How to Report an Unauthorised Bank Transaction and Get a Refund Under RBI Rules
- Kaustav Chowdhury
- 5 days ago
- 3 min read
If money disappears from your account through a fraudulent or unauthorised bank transaction, the Reserve Bank of India gives you strong protection, but only if you act fast. Under the RBI rules on limiting customer liability in unauthorised electronic banking transactions, a customer who reports the fraud promptly can bear zero liability and get the money credited back. This guide explains how to report the transaction, the timelines that decide your liability, and what the bank must do.
Act Immediately and Report Within Three Working Days
The single most important rule is speed. Where the loss is due to a third-party breach and is no fault of yours or the bank, you bear zero liability if you notify the bank within three working days of receiving the communication about the transaction. The clock runs from when you are informed, which is why you should never ignore transaction alerts. Block your card or net banking access at once, and lodge a written complaint so there is a dated record of when you reported.
If you report a little later, between four and seven working days, your liability is limited rather than zero, and is capped according to the schedule in the RBI circular based on the type of account. Delay beyond that window, or where your own negligence such as sharing a PIN or OTP caused the loss, can shift more of the burden onto you until you report. The lesson is consistent: report at the earliest moment.
The Bank Must Reverse the Amount Within Ten Days
Once you notify the bank, it is required to credit the disputed amount to your account within ten working days from the date of your notification, without waiting for any insurance claim to be settled. This temporary credit is often called a shadow reversal. The bank must also resolve the complaint and finally fix any customer liability within ninety days. If the bank delays or refuses, that is itself a deficiency you can escalate.
Banks are also obliged to treat customers fairly throughout the process, much as they are when it comes to the conduct of recovery agents under RBI guidelines. A customer who has been wronged should not be made to chase the bank endlessly for a refund that the rules already mandate.
Step by Step: What to Do
First, freeze the affected card or account channel through your banking app or the helpline. Second, report the fraud to your bank in writing and keep the acknowledgement. Third, report the cyber fraud on the national cybercrime helpline by dialling 1930 and registering a complaint, which can help freeze the money trail. Fourth, follow up in writing if the ten-day credit does not appear. Keep every reference number, email and screenshot, because documentation decides disputes.
If the bank does not resolve your complaint satisfactorily, you can escalate to the RBI Ombudsman scheme, and in suitable cases to a consumer commission. Customers have also recovered losses through the courts when a service provider's negligence enabled the fraud, as seen in a SIM-swap fraud case where a telecom operator was held liable.
Protecting Yourself Going Forward
Never share your PIN, password, CVV or OTP with anyone, including callers claiming to be from your bank. Enable transaction alerts on every account and review them daily. Use the official app, and be wary of links sent over message or email. Separately, it is worth checking whether you have forgotten deposits lying unclaimed through the RBI UDGAM portal, since unclaimed funds are a different but common issue.
It helps to understand how liability shifts with time, because the rules reward prompt action and penalise delay. If you travel or are unreachable for long periods, set up a trusted contact or make sure your alerts reach an active number and email, so that the three-day window does not run out before you even learn of a fraud. Updating these details is quick and can make the difference between a zero-liability outcome and a contested one.
Keep your contact details with the bank current. Many disputes turn on whether the customer was actually informed of a transaction, and an outdated mobile number or email address can complicate an otherwise strong claim. A few minutes spent confirming your registered details today can save weeks of argument later.
Related Reading
Key Takeaways
Report an unauthorised bank transaction within three working days to bear zero liability under RBI rules; reporting between four and seven working days limits but does not eliminate your liability. The bank must credit the disputed amount within ten working days and resolve the complaint within ninety days. Block the channel, file a written complaint, dial the cyber helpline on 1930, and preserve all records to support your claim.
Comments