Unauthorised bank transactions: who bears the loss?

Under the Reserve Bank of India's directions, how much of a fraudulent debit you bear depends on whose fault it was and how quickly you told the bank.

Source. Reserve Bank of India circular "Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions", RBI/2017-18/15, dated 6 July 2017, addressed to scheduled commercial banks, small finance banks and payments banks, as published on rbi.org.in and read on 12 November 2026. This page is a plain summary, not legal advice. Your bank's own policy and the latest RBI directions apply.

What the circular covers

Electronic banking transactions of two kinds: remote or online payments, where no card or phone is physically presented (internet banking, mobile banking, online card payments, prepaid instruments), and face-to-face payments, where the card or phone is present (ATM, card machines).

When your liability is zero

You are entitled to zero liability where the unauthorised transaction happened because of:

1. Fraud, negligence or deficiency on the part of the bank. This holds whether or not you report the transaction.
2. A third-party breach, where the fault lies neither with the bank nor with you but elsewhere in the system, and you notify the bank within three working days of receiving the bank's communication about the transaction.

When you bear the loss

• Your own negligence, for example where you shared your payment credentials. You bear the entire loss until you report the transaction to the bank. Any loss after you report is borne by the bank.
• A third-party breach reported late. If you notify the bank four to seven working days after its communication, your liability for each transaction is limited to the transaction value or the amount in the table below, whichever is lower.

• Reported after seven working days: liability is decided by the bank's own board-approved policy.

The summary table

Working days are counted by the working schedule of your home branch, leaving out the day you received the communication.

What the bank must do

• Ask customers to register for SMS alerts, and send them for electronic transactions.
• Provide 24x7 channels to report unauthorised transactions and lost cards: website, phone banking, SMS, email, a toll-free helpline, the home branch and others. A direct link for such complaints must be on the home page of the bank's website.
• Send an immediate acknowledgement with a complaint number, and record the time of your report.
• Take immediate steps to prevent further unauthorised transactions once you report.
• Credit the amount back (a "shadow reversal") within 10 working days of your notification, where you are entitled to it, without waiting for any insurance claim.
• Resolve the complaint and establish liability within the time in its policy, not exceeding 90 days. If it cannot do so within 90 days, the compensation under the circular is paid to the customer.

What this means in practice

• Report at once, to the bank, in a way that leaves a record. The clock in the tables runs from the bank's alert to your report. Use the bank's official helpline or app, note the complaint number, and follow up by email.
• Keep SMS and email alerts switched on and your mobile number updated at the bank. An alert you did not receive because your number was old weakens your position.
• Never share credentials. If an OTP, PIN, password or card details were given away, the loss before reporting is yours under these directions. That is why every scam aims to make you part with them. See OTP scams.
• If the bank does not respond properly, write to its grievance officer; if the complaint remains unresolved, the Reserve Bank of India runs an ombudsman scheme for complaints against regulated entities. Details are on the RBI's website.

Independent guide. This is not a government, bank or police website. Helplines and rules were checked at official sources on 12 November 2026; confirm on the official site before relying on them.