and/ or loss or theft of payment instrument such as card, etc.

(iv) To enable the customers to instantly respond by

"Reply" to the SMS and e-mail alerts and the customers should not be required to search for a web page or an e-mail address to notify the objection, if any. Further, a direct link for lodging the complaints, with specific option to report unauthorised electronic transactions shall be provided by banks on home page of their website.

(v) To ensure that the loss/ fraud reporting system shall send immediate response (including auto response) to the customers acknowledging the complaint along with the registered complaint number.

(vi) To ensure that the communication systems used by banks to send alerts and receive their responses thereto must record the time and date of delivery of the message and receipt of customer's response, if any, to them. This shall be important in determining the extent of a customer’s liability.

(vii) Not to offer facility of electronic transactions, other than ATM cash withdrawals, to customers who do not provide mobile numbers to the bank.

(viii) To take immediate steps to prevent further unauthorised transactions in the account on receipt of report of an unauthorised transaction from the customer.”

42. The first instance of rejection of the complaint in this case has been because the said complaint was stated to be filed by an advocate. In the second instance, the reason given by the RBI is that there was some inadvertent field which was wrongly filled.

43. The rejection of complaints filed by the public due to such technical reasons show that the functioning of the Ombudsman of the RBI is not more consumer friendly. Thus, both, the The Reserve Bank-Integrated Ombudsman Scheme, 2021 and the Circular No. RBI/2017-18/15 dated 6th July, 2017 on ‘Customer Protection - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions' ought to be implemented in its letter & spirit.

44. The prayers in this writ petition are for refunding the amount of Rs.76,777/- which was the value of the transaction that took place on credit card no. 2 which the Petitioner stated to have not initiated. The bank has, however, already re-credited the said amount to the Petitioner, along with interest and penalty, as stated by the Petitioner in its Rejoinder dated 13th June,

2023.

45. Further, the Petitioner has sought restoring of his CIBIL score and for restraining the Bank from charging any penalty charges.

46. Considering the factual chronology as set out above, the Court is of the opinion that the purpose and intent of all financial regulatory mechanisms including banks, financial institutions and regulators ought to be to: a) Put in place adequate safeguards to avoid misuse. b) Take stringent actions against perpetrators. c) Ensure that innocent credit card holders are not made to undergo harassment and frustration by incessant emails, messages and demands.

47. Accordingly, with the intent to achieve the abovementioned purpose, the following directions are issued: (1) The amount of Rs.76,777/- has already been re-credited to the Petitioner. No payment of late fee, interest charge, or any amount in respect of the said amount shall be charged by the Bank. (2) The CIBIL score of the Petitioner shall not be changed merely based on the disputed transactions and the same shall be restored, if there are no other grounds for changing the score. (3) For the conduct of the recovery agents of the bank, the Court deems it appropriate to hold the Bank responsible for the harassment caused to the Petitioner. Accordingly, costs of Rs.[1] lakh is directed to be paid to the Petitioner by the Bank by 15th January, 2026. (4) Insofar as the RBI is concerned, steps shall be taken for ensuring that all complaints filed by the customers are not rejected simply by a mechanised process. If there are any mistakes made by complainants, an opportunity ought to be given to them to correct any errors or mistakes. Rejection of complaints by the Ombudsman by a mechanised model results in more disputes being filed in consumer forums, commercial Courts, civil Courts and writ petitions. Issues which ought to be resolved at the level of the Ombudsman of the RBI shall be resolved at that stage itself and for the said purpose, if any strengthening, expansion or supplementing of the human resource at the Ombudsman’s office is required, the same shall be undertaken. (5) Whenever the complaints filed before the RBI Ombudsman are finally rejected, the same shall undergo a second level human supervision process, by trained legal personnel for e.g. retired judicial officers, lawyers, etc., who are legally trained for at least ten years, so that complaints are not rejected due to small errors. If the complaint redressal mechanism adopted by the Ombudsman is made more effective and efficient, litigation in Courts and consumer forum/s can be reduced considerably. (6) RBI shall issue directions to all banks regulated by them to create a flowchart in the complaints tab on their respective websites where the manner in which a customer can register a complaint with the customer care executive, branch manager, as well as the nodal officer can be communicated to the customers. (7) The Ombudsman of RBI shall also ensure that all banks and financial institutions clearly reflect on their respective websites, the hierarchy of all such officers who deal with consumer complaints, in the form of a flowchart.

48. These directions shall be brought to the notice of the office of the concerned Deputy Governor, RBI, through the Assistant General Manager, RBI, as also, through Mr. Ramesh Babu, ld. Counsel. The Deputy Governor, RBI shall then place an affidavit on record, by 15th January 2026, stating as to what measures have been taken to implement the directions given above.

49. The writ petition along with pending application, if any, is disposed of in the aforesaid terms.

50. List for reporting for compliance on 30th January 2026.

PRATHIBA M. SINGH JUDGE NOVEMBER 27, 2025 kk/sm/ss