Who Bears the Loss? Rethinking Consumer Liability in QR-Code Payment Fraud in India

The rapid adoption of QR-code-based digital payments in India has created new forms of consumer vulnerability, particularly where fraudsters manipulate customers into voluntarily authorising transactions. The existing regulatory framework of the Reserve Bank of India (RBI) primarily addresses “unauthorised electronic banking transactions”, providing a liability framework where the customer has not authorised the transaction or where third-party fraud occurs without customer involvement. However, QR-code payment fraud presents a more complex situation: the customer may technically authenticate and authorise the payment, but such consent is obtained through deception, manipulation, or fraudulent misrepresentation. Consequently, the transaction is formally “authorised” while being substantively induced by fraud, creating uncertainty regarding who should ultimately bear the financial loss. This article critically examines whether the existing Indian framework adequately protects consumers in such circumstances and questions the continued reliance on formal authorisation as the basis for allocating liability. It argues that consumer liability should be reconsidered where consent is obtained through fraudulent inducement, particularly when the customer has exercised reasonable care. The article comparatively analyses approaches adopted in the United Kingdom and European Union to identify possible models for allocating losses between consumers, payment service providers, and other relevant actors. It proposes a more balanced, technology-neutral liability framework for QR-code payment fraud that recognises the distinction between genuine authorisation and fraudulently induced consent.