Fintech Deep Dive — Saturday | October 24, 2026

Consumer rights | Developments reported October 17–24, 2026

This week’s consumer-rights story is not that digital payments have become unsafe overnight. It is that remedies still depend on evidence, fast reporting, direct communication and institutions doing their part. Four developments expose the gap: a bank-data exposure and customer-notification response; deepfake-assisted benefit scams; a Supreme Court update on digital-arrest losses and mule-account controls; and an RBI financial-inclusion campaign combining re-KYC with fraud awareness.

Two fraud rulings also entered the news cycle this week, but their decisions predate this seven-day window. They are useful legal context, not fresh orders. Across both old cases and new events, the question is: when a payment is authenticated or personal data exposed, who must show what happened next?

1. Two newly reported rulings, but not new decisions: authentication is not the whole case

On October 18, LiveLaw reported that the Kerala High Court had directed the State Bank of India (SBI) to refund ₹3.73 lakh to a customer who lost money in a 2019 impersonation scam. The decision in Remadevi T.L. v. Reserve Bank of India and Others was delivered on October 5—outside this issue’s event window. It set aside the Banking Ombudsman’s rejection of her complaint and ordered SBI to make good the loss within four weeks.¹

The fraud began with a message claiming older non-chip cards would be blocked, followed by a call about reactivation and registering a “State Bank Secure App.” The customer shared an OTP; ₹3.75 lakh was debited. She reported it the same day, blocked internet banking and complained to the police. Investigators identified a fraudster. The Ombudsman treated her as privy to the transaction, but the High Court found the bank had not established her involvement and applied the RBI’s third-party-breach protection.

The RBI’s 2017 circular provides zero liability in specified bank-negligence cases and qualifying third-party breaches reported within three working days of the bank’s transaction communication. Where the customer’s own negligence caused the loss, liability can continue until reporting; the bank bears the burden of proving customer liability.² This is a fact-specific ruling about evidence and prompt reporting—not a blanket rule that sharing an OTP never matters.

A second decision was reported on October 17: the Punjab State Consumer Disputes Redressal Commission upheld relief over 11 disputed UPI transactions totalling ₹72,495, saying MPIN authentication alone did not prove authorization or negligence. That order was dated October 1, also outside the event window.³

The takeaway is not “the bank always pays,” but “authentication is not the same as informed consent.” Report immediately through the bank’s official channel, obtain a dated complaint number, notify 1930 and preserve alerts, statements and police acknowledgements. RBI rules require banks to act to prevent further unauthorized transactions after notice; the timestamp can become central to the dispute.

2. SBI’s dark-web exposure: “funds are safe” is not the same as “customers face no risk”

SBI told stock exchanges on October 21 that a preliminary review of approximately 3.75 lakh records found on the dark web identified 3,897 customer records containing personally identifiable information. The bank said those records included names, mobile numbers, dates of birth, email and residential addresses, branch and customer identifiers, and loan- or lead-related metadata. It said it had activated incident response, engaged a CERT-In-empanelled cybersecurity firm and found no material effect on core operations, financial performance or business continuity; the source, authenticity and full extent remained under investigation.⁴

Those are separate questions. Whether core banking systems or customer balances were affected is not the same as whether exposed identity data can be used to make more convincing calls, messages or loan-application attempts. Nor does a preliminary sample of 3,897 records establish that every other record in the roughly 3.75-lakh trove was harmless—or that the entire trove is authentic SBI data. The bank’s initial exchange filing did not answer those points.

The Internet Freedom Foundation criticized the gap between informing investors and telling people whose data may have been exposed, and called for direct notification and a clearer account of the incident. On October 23, SBI said it had individually informed all customers whose data it had identified, by email and/or WhatsApp, and again said balances and funds were safe.⁵ That is a meaningful step: notice gives affected customers a chance to recognize targeted impersonation. It does not settle the origin of the data, whether all relevant people have been identified, or what preventive support SBI is providing.

The consumer response should be proportionate. An exposure notice is not proof that a bank account has been taken over or a loan fraudulently opened. But a person who receives a notice should treat unexpected calls that recite personal details as more—not less—suspicious, verify through a number or app they independently know, and watch for unfamiliar credit enquiries or accounts. If an unauthorized transaction occurs, contact the bank immediately and report it through the national cybercrime helpline at 1930 or the National Cyber Crime Reporting Portal. SBI’s public assurance is useful, but a durable answer requires the investigation’s findings, the scope of customer notification and clear remediation—not only reassurance about balances.

3. Deepfake welfare ads turn public trust into a payment prompt

On October 19, India Today reported an I4C advisory about fake government-scheme advertisements using the names, images and purported deepfake videos of the Prime Minister, Finance Minister and chief ministers. The pitches promised financial assistance, cashback or prizes, then asked for registration, processing, tax or verification payments. Some victims were allegedly directed to approve UPI collect requests or enter a UPI PIN, converting a supposed incoming benefit into an outgoing payment.⁶

This is not just a “people should be more careful” problem. A scam that borrows official imagery and the language of welfare attacks two things at once: a person’s hope of receiving support and their ability to tell a genuine public programme from an advertisement. A synthetic video can make a false message look familiar; a small upfront fee can make the request seem like ordinary paperwork. UPI’s own interaction—approve a request, enter a PIN—may be technically valid even when the story used to obtain that approval is fabricated.

That distinction matters for redress as well as prevention. A payment completed after deception can be harder to contest than a payment the customer never authorized at all; the RBI’s revised customer-protection directions for fraudulent electronic banking transactions are scheduled to apply to transactions from January 1, 2027, not to rewrite the current position today.⁷ Meanwhile, the safest rule remains simple: a UPI PIN authorizes a payment, not receipt of money. Do not pay an unsolicited “release” or “registration” fee for a benefit; verify the programme on the relevant department’s official website, not through the ad’s link or caller. If money has moved, contact the bank and call 1930 quickly; speed can help authorities and banks try to stop funds as they move through accounts.

Platforms also have a role in making these ads harder to distribute and easier to report, especially when a public figure’s likeness is used to sell a financial claim. The public advisory is useful, but it should not shift the whole enforcement burden to each person who sees a convincing video. The follow-up questions are whether the ads were removed, how many reports were received, and whether the payment trail was investigated.

4. Digital-arrest fraud: large losses, and the danger of freezing the wrong account

A status report filed by the Ministry of Home Affairs and the Indian Cyber Crime Coordination Centre before the Supreme Court, reported on October 23, said more than 21,900 digital-arrest complaints involving over ₹647 crore were registered from January 1 to August 31, 2026. These are complaints and the amount involved in them—not a verified measure of final losses, unique victims or money unrecovered. The Court is due to take up the matter on October 29.⁸

The same report describes work on a draft RBI standard operating procedure for suspected money-mule accounts, with integration into the Grievance Redressal Portal (GRP) and Money Restoration Portal (MRP) tentatively targeted for December 2026. It also says the RBI is considering safeguards such as delayed transactions or lagged credit to reduce the risk of a victim being pressured into quickly transferring money. These are proposals or implementation work, not consumer protections already available on demand.

The hard design problem is that fraud prevention can itself harm innocent people. A receiving account may be a mule account, but it may also belong to someone whose ordinary payment is caught by a weak signal. A freeze that blocks an entire account can interrupt wages, rent or essential spending; a freeze that is too narrow or too slow can let stolen funds disappear. The consumer-rights test is therefore not “freeze more.” It is whether a hold is tied to a specific suspicious amount, explained promptly, reviewable by a person and lifted on a clear deadline when evidence does not support it. The draft, its final text and the appeal path will matter more than a headline number of accounts flagged.

The RBI’s revised directions take effect on January 1, 2027. For bona fide individuals, including sole proprietors, with gross losses up to ₹50,000 in specified cases involving customer negligence, they provide compensation of 85% of net loss after recoveries or ₹25,000, whichever is lower, once in a lifetime. Victims must report to both the bank and the National Cyber Crime Reporting Portal or 1930 within five calendar days. This is a narrow, conditional safety net—not universal insurance or a substitute for recovering money from perpetrators.⁷ Do not wait for 2027 rules: report immediately and preserve the acknowledgement and transaction details.

5. A nationwide financial-inclusion drive puts fraud awareness beside re-KYC

On October 19, the Department of Financial Services announced a nationwide Financial Inclusion Saturation Campaign running from October 21 to December 31 and covering 2.70 lakh Gram Panchayats and Urban Local Bodies. Bank camps are to support insurance and pension enrolment, PMJDY accounts, re-KYC, pending C-KYC IDs, nomination updates, and awareness sessions on digital frauds and unclaimed financial assets.⁹

The same local touchpoint is meant to help people keep accounts usable, complete records and learn fraud safeguards. This is an implementation drive, not a new liability rule or promise of compensation. The announcement says progress will be monitored, but does not say how public outcome measures—processed re-KYC, updated nominations or fraud reports referred—will be published. Camp counts measure activity, not whether residents received service or a remedy. Use a bank camp, branch or Business Correspondent you can verify; the campaign is no reason to trust an unsolicited caller asking for an OTP, PIN or KYC payment.

The consumer-rights readout

The week’s four live developments expose different breaks in the consumer-protection chain: deceptive payment prompts, exposed data, coercive fraud and weak access to safe financial services. The Kerala and Punjab decisions—both older than this coverage window—add a useful legal reminder: authentication alone does not resolve who is liable.

Watch the Supreme Court’s October 29 hearing, the RBI’s planned December integration of the mule-account SOP, and the January 1, 2027 start of revised fraud protections. For SBI, the open questions are the source and full scope of the data exposure and what remediation follows notification. The standard should be plain: consumers must report quickly, while institutions must investigate, explain, communicate and prove their case.

Sources