In a case where the assessee-customer’s SBI savings account was fraudulently debited by three unauthorized transactions on 18.10.2021 after he downloaded an application believing it to be from Louis Philippe customer care, the Gauhati High Court held that the transactions were clearly unauthorized and the Bank failed to establish any negligence on the part of the customer. The Court noted that the petitioner reported the fraud within one working day, attracting Clause 8 (zero liability in third-party breach cases) of the RBI Circular RBI/2017-18/15 dated 06.07.2017. The Bank neither lodged any complaint with cyber-crime authorities nor raised a charge-back request with the beneficiary bank despite timely intimation. Although the Bank alleged that OTP/MPIN had been shared, it produced no evidence. The merchant (respondent No. 3) admitted breach of customer data. Relying on DAV Public School v. Indian Bank (2019) 20 SCC 31 and Justice (Retd.) Basudev Agarwal v. SBI, [WP(C) 3474/2022] the Court affirmed that the Bank cannot shift liability to the customer without proving negligence; mere downloading of an app does not constitute negligence. The Division Bench upheld the Single Judge’s direction to SBI to refund ₹94,204.80 with liberty to recover the amount from the merchant, dismissing SBI’s writ appeal.  (Appeal against the order WP(C) No. 1900/2022, dated 30.09.2022) .   (WA 364/2022, dt. 13.09.2024)