A Delhi consumer commission has delivered a ruling with implications well beyond one fraud case: banks cannot blame customers for online fraud and walk away. They must prove the customer was negligent, and if they cannot, they pay.The order, passed on 16 June 2026 by the District Consumer Disputes Redressal Commission-III (West), came in a complaint filed by Santosh Nagpal, an 83-year-old woman from Dwarka, after IndusInd Bank refused to fully refund Rs 2.31 lakh drained from her premium account in a single evening in May 2021.What happened that eveningOn 1 May 2021, Nagpal received a call from someone claiming to be from Airtel, warning her that her mobile number would be blocked unless she completed a KYC update immediately. She was alone at home during the pandemic. She followed the caller's instructions, downloaded an app, and paid Rs 10 on a website as a supposed KYC charge.That one step handed the fraudster everything he needed. The app gave him remote access to her phone, allowing him to view and delete OTPs as they arrived. Using a single OTP, he registered her debit card for Mastercard Secure Code, set a transaction password, and started moving money.What followed took 18 minutes and 17 seconds. Seventeen transactions. The shortest gap between two of them was five seconds. The largest single transfer was Rs 95,000. By the time her relative managed to get through the bank's customer care and block the card, Rs 2,31,484 was gone.The bank's position, and why the court rejected itIndusInd Bank argued that the transactions were executed over a secured channel using OTP and Mastercard Secure Code authentication. It said the complainant had shared her details with the fraudster and was therefore responsible for what happened. The bank pointed to a Supreme Court judgment to argue that fraud cases involving disputed facts could not be decided by consumer commissions at all.The commission rejected this line of reasoning entirely.It pointed out that the bank had already partially refunded money through earlier proceedings, recovering Rs 37,810 from merchants and paying Rs 49,337 following a Banking Ombudsman directive. The commission said this directly undermined the bank's own claim that the customer was fully at fault. If that were true, it asked, why had the bank already paid up once?More critically, the bank never produced an investigation report. It sought adjournments repeatedly and did not appear on the final hearing date to answer the commission's queries. The court noted that this absence itself drew an adverse inference.What the court said that matters beyond this caseThis is where the ruling carries weight that goes beyond Nagpal's refund.The commission invoked a 2017 RBI circular that states plainly: the burden of proving customer liability in unauthorised electronic banking transactions lies on the bank, not the customer. Not the other way around.It then cited a 2020 National Consumer Disputes Redressal Commission judgment which held that if an account is maintained by a bank, the bank is responsible for its safety and security, and that any systemic failure, whether by the bank's own staff or any external party other than the customer, is the bank's responsibility alone.The commission also relied on a January 2025 Supreme Court ruling in State Bank of India versus Pallabh Bhowmick, which held that banks have access to the best available technology to detect and prevent unauthorised transactions, and that they must remain vigilant. The court in that case found no negligence on the customer's part and held the bank fully liable.Applying all three to Nagpal's case, the commission said IndusInd Bank had failed on multiple counts. Seventeen consecutive transactions on a newly registered debit card, within 18 minutes, with gaps as short as five seconds, were never flagged. No call was made to the customer. No alert was sent. No transaction was paused. The commission noted that banks like SBI, ICICI, and HDFC routinely call customers to verify suspicious activity. IndusInd did none of this.The commission also found that by not sharing its fraud investigation findings with the complainant, the bank violated her right to be informed, itself a deficiency in service. It said customers, especially senior citizens, have a right to know how money was taken from their accounts so they can protect themselves in future.The relationship manager's roleThe commission also took note of how the bank's relationship manager responded on the evening of the fraud. Nagpal had WhatsApp messaged her RM as soon as she realised what was happening. The RM replied after banking hours and sent a customer care number, nothing more.The commission was unimpressed. Nagpal had relied on this RM for all her banking needs for years. She was 80, alone, and in a panic. The court noted that the RM could have called customer care herself, looped in the complainant, or escalated the matter to a colleague. The bank's defence that the RM was off hours was not accepted as sufficient.What the court orderedThe commission directed IndusInd Bank to refund Rs 84,339 to Nagpal, after deducting the Rs 9,998 she herself accepted responsibility for as the first transaction she had knowingly initiated. The refund will carry interest at 6 per cent per annum from the date the complaint was filed until full payment is made.The bank must also pay Rs 10,000 as litigation costs and comply with the full order within 30 days of receiving the certified copy.Check the case judgement here: