Menu

Unauthorised Bank Transactions

Money debited without your consent — RBI's zero-liability rules are on your side.

RBI Limited Liability Directions + Payment Systems Law, 2017 · Zero & limited customer liability

Overview

When money leaves your account without your authorisation — a skimmed card, a SIM-swap, a hacked net-banking login, a UPI debit you never made — RBI's limited-liability framework decides who bears the loss, and it turns almost entirely on how fast you reported. Report within 3 working days of learning of the fraud and your liability is zero where the breach wasn't your doing; within 4–7 days it's capped; banks must credit the disputed amount (shadow reversal) within 10 working days and resolve within 90. Banks routinely reject claims citing 'customer negligence' — most of those rejections don't survive a properly argued Ombudsman complaint.

Key Provisions — RBI Limited Liability Directions + Payment Systems Law, 2017

  • Zero liability where the fraud arises from the bank's or a third party's breach and you report within 3 working days.
  • Limited liability (₹5,000–₹25,000 caps by account type) for reports within 4–7 working days; bank policy governs beyond.
  • Shadow credit of the disputed amount within 10 working days of reporting; complaint resolution within 90 days.
  • The burden of proving customer negligence lies on the bank — not on you to prove innocence.

What You Can Get

Full reversal of unauthorised debits
Interest for the period of loss
Ombudsman compensation for deficiency
Escalation beyond wrongful rejections

How We Handle It

1

Report & Freeze

Bank fraud reporting + 1930/cybercrime.gov.in the same day — the clock decides liability.

2

Written Claim

A liability-framework claim citing the RBI directions, not a plain 'complaint'.

3

Ombudsman

RBI Ombudsman complaint (CMS portal) when the bank rejects or stalls past 30 days.

4

Recovery

Reversal with interest — consumer commission for compensation where warranted.

Typical timeline: Report same day · shadow credit 10 working days · Ombudsman matters 2–6 months.

Frequently Asked Questions

The bank says I must have shared my OTP, so no refund — is that the end?

No. The bank must prove your negligence; assertion isn't proof. SIM-swap, malware, and social-engineering frauds regularly win at the Ombudsman despite an OTP having been entered.

I noticed the fraud 2 weeks later — am I out of luck?

Liability beyond 7 days follows the bank's board-approved policy, and deficiency claims plus Ombudsman routes still exist. Slower is weaker, but not hopeless — report now.

Legal Connect connects you with independent advocates; we are not a law firm and this page is general information, not legal advice. In active fraud situations, report to your bank and 1930 immediately — then call us on +91 22 6555 3444.

Related Banking Matters