For an unauthorised electronic banking transaction, the liability of the customer is not automatically the whole amount. The Reserve Bank of India prescribes a framework that limits customer liability for unauthorised electronic transactions, provided the customer reports the transaction to the bank without delay and in writing. Where the loss results from the bank's own failure or from a third-party breach, the customer carries zero liability; where the loss is due to the customer's negligence, liability is graded according to the delay in reporting.
When this matters
This applies whenever a debit, transfer or payment was made from your account without your authorisation: a card skimmed at a terminal, an OTP obtained by deception, a phishing page that captured your credentials, a cloned SIM, or a UPI mandate you never approved. The framework covers transactions across cards, internet banking, mobile banking, wallets and UPI. The question in every such case is the same: was the transaction authorised by the customer, and if not, how quickly was it reported?
The limited-liability framework
- The customer must inform the bank of the unauthorised transaction without delay and in writing. The framework gives a short reporting window, counted in working days from the date of the transaction, within which the customer must report to keep the benefit of limited liability.
- Where the loss is due to the bank's own negligence, or to a breach on the bank's systems, the customer has zero liability.
- Where the loss is due to a third-party breach and the customer has not shared credentials, the customer keeps limited liability, subject to prompt reporting.
- Where the loss is due to the customer's own negligence, such as sharing an OTP or password, liability is graded: limited if the report is prompt, and greater if the report is delayed.
- The bank must credit the amount involved, or reverse the transaction, within the period the framework prescribes, and must not delay beyond it.
Describe the timeline to the bank in these terms rather than promising a figure. The framework does not allow the bank to shift the whole loss to a customer who reported promptly and did not share credentials.
What the bank must prove
The bank cannot simply declare that you were negligent. Where it seeks to put liability on the customer, it must show that the transaction was authorised by the customer, or that the customer shared the credentials, or that the customer's negligence caused the loss. In practice, the bank relies on the logs of the transaction, the OTP delivery record, the device and IP used, and the terms of the account. Your reply is the paper trail: the complaint you made, the time you made it, and the absence of any sharing on your part. A banking and finance lawyer can put this on record before the recovery claim is closed.
Fraud, negligence and third-party breach
- Fraud: the transaction was never authorised by the customer and the customer did nothing careless. The customer's liability should be nil or nominal, subject to prompt reporting.
- Negligence: the customer shared an OTP, password or PIN, or used an insecure network. Liability is graded by the delay in reporting.
- Third-party breach: the loss arose from a system of a third party where neither the customer nor the bank was at fault. Here the customer, if not negligent, retains limited liability.
The ombudsman route and the consumer commission route
If the bank rejects the claim or delays the credit beyond the prescribed period, the first internal step is a written complaint to the bank's grievance redressal officer. If that fails, escalate under the Reserve Bank's Integrated Ombudsman Scheme; the ombudsman can direct the bank to make good the loss. In parallel, or where compensation beyond the transaction is sought, a complaint lies before the district consumer commission under the Consumer Protection Act 2019, which can be filed through e-Daakhil. A consumer protection claim can cover the deficiency in service and the loss. Choose the forum that fits the relief: the ombudsman for the refund, the consumer commission for a wider claim. Where the fraud is deliberate, a cyber fraud complaint runs alongside.
Evidence to preserve
- Bank statement showing the disputed debit, and the transaction reference.
- The written complaint to the bank with its acknowledgment and ticket number.
- SMS and email alerts from the bank about the transaction and the OTP, if received.
- Screenshots of the fraudulent message, call log, or website with timestamps.
- Copy of the police or portal complaint, where a criminal complaint was made.
- Every reply from the bank and the date it was received.
Common mistakes
- Reporting over the phone only, with no written complaint and no acknowledgement.
- Continuing to share OTPs with the fraudster after the first loss, which supports a finding of negligence.
- Waiting until the reporting window has passed before writing to the bank.
- Accepting a partial or informal settlement without understanding the liability rules.
- Discarding the alerts and messages that fix the time of the transaction and of your report.
Common questions
Am I liable if someone used my card online?
Not automatically. If the transaction was unauthorised and you reported it without delay and in writing, and did not share your credentials, your liability is limited or nil under the framework. If you shared the OTP or password, liability is graded by the delay in reporting.
Does the bank have to refund the money?
Where the loss is due to the bank's own negligence the liability is zero and the amount must be credited within the prescribed period. Where the claim is rejected, the ombudsman or the consumer commission can direct the bank to make good the loss.
Which is better: the ombudsman or the consumer commission?
The ombudsman is a quick, free route focused on the refund of the unauthorised amount. The consumer commission can award compensation beyond the transaction but follows a longer process. Many claimants pursue the ombudsman first and the commission if the claim is wider.
Do I need a police complaint for the bank claim?
The bank claim does not depend on a police case, but where a fraud is involved a police or portal complaint helps establish the transaction was not authorised, and supports the recovery of any traced funds.
FileX Advocates & Legal Consultants, Kolkata, drafts and files these matters before the Calcutta High Court, City Civil and Sessions courts, magistrate, family, consumer and tribunal forums. Call +91 7439811422 or WhatsApp us for a free first consultation.