In a significant ruling that reinforces consumer protection against digital banking fraud, the national consumer disputes redressal commission (NCDRC) has upheld an order directing Punjab National Bank (PNB) to reimburse more than ₹16.11 lakh to a customer whose bank account was allegedly emptied through cloned ATM card transactions in London.
The
order, pronounced on 30 June 2026 (blob), dismissed PNB's first appeal against a 2017 decision of the Uttarakhand state consumer disputes redressal commission which had held the bank guilty of deficiency in service and directed it to refund the amount along with 6% annual interest from the date of filing of the complaint and ₹5,000 towards litigation costs.
In the order, the bench of Dr Inder Jit Singh (presiding member) and Shashi Nandkeolyar (member) said, "...there is no negligence on the part of the complainant or respondent. It is admitted that the withdrawals have taken place from London and the complainant and/or any of his family members have not travelled to London during that relevant period. The complainant or respondent intimated the Bank about such fraudulent transactions immediately when he came to know about the same. The Reserve Bank of India (RBI) vide its Circular dated 6 July 2017 have issued detailed guidelines on customer protection - limited liability of customers in unauthorised electronic banking transactions."
"In the present case, there was no negligence on the part of the complainant. Hence, as per RBI circular, no liability can be fixed on the complainant, even if Bank was also not negligent. The first appeal lacks merit and is consequently dismissed and the order passed by the state commission is upheld," NCDRC said.
Fraud Discovered after ATM Visit
According to the commission's order, complainant Virender Kumar Pandey had opened a non-resident external (NRE) account (a bank account for non-resident Indians (NRIs) to park foreign earnings in India) with Punjab National Bank's Nari Shilp branch in Dehradun and was issued an ATM-cum-debit card. He alleged that bank officials had assured him that transactions through the card were fully secure.
Mr Pandey, who was employed with Transocean Drilling Company and posted at Mumbai High, visited a PNB ATM in Dehradun on 14 October 2010. During the transaction, he discovered that his account balance had fallen sharply.
The Bank informed him that several withdrawals had been made from ATMs in London between 20th August and 14 October 2010. The total unauthorised withdrawals amounted to ₹16.11 lakh.
Mr Pandey maintained that neither he nor any of his family members had ever travelled to London and that the debit card had remained in his possession throughout. He also submitted that during the period, he was posted at Bombay High (oil rig) since October 2009. Upon arriving at the port in India in October 2010, he reached Dehradun and visited the PNB ATM on Kaulagarh Road on 14 October 2010 to withdraw money for his personal use. He discovered from the ATM that the balance available in his account was ₹14 lakh short of what it should have been.
He immediately complained to PNB and also lodged a first information report (FIR) with Dehradun police. Despite repeated representations, including emails seeking CCTV footage and investigation details, he claimed that the Bank failed to provide satisfactory information.
He then filed a complaint before the state commission. In its order, the state commission observed that on 14 October 2010, there was a cash withdrawal transaction recorded at 15.16 hours in London using Mr Pandey's ATM card. However, on the same day, Mr Pandey was in Dehradun and had used his ATM card to withdraw cash at 17.37 hours. "It is not possible that within a difference of a few hours another transaction was done in London by the same ATM card."
"The bank has not proved that Mr Pandey was indulged in any fraudulent activities or any fault of the complainant, which may be attributed to his own carelessness. This is a perfect example of card cloning or duplicate card, which shows the failure of PNB's security system. The opposite parties (PNB) have not investigated the case properly and never asked for CCTV footage from the concerned authorities in London. The bank never diligently acted on Mr Pandey's complaint that was filed on 20 October 2010. It itself raises questions on banks' security systems," the state commission noted.
Bank Challenged State Commission's Order
Punjab National Bank challenged the state commission's order on several grounds, arguing that it had promptly referred the matter to its ATM cell and cybercrime unit, that there had been no breach of its security systems, and that the consumer complaint involved disputed questions requiring a detailed trial rather than summary proceedings.
The Bank also questioned the state commission's pecuniary jurisdiction, contended that Mr Pandey was no longer a consumer because he had subsequently closed the account and argued that the customer had failed to produce concrete evidence regarding the alleged fraudulent withdrawals. It further claimed that the PIN had likely been compromised because two incorrect PIN attempts were followed by a successful transaction in London.
Commission Finds No Negligence by Customer
NCDRC, however, found no merit in the bank's arguments. The commission noted that the complainant had consistently maintained possession of his ATM card and had produced evidence showing that he had never travelled to London during the relevant period.
It also observed that the Bank itself had admitted that the disputed withdrawals were made using Mr Pandey's active ATM card, rather than an older debit card, rendering its arguments regarding another card irrelevant.
One of the key findings relied upon by the commission was that Mr Pandey had successfully used his ATM card at Kaulagarh Road in Dehradun on 14 October 2010, while another withdrawal using the same card occurred in London only a few hours later.
The commission said it was impossible for the same physical card to be used in both locations within such a short span and concluded that the case represented 'a perfect example of card cloning/duplicate card'. It also noted that the Bank had failed to rebut this crucial fact.
Questions over PNB's Investigation
NCDRC also agreed with the state commission's findings that PNB had not produced any investigation report, despite claiming that the matter had been referred to its head office.
The commission observed that the Bank neither obtained CCTV footage from the London ATMs nor demonstrated that it had conducted a thorough investigation after receiving the customer's complaint.
It further noted that while the customer had promptly lodged an FIR and repeatedly followed up with the bank's cybercrime cell, the Bank failed to provide satisfactory responses or meaningful updates regarding its investigation.
RBI Guidelines Support Customer
It observed that under the RBI framework, customers are entitled to zero liability where unauthorised transactions occur due to deficiencies attributable to the bank or where the customer is not negligent and reports the fraud promptly.
Since the commission found no negligence on Mr Pandey's part and noted that he had immediately informed the bank after discovering the fraud, it held that no liability could be fastened on him.
Dismissing the appeal, NCDRC held that the Uttarakhand state consumer commission had passed a well-reasoned order and found no illegality or material irregularity warranting interference.
As a result, Punjab National Bank will have to pay to Mr Pandey ₹16.11 lakh with interest at 6% per annum from the date of filing of the consumer complaint until payment, along with ₹5,000 towards litigation expenses, as directed by the state commission.
(First Appeal No1394 of 2017 Date: 30 June 2026)
