I. General Principle - Duty to Have Detection System

Law does not expect 100% detection, but expects reasonable and appropriate measures.

RBI Circular dated 06.07.2017 on Customer Protection - Limiting Liability in Unauthorised Electronic Banking Transactions - is the bible in India. It says:

Banks must put in place fraud detection and prevention mechanism, a mechanism to assess and mitigate risks, as well as a system of continually advising customers.

If bank fails, liability is on bank.

II. Banking & Financial Fraud - Indian Case Laws

This is where most case law exists in 2024-2026.

1. Supreme Court Suo Moto - Digital Arrest Scam - 29 Oct 2025 - CJI Surya Kant, Justice Joymalya Bagchi, Justice V. Mohana

Landmark proposal. Supreme Court said:

Financial institutions must face strict liability when customer falls victim to digital arrest or cyber fraud that took place because institution or its officials were negligent in exercising due diligence. Banks must indemnify digital arrest victims with compensation not less than amount lost where fraud succeeded because institution failed in its due diligence.

Hard-coding institutional liability: General security advisories issued by banks are legally insufficient. RBI's regulatory codes must indemnify cyber fraud victims to full extent of losses if investigation establishes crime resulted from failure of institutional due diligence.

2. SBI v Pallabh Bhowmick & Ors - Gauhati High Court - Affirmed by Supreme Court view
Held Banks must utilize best available technology to detect and prevent unauthorized and fraudulent transactions, placing technological obligation squarely on banking institutions. Banks cannot rely on perceived negligence and must establish it with cogent evidence before denying liability.

If fraud is third-party breach where deficiency lies neither with bank nor customer, customer's liability is "zero" if reported within 3 working days - Para 6(ii) of RBI circular.

3. District Consumer Disputes Redressal Commission, Panchkula v SBI
Held SBI liable for deficiency in services for failure to provide safety and security of electronic banking transactions which resulted in unauthorized transactions. Referred to RBI circular 06.07.2017.

4. Karnataka High Court - Unauthorised Transactions Alone Do Not Establish Deficiency
Held occurrence of unauthorised transactions in customer's account does not, by itself, establish deficiency by bank. Need to prove fault. This is defence side.

5. Delhi High Court - SBI v Customer - CJ Devendra Kumar Upadhyaya & Tejas Karia
Held if bank customers ignore repeated warnings and click on suspicious links circulated by fraudsters, customer may also be considered negligent. So contributory negligence applies.

6. Classic - Canara Bank v Canara Sales Corporation (1987) 2 SCC 666
Supreme Court held: Nor can inaction for reasonably long time in not discovering forgery absolve bank. Bank must have anomaly detection system for signature verification. When bank cleared payment by seeing pass book without verifying signature on withdrawal form, it would be guilty of deficiency.

III. Cybersecurity - Failure to Detect Intrusion

7. FTC v Wyndham Worldwide Corp. - US 3rd Circuit 2015 - Landmark
FTC v Wyndham - three separate security intrusions between April 2008 and Jan 2010. FTC alleged Wyndham stored credit card info in unencrypted clear text and failed to use readily available security measures like firewalls to segment network. Court held failure to maintain reasonable security is unfair practice under Section 5(a) FTC Act. This is cited globally for duty to detect anomalies.

8. Darren Warren v DSG Retail Ltd [UK High Court 2023]
DSG Retail was victim of malware hack between 2017-2018 on 5,930 point of sale terminals. Claimant sued for failure to provide adequate data security. High Court struck out misuse of private information, breach of confidence and negligence claims, ruling that failure to provide adequate data security is not a positive act that can form basis of such claims. But breach of Data Protection Principle 7 - failure to take appropriate technical and organisational measures - was upheld. Shows English law treats failure to detect as regulatory breach, not tort of intrusion.

9. Owsianik v Equifax Canada Co. - Ontario Court of Appeal Trilogy
Plaintiff alleged personal info compromised when defendant affected by cyber attack, and cybersecurity measures inadequate to point of constituting reckless conduct. Divisional Court held gatherers and custodians of personal data cannot be liable for intrusion upon seclusion when third parties steal data. But can be sued in negligence and breach of statutory obligations. Failure to prevent breach not equal to invasion of privacy.

IV. Software / Construction System

10. Gerber Scientific Instrument Co. v Bell-Northern Research Ltd (1994) - Canada
Latent defects in software are problems not easily detected through regular testing. Buyer bought computer system that failed to meet expectations due to deficiencies in speed and positional accuracy. Court held implied condition of quality under Sale of Goods Act - failure to detect anomaly during acceptance testing does not waive liability if latent.

11. Pearson Education Ltd v The Charter Partnership Ltd (2007)
Architects held liable for defective drains which led to flooding of warehouse. Court held drains were truly latent defect and first flood only revealed it. Architect owed duty of care and liable for £2.1M. Failure to detect anomaly in system behavior (drain capacity) during design = negligence.

12. R v Balfour Beatty Rail Infrastructure Services Ltd
For systemic failure test: A breach of duty under s.3 Health & Safety at Work Act 1974 may result from systemic failure attributable to fault of management. If organization has no adequate notification system to follow-up on abnormal reports - like radiology department failing to have adequate notification system to follow-up on abnormal x-rays - it is systemic failure.

V. Medical Anomaly Detection

13. NCDRC - Wrong USG Scanning Reports, Failure to Detect Serious Limb Anomalies
NCDRC enhanced compensation from 7.5K to 7.5 lakh because of negligence and carelessness as well as reckless casual report submitted by Doctor - tragedy could not be averted. Had anomalies been detected earlier, complainant could have exercised option of abortion.

VI. Elements to Prove Your Case

If you are claiming failure to detect anomaly:

1. Duty: Show contract / RBI circular / DPDP Act / IT Act 2000 Sec 43A required monitoring
2. Anomaly was detectable: Show logs - e.g., transaction of Rs. 5 lakhs at 3 AM from new IP, or SIEM alert that was ignored, or USG image that clearly shows missing limb
3. No reasonable system: No velocity checks, no geofencing, no SIEM correlation, no second read protocol
4. Causation: If detected, loss would have been avoided
5. Loss

Drafting Tip for Banks/IT Companies:

Implement:

• Real-time anomaly detection - velocity, location, device ID
• Three working day zero liability reporting - automate
• SIEM with SOAR playbook - document why alert was closed as false positive
• RBI guidelines mandate Board-approved fraud risk management policy