1. Introduction

Notification systems play an important role in modern digital, commercial, financial and administrative activities. They are mechanisms through which important information, warnings, alerts, notices and communications are transmitted to individuals, institutions or government authorities.

Examples include:

SMS alerts relating to banking transactions.

Email notifications regarding financial transactions.

Alerts concerning unauthorised access to computer systems.

Notifications regarding insurance policy renewals.

Court notices and legal communications.

Emergency alerts relating to natural disasters.

Notifications regarding data breaches and cybersecurity incidents.

A failure of a notification system occurs when the required information is not generated, transmitted, delivered or communicated to the intended recipient within the prescribed time.

Such failure may result in financial losses, legal complications, violation of consumer rights, security breaches and administrative negligence.

The most important legal question is:

When a notification system fails and causes damage, who should bear the legal responsibility: the organisation sending the notification, the technology service provider, the telecommunications operator or the recipient?

The answer depends upon the existence of a legal duty, negligence, contractual obligations, statutory requirements and the connection between the notification failure and the loss suffered.

2. Meaning of failure of notification systems

Failure of notification systems refers to the breakdown or improper functioning of a communication mechanism that prevents important information from reaching its intended recipient.

Notification failure may occur at different stages.

A. Failure to generate notification

The system fails to generate a required alert.

Example: A bank's software fails to generate an SMS notification after an unauthorised withdrawal.

B. Failure to transmit notification

The notification is generated but is not successfully transmitted because of network or server problems.

C. Failure to deliver notification

The notification is transmitted but does not reach the recipient's mobile phone or email account.

D. Delay in notification

The notification reaches the recipient after the relevant event has occurred or after the recipient has lost the opportunity to take preventive action.

E. Incorrect notification

The recipient receives inaccurate, incomplete or misleading information.

F. Failure of acknowledgement

The system does not record whether the notification has been received or whether the recipient has responded.

These distinctions are legally important because the responsibility of each stakeholder may differ according to the stage at which the failure occurred.

3. Major causes of notification system failure

3.1 Technical failures

Technical problems are among the most common causes.

Examples include:

Server breakdown.

Software malfunction.

Network interruption.

Database errors.

Cloud-service failure.

Incorrect system configuration.

Failure of SMS gateways.

3.2 Human negligence

Notification failures may also occur because of human errors.

For example:

Incorrect entry of mobile numbers.

Failure to update customer information.

Failure to monitor notification systems.

Negligence in sending mandatory notices.

Failure to respond to system-generated warnings.

3.3 Organisational negligence

An organisation may fail to establish appropriate procedures for monitoring and maintaining its notification infrastructure.

For example, a bank may provide transaction-alert services but fail to maintain adequate monitoring mechanisms to identify repeated failures.

3.4 Third-party service failure

Modern notification systems frequently depend upon several external service providers.

These may include:

Software developers.

Cloud-service providers.

Telecommunications companies.

Internet service providers.

SMS gateway operators.

Data-processing organisations.

A failure by one service provider may affect the entire notification process.

3.5 Cybersecurity incidents

Cyberattacks, ransomware, unauthorised access and denial-of-service attacks may interrupt notification systems.

An organisation cannot automatically escape responsibility merely by claiming that a cyberattack occurred. Its security arrangements, preventive measures and response procedures must also be examined.

4. Legal principles governing liability allocation

Liability allocation means determining which person or organisation should legally bear responsibility for damage caused by the failure of a notification system.

The following legal principles are particularly relevant.

4.1 Liability under the law of negligence

Negligence arises when a person or organisation fails to exercise the reasonable standard of care required by law.

The following elements generally need to be established:

Duty of care: The defendant owed a legal duty to the claimant.

Breach of duty: The defendant failed to fulfil that duty.

Causation: The failure caused or materially contributed to the loss.

Damage: The claimant suffered legally recognisable harm.

Example:

A bank provides SMS transaction alerts to its customers. The bank's notification system repeatedly fails to send alerts regarding unauthorised withdrawals.

If the customer suffers financial loss because the absence of timely alerts prevented the customer from reporting the fraud, the bank may be liable for negligence or deficiency in service, depending on the applicable law and evidence.

4.2 Contractual liability

A notification system may be governed by a contractual agreement.

For example:

An insurance company agrees to provide renewal notifications.

A bank agrees to provide transaction alerts.

A digital platform agrees to notify customers about account-related changes.

Failure to fulfil such obligations may constitute breach of contract.

The injured party may claim appropriate contractual remedies, subject to the agreement and applicable law.

4.3 Statutory liability

Certain laws and regulations impose mandatory notification obligations.

If an organisation fails to comply with these requirements, it may face statutory consequences.

For example, RBI directions require banks to maintain systems for transaction alerts and customer reporting of unauthorised electronic transactions.

4.4 Vicarious liability

An organisation may be held responsible for wrongful acts or omissions of its employees committed in the course of employment.

Example: An employee responsible for issuing mandatory notifications negligently fails to send them. The employer may be held liable, depending on the circumstances.

4.5 Third-party liability

Where notification services are outsourced, the technology provider may also be responsible for failures attributable to its negligence or breach of contractual obligations.

However, outsourcing does not automatically eliminate the original organisation's statutory or independent legal responsibilities.

4.6 Contributory negligence

Sometimes the recipient also contributes to the loss.

For example:

Providing an incorrect mobile number.

Sharing confidential banking credentials.

Ignoring a notification actually received.

Failing to report an unauthorised transaction after discovering it.

The recipient's conduct may affect the allocation of liability, subject to the applicable statutory framework.

5. Important Indian case laws

The following decisions are particularly relevant to notification failure, banking negligence, consumer protection and electronic communication.

Case 1. State Bank of India v. Jarnail Singh & Others (2022)

Highly relevant case

Citation: Revision Petition No. 275 of 2021, National Consumer Disputes Redressal Commission, decided on 22 June 2022.

Facts

The complainant maintained a savings bank account with State Bank of India and had registered his mobile number for SMS transaction alerts.

After making a genuine ATM withdrawal, several unauthorised withdrawals took place from his account between September and November 2015.

The complainant did not receive SMS notifications regarding these transactions.

The fraudulent withdrawals amounted to ₹6,88,456.

The bank argued that the complainant had failed to protect his ATM card and PIN and attempted to shift responsibility onto the customer.

Issues

Whether the bank was responsible for failing to send transaction alerts.

Whether failure to send SMS notifications amounted to deficiency in service.

Whether the bank could establish customer negligence.

Whether the bank had to produce evidence of SMS delivery.

Decision

The National Consumer Disputes Redressal Commission dismissed the bank's revision petition.

It upheld the findings of the consumer forums below and held the bank liable for deficiency in service.

The bank was directed to refund ₹6,88,456 with interest at 6% per annum.

Important legal principles

SMS alerts are an important banking security facility.

Continuous failure to send transaction alerts cannot be dismissed as an ordinary technical problem.

Banks must maintain evidence supporting their claims regarding notification delivery.

The bank's failure to investigate the unauthorised transactions was also relevant.

The bank could not establish the customer's alleged involvement merely through unsupported allegations.

An especially important aspect of this decision was that the bank attempted to introduce SMS delivery reports at the revisional stage, although it had not properly produced that evidence before the lower consumer forums.

The Commission refused to permit the bank to fill the evidentiary gaps at that late stage.

Relevance to the topic:

This case directly establishes the importance of notification systems in financial security and demonstrates that repeated failure to send transaction alerts can amount to deficiency in banking services.

It also illustrates the evidentiary importance of delivery reports.

Case 2. State Bank of India v. Vikas Jain (2024)

Citation: First Appeal No. 39 of 2015, Delhi State Consumer Disputes Redressal Commission, decided on 18 November 2024.

Facts

The complainant had an account with State Bank of India and had activated SMS alerts.

Four unauthorised ATM withdrawals amounting to ₹80,000 took place in Bangalore while the complainant was elsewhere.

The complainant did not receive SMS notifications regarding the withdrawals.

The bank argued that the messages had been generated through its notification system.

Legal issues

Whether generating an SMS proves actual delivery.

Whether failure to deliver transaction alerts constitutes deficiency in service.

Whether the bank was responsible for the resulting financial loss.

Decision

The Delhi State Consumer Commission dismissed the bank's appeal and upheld the order directing the bank to refund ₹80,000 with interest and litigation costs.

Legal principles

Generation of a message does not necessarily establish its delivery.

A bank must provide adequate evidence supporting its claim that notifications were communicated.

Transaction alerts are an important part of banking security.

Failure to provide timely notifications may constitute deficiency in service.

The bank's responsibility must be examined in light of the circumstances and the resulting financial loss.

Relevance:

This decision is particularly important because it distinguishes between message generation and successful delivery.

It demonstrates that merely maintaining an automated notification facility does not necessarily discharge the organisation's legal responsibility.

Case 3. Sunil Kumar Maity v. State Bank of India (2022)

Citation: Civil Appeal No. 432 of 2022, Supreme Court of India, decided on 21 January 2022; 2022 LiveLaw (SC) 77.

Facts

The dispute concerned irregularities involving changes to the complainant's bank account number.

The complainant approached the consumer forum seeking relief against the bank.

The National Consumer Disputes Redressal Commission had dismissed the complaint at the revisional stage.

Decision

The Supreme Court set aside the National Commission's order and restored the State Commission's order.

Legal principles

The decision is relevant to the jurisdiction of consumer forums in disputes involving technical and complicated factual questions.

The Supreme Court clarified that factual complexity does not automatically prevent consumer forums from examining a complaint.

Application to notification-system failure

Notification-system disputes may involve complicated technical evidence, including:

Server records.

SMS delivery reports.

Email transmission records.

System audit reports.

Technical failure reports.

The existence of such technical questions does not automatically prevent a consumer from seeking remedies before the appropriate consumer forum.

Relevance: This case supports the availability of consumer remedies in disputes involving technical failures in banking services. It is not itself a direct decision concerning failed SMS notifications.

Case 4. Meenu Singla v. State Bank of India and Others (2023)

Citation: First Appeal No. 406 of 2021, decided on 4 October 2023.

Facts

The complainant alleged that SMS alerts had not been activated for her ATM transactions and that this amounted to negligence on the part of the bank.

The bank argued that the customer had not applied for the SMS alert facility before the disputed transactions.

Decision

The consumer commission dismissed the appeal.

It noted that there was no sufficient evidence establishing that the complainant had requested the SMS alert service before the relevant incident.

Legal principles

The existence of a notification facility does not automatically establish that a customer had activated it.

The claimant must establish the relevant facts supporting the alleged service deficiency.

The contractual and factual circumstances surrounding the notification facility are important.

Relevance:

This case provides an important qualification to the principle of bank liability.

A bank cannot automatically be held responsible for every failure to receive an alert without examining whether the relevant notification service was actually activated or legally required.

Case 5. Ms. Saroj Soni v. Central Bank of India (2021)

Date: 30 December 2021.

Facts

The complainants alleged that 25 unauthorised ATM withdrawals amounting to ₹2,50,000 had occurred without the bank sending SMS alerts for the transactions.

They argued that the bank's failure to notify them amounted to deficiency in service.

Legal issue

Whether the absence of SMS alerts made the bank liable for the unauthorised withdrawals.

Decision and significance

The commission examined the complainants' responsibility for safeguarding their ATM card and PIN and the evidence regarding the availability and activation of the SMS alert facility.

The claim concerning SMS failure was not accepted merely on the basis of the allegation.

Legal principles

Customer responsibility for protecting banking credentials remains relevant.

The existence of an SMS notification facility must be examined in the context of the customer's actual entitlement to it.

Failure to establish the bank's notification obligation and the relevant negligence may affect the outcome.

Relevance: This decision demonstrates that liability allocation requires examination of the conduct of both the bank and the customer.

6. Statutory framework governing notification failure in India

6.1 Consumer Protection Act, 2019

The Consumer Protection Act, 2019 is an important legal mechanism for addressing notification failures involving consumer services.

Section 2(11): Deficiency

The provision defines deficiency as a fault, imperfection, shortcoming or inadequacy in the quality, nature or manner of performance required under law or contract.

Therefore, if a bank or another service provider fails to provide notifications required by law or contract, such failure may amount to deficiency in service.

Section 35: Filing of complaints

This section provides for filing consumer complaints before the appropriate Consumer Commission.

Section 39: Findings of the District Commission

The section provides for various remedies, including removal of deficiencies, compensation and other appropriate orders.

Example: If a bank repeatedly fails to send transaction alerts and the failure contributes to financial loss, the affected consumer may seek relief under the Consumer Protection Act.

6.2 Information Technology Act, 2000

The Information Technology Act, 2000 is relevant to failures involving electronic communications and cybersecurity.

The Act is relevant where notification failure is associated with unauthorised access, data compromise or computer-related offences.

6.3 RBI Circular dated 6 July 2017

Title: Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions.

This is an important regulatory framework for understanding liability allocation in banking notification failures.

The circular requires banks to:

Provide mandatory SMS alerts for electronic banking transactions.

Provide email alerts wherever registered.

Maintain 24-hour channels for reporting unauthorised transactions.

Provide immediate acknowledgement of customer complaints.

Maintain records of the date and time of delivery of alerts.

Maintain records of customer responses.

Allocation of liability under the framework

The burden of proving customer liability under this framework rests on the bank.

Important legal point: The reporting period for third-party breaches is calculated from receipt of the bank's communication regarding the unauthorised transaction. Failure to send the communication is therefore a relevant consideration in determining the customer's liability.

The 2017 circular was subsequently consolidated into RBI's 2025 Responsible Business Conduct Directions. For commercial banks, the applicable consolidated directions and amendments must be consulted rather than relying exclusively on the original circular.

6.4 CERT-In Directions, 2022

The Indian Computer Emergency Response Team issued directions on 28 April 2022 under Section 70B(6) of the Information Technology Act.

These directions require specified organisations to report listed cybersecurity incidents within six hours of noticing them or being brought to their notice.

Relevant incidents include:

Data breaches.

Ransomware attacks.

Unauthorised access.

Denial-of-service attacks.

Certain incidents affecting digital payment systems.

These directions are relevant where notification-system failure results from cybersecurity incidents.

However, reporting a cybersecurity incident to CERT-In is different from notifying affected customers.

6.5 Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 is relevant to failures involving personal data and data-breach notifications.

Section 8 addresses the obligations of Data Fiduciaries, including reasonable security safeguards and notification of personal data breaches to the Data Protection Board and affected Data Principals in the prescribed manner.

A failure to provide a legally required data-breach notification may therefore result in regulatory consequences.

The applicable commencement notifications and rules must be examined before determining the precise obligations for a particular incident.

7. Liability allocation among different stakeholders

Liability is not necessarily restricted to the organisation that initially sends the notification.

It may involve several parties.

Example

Suppose a customer suffers an unauthorised withdrawal of ₹1,00,000.

The bank generates an SMS notification, but the notification is not delivered because of a technical failure involving an external service provider.

The following questions must be examined:

Did the bank have a legal obligation to send the notification?

Did the bank properly generate and transmit the message?

Was the service provider responsible for the transmission failure?

Did the bank maintain an alternative notification mechanism?

Did the absence of notification contribute to the customer's loss?

Was there any negligence on the part of the customer?

The bank may have statutory or independent responsibilities even though a third-party service provider was involved. The provider may separately be liable under its contractual obligations or other applicable law.

8. How courts determine liability in notification-system failure cases

Courts generally examine the following factors.

8.1 Existence of legal duty

The court examines whether the defendant had a legal or contractual obligation to provide the notification.

8.2 Nature of the failure

It must be determined whether the notification was:

Never generated.

Generated but not transmitted.

Transmitted but not delivered.

Delivered after an unreasonable delay.

Delivered with incorrect information.

8.3 Evidence of notification

Relevant evidence includes SMS delivery reports, email logs, server records and timestamps.

The decision in State Bank of India v. Vikas Jain (2024) illustrates the distinction between generating an SMS and proving its delivery.

8.4 Causation

The court examines whether the failure caused or contributed to the loss.

For example, would timely notification have allowed a customer to block an ATM card before further unauthorised withdrawals?

8.5 Foreseeability

The court examines whether the resulting damage was reasonably foreseeable.

Financial loss resulting from the absence of transaction alerts may be foreseeable where those alerts are intended to help customers detect fraud.

8.6 Contributory negligence

The court examines whether the recipient contributed to the loss by sharing confidential credentials, providing incorrect information or ignoring a notification actually received.

9. Evidence required to prove notification-system failure

Evidence plays a significant role in establishing liability.

The following documents may be important:

Where technical records are exclusively controlled by an organisation, failure to produce relevant records may be an important evidentiary consideration.

The claimant must still establish the necessary elements of the claim, subject to applicable evidentiary rules and statutory presumptions.

10. Challenges in liability allocation

Several difficulties arise when determining responsibility for notification failure.

A. Multiple parties involved

The notification process may involve the organisation, software provider, telecom operator and cloud service provider.

Identifying the precise point of failure can be difficult.

B. Lack of transparency

Organisations generally have greater access to technical records than individual customers.

This creates an evidentiary imbalance.

C. Contractual exclusion clauses

Some organisations attempt to exclude liability through contractual terms and conditions.

However, contractual clauses cannot automatically eliminate statutory obligations or protect a party against every form of negligence.

D. Outsourcing of notification services

Organisations may argue that the failure occurred because of an external service provider.

However, outsourcing does not automatically remove the organisation's own legal responsibilities.

E. Difficulty in establishing causation

The claimant may find it difficult to establish that timely notification would actually have prevented the loss.

F. Absence of uniform technical standards

Different organisations use different notification mechanisms, making it difficult to determine whether the system maintained an adequate standard of reliability.

11. Suggestions and reforms

The following measures can improve accountability and prevent notification failures:

Mandatory delivery verification: Organisations should maintain reliable delivery records.

Multiple communication channels: Important alerts should be communicated through alternative channels wherever appropriate.

Regular system audits: Notification infrastructure should be independently assessed.

Automatic failure detection: Systems should identify delayed and undelivered notifications.

Clear contractual obligations: Agreements between organisations and service providers should specify responsibility for failures.

Transparent grievance mechanisms: Customers should have effective procedures for reporting notification failures.

Preservation of electronic evidence: Server logs and delivery reports should be preserved.

Regulatory supervision: Relevant regulators should monitor compliance with notification obligations.

Prompt remedial action: Organisations should take immediate steps to prevent further loss once a failure is detected.

12. Conclusion

Failure of notification systems is not merely a technological problem. It is a significant legal issue involving negligence, contractual responsibility, consumer protection, statutory compliance and institutional accountability.

The allocation of liability depends upon the legal duty of each stakeholder, the nature of the failure, the evidence available and the connection between the failure and the damage suffered.

Indian judicial decisions, particularly State Bank of India v. Jarnail Singh (2022) and State Bank of India v. Vikas Jain (2024), demonstrate the importance of effective notification systems in protecting customers from financial fraud.

These decisions also highlight that merely claiming that a notification was generated may not be sufficient to establish that it was delivered.

The ultimate objective of liability allocation should be to ensure that the party responsible for the failure bears the legal consequences to the extent established by law.

Thus, effective notification systems are essential not only for technological efficiency but also for protecting legal rights, ensuring transparency and maintaining public confidence in digital services.

13. Important case laws for examination and academic reference

Final academic observation: Among these authorities, Jarnail Singh and Vikas Jain are the two most directly relevant decisions for a research paper specifically addressing failure of SMS notification systems and allocation of liability. The remaining cases provide supporting principles concerning consumer remedies and customer responsibility.