Unauthorised electronic banking transaction liability in India depends on why the debit happened and how quickly the customer reports it. Under the RBI’s customer-protection circular, a bank failure can mean zero customer liability. A third-party breach can also mean zero liability if it is reported within three working days of the bank’s alert. Sharing credentials follows a different rule.
The clock matters, but it is not the only test. This guide separates bank deficiency, third-party breach and customer negligence, then explains what the bank must do after a report.
First, report the transaction
Use a channel controlled by your bank: the fraud helpline, mobile app, internet banking, email, branch or another 24-hour channel listed by the bank. Do not call a number contained only in the suspicious message.
Ask for the complaint or acknowledgement number. Keep the transaction alert, account statement, screenshots and the time of your report. If the payment was made through UPI, card, internet banking or another electronic channel, block the affected instrument and reset credentials through the official app or website.
For fast reporting of financial cyber fraud, call 1930 and complete the complaint at cybercrime.gov.in. Our guide to reporting cyber fraud explains what to save and what to do next. Reporting to 1930 does not replace notifying the bank.
When the customer has zero liability
The RBI circular creates zero liability in two situations:
- The unauthorised transaction results from contributory fraud, negligence or a deficiency on the bank’s side. The timing of the customer’s report does not remove this protection.
- The fault lies elsewhere in the system, not with the bank or customer, and the customer tells the bank within three working days of receiving the bank’s communication about the transaction.
The second rule is often shortened to “report within three days”, but the starting point matters. The RBI table counts working days from the date the customer receives the bank’s communication, not simply from the date printed beside the transaction.
Zero liability is not an automatic promise that every disputed debit will be refunded. The bank still examines how the transaction was authorised, where the failure occurred and when the customer reported it. The burden of proving customer liability lies with the bank.
What changes after three working days
For a third-party breach, a report made four to seven working days after the bank’s communication creates limited liability. The customer’s maximum per-transaction liability is the lower of the transaction value or the RBI cap for the account category.
| Account category in the RBI circular | Maximum liability for a four-to-seven-day report |
|---|---|
| Basic Savings Bank Deposit account | ₹5,000 |
| Other savings accounts; prepaid payment instruments and gift cards; specified individual and MSME current, cash-credit or overdraft accounts; credit cards with limits up to ₹5 lakh | ₹10,000 |
| Other current, cash-credit or overdraft accounts; credit cards with limits above ₹5 lakh | ₹25,000 |
The categories have detailed conditions. For individual current, cash-credit and overdraft accounts, for example, the ₹10,000 row applies when the annual average balance or limit is up to ₹25 lakh. Ask the bank to identify the row it used rather than accepting a cap without explanation.
If the customer waits more than seven working days, liability is determined under the bank’s board-approved policy. Obtain that policy from the bank and check the version in force when the transaction occurred.
Customer negligence follows a different rule
If the loss is caused by the customer sharing payment credentials, the customer bears the loss up to the point at which the unauthorised transaction is reported to the bank. Losses after the report are borne by the bank.
This is why the three-day table should not be used as a universal calculator. A third-party compromise without customer fault is not assessed in the same way as a payment made after an OTP, PIN or password was shared.
Do not assume that every successful authentication proves negligence. The bank has to establish the basis for customer liability. Give a factual account of what happened and do not speculate in the complaint. State which messages arrived, which credentials were or were not entered, and when the bank was informed.
What the bank must do
After receiving the report, the RBI circular requires the bank to make a provisional credit, described as a shadow reversal, within 10 working days. The value date should be the date of the unauthorised transaction, so the customer does not lose interest or face additional charges because of the disputed debit.
The bank must resolve the complaint and determine liability within the period in its board-approved policy, with an outer limit of 90 days from receiving the complaint. For a debit-card or bank-account case, the customer should not lose interest while waiting. For a credit-card case, the customer should not bear an additional interest burden on the disputed amount.
A provisional credit is not the same as a final decision. Track the complaint until the bank records its finding and finalises the credit.
If the bank rejects or closes the complaint
Ask for the written reason, the evidence used to assign liability and the applicable board-approved policy. Compare the bank’s dates with your alert and acknowledgement.
If the bank does not resolve the complaint satisfactorily, use its grievance escalation path. You can then consider the RBI Integrated Ombudsman route where the complaint is eligible. The process starts with a complaint to the regulated entity; our UPI complaint guide explains the escalation sequence and the difference between the app, bank, NPCI and RBI stages.
A police or cybercrime report deals with the suspected offence and tracing funds. The bank complaint determines the account-side dispute and liability. In many fraud cases, both tracks matter.
A checklist for the first hour
- Notify the bank through an official 24-hour channel.
- Block the card, UPI handle or banking access that may be compromised.
- Save the acknowledgement number and exact report time.
- Call 1930 promptly if it is financial cyber fraud.
- Preserve alerts, statements, emails and screenshots.
- Do not delete the suspicious message or install any app suggested by the caller.
- Ask when the provisional credit will appear and how the bank classifies the case.
Source
Reserve Bank of India, Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, RBI/2017-18/15, DBR.No.Leg.BC.78/09.07.005/2017-18, 6 July 2017. Checked on 12 October 2026. The RBI document was read in full; in line with this site’s policy on RBI links, it is named rather than hyperlinked.
