Unauthorised Bank Transaction? RBI's Zero and Limited Liability Rules

1. When Does a Bank Customer Have 100% Zero Liability for an Unauthorised Transaction?

The Reserve Bank of India enacted this binding statutory directive under Section 35A of the Banking Regulation Act, 1949 to stop commercial banks from hiding behind one-sided account terms. Under Paragraph 6(a), if the loss occurs due to a bank server vulnerability, an insider employee leak, card skimming at an ATM, or an international transaction processed without mandatory Additional Factor of Authentication (AFA/OTP), the customer's liability is zero from Day 1—irrespective of whether or when the customer reports it.

Under Paragraph 6(b), where the fraud originates from a third-party system breach—such as a compromised merchant database, a telecom SIM-swap attack, or a malicious APK/remote-screen exploit where the customer never voluntarily shared their OTP or MPIN to authorise the payment—the customer incurs zero financial loss provided they notify the bank within three working days of receiving the communication from the bank regarding the unauthorised debit. Crucially, Footnote 1 to Paragraph 6(b) specifies that the 3-working-day count excludes the exact date on which the customer received the alert.

2. What Is Your Limited Liability If You Report Between 4 and 7 Working Days?

Banks frequently mislead customers into believing that missing the 3-working-day window forfeits the entire refund claim. That is false under the RBI rulebook. If ₹1,80,000 is siphoned from your regular savings account in a third-party breach and you report it on the 5th working day after receiving the SMS alert, the bank can deduct at most ₹10,000 (your limited liability cap under Table 1) and must statutorily refund the remaining ₹1,70,000 to your account.

Only when a customer delays reporting beyond 7 working days after receiving the bank's alert does liability fall under the bank's Board-approved policy (Paragraph 7(b)(ii)). Even then, the bank must publicly display that Board-approved policy and provide every customer with its details at the time of account opening. For active recovery assistance on disputed debits, review our dedicated hub on recovering fraudulent UPI, card and bank transaction amounts.

3. Within How Many Working Days Should Shadow Reversal Be Credited by the Bank?

This is one of the most heavily searched banking rules in India (and a core benchmark in JAIIB/CAIIB banking examinations and Ombudsman adjudications): 10 working days from the date of customer notification. A "shadow reversal" (or provisional credit) restores the disputed funds to your account ledger while the bank conducts its internal forensic or chargeback investigation.

• •Value-Dated to the Date of Fraud (Paragraph 9(ii)): For a savings or overdraft account, back-dating the shadow credit to the date of the unauthorised debit ensures you lose zero savings interest and pay zero penal overdraft interest. For a credit card, it ensures zero 36%–42% finance charges or late-payment penalties accrue on the fraudulent swipe.
• •No Insurance Delay Excuse (Paragraph 9(i)):Banks carry Bankers' Indemnity and Cyber Crime Insurance policies, but Paragraph 9 explicitly forbids banks from delaying your 10-working-day shadow credit while waiting for their insurer to approve or settle the claim.

4. Who Bears the Burden of Proof in an Unauthorised Electronic Transaction Dispute?

In practice, almost every retail bank in India initially rejects fraud complaints with a standard two-line email stating: "The transaction was authenticated via 2FA/OTP/MPIN; hence the bank is not liable." Under Paragraph 12, that mechanical assertion does not discharge the bank's statutory burden.

As the Bombay High Court held in Jaiprakash Kulkarni v. Banking Ombudsman & Bank of Baroda (2024), the mere fact that an electronic system recorded an OTP or IP log does not prove that the customer negligently shared credentials—especially where SIM-cloning, malware SMS-forwarding APKs, man-in-the-middle attacks, or unverified beneficiary additions occurred. To deny a refund, the bank must furnish concrete forensic evidence establishing affirmative customer negligence.

5. What If You Were Tricked Into Sharing an OTP—Who Bears Losses After You Notify the Bank?

This is a vital legal lifeline in multi-tranche phishing frauds. Suppose a fraudster tricks an account holder at 2:10 PM into sharing an OTP for a ₹15,000 debit. Realising the scam immediately, the customer calls the bank's 24x7 toll-free fraud hotline at 2:14 PM or sends the mandatory SMS block command. If the bank's IVR fails to freeze the account immediately and the fraudster executes three more debits of ₹50,000 each at 2:22 PM, 2:25 PM, and 2:30 PM, Paragraph 7(a)(i) makes the bank 100% liable for the ₹1,50,000 debited after 2:14 PM.

Furthermore, under Paragraph 7(a)(ii), banks are expressly encouraged by the RBI to waive even the pre-reporting customer liability in cases of tricked credentials via a Board-approved policy. If you instead transferred money yourself to an unintended recipient or wrong account number, use our wrong account transfer refund application format to initiate beneficiary-bank lien marking and reversal.

6. What Happens If the Bank Fails to Resolve Your Complaint Within 90 Days?

The RBI inserted Paragraph 11 to prevent banks from keeping a customer's shadow credit in perpetual "lien" or "under investigation" status for years. The bank has a strict 90-calendar-day outer ceiling from the complaint date to complete its forensic audit and prove customer liability. If Day 90 expires without conclusive proof of customer negligence, the provisional shadow reversal becomes absolute and irrevocable, with zero loss of debit-account interest or imposition of credit-card interest.

7. Does the RBI Zero Liability Circular Cover UPI, Credit Cards, and Prepaid Wallets (PPIs)?

Whether an unauthorised debit hit your savings account via a UPI collect/push exploit on Google Pay, PhonePe, or Paytm, or via an unauthenticated credit card swipe or wallet transfer, the statutory protections are identical. Under the 4 January 2019 PPI Circular, even non-bank wallet issuers must provide 24x7 reporting channels, send mandatory SMS alerts for every debit, cap 4–7 day reporting liability at ₹10,000, and credit shadow reversal within 10 days. If your bank instead deducted wrongful auto-debits or bounce fees, see our guide on serving a legal notice for unauthorised ECS/NACH debit reversal and recovering unauthorised bank charges and liens.

8. Why Did the Supreme Court Rule That State Bank of India Must Refund Unauthorized Withdrawals?

This landmark 2025 Supreme Court order destroys the two most common excuses banks use to reject cyber-fraud victims: (1) claiming that the transaction happened through a third-party UPI app like Google Pay or PhonePe, and (2) claiming that installing an app during a customer-service call automatically equals "customer negligence". The Supreme Court observed that banks hold the statutory duty to deploy robust anomaly-detection technology capable of flagging suspicious, rapid-fire withdrawals, and must honour Clauses 8 and 9 of the 2017 RBI Circular when customers report promptly.

9. What Duties Does Paragraph 5 Impose on Banks Regarding SMS Alerts and Loss Reporting?

If a bank fails to send an instant SMS alert for an electronic banking debit, or if its toll-free fraud hotline/IVR was unreachable when you tried to report the loss, the bank violates Paragraph 5. Under the RBI circular, the 3-working-day reporting window is measured strictly from the date of receiving the communication from the bank—meaning if no SMS was delivered, your 3-day window begins only when you first receive your passbook update or email statement. Additionally, always report the incident on the 1930 National Cyber Crime Helpline and cybercrime.gov.in (see our Hindi guide on साइबर फ्रॉड का पैसा वापस कैसे मिलेगा for step-by-step 1930 freeze procedure).

10. How Does the 1 January 2027 RBI Revised Framework Change Fraud Compensation? (†)

Under the 2017 circular, if a victim was manipulated through social engineering, fake KYC threats, or "digital arrest" coercion into entering their own UPI PIN or reading out an OTP, banks routinely denied refunds under Paragraph 7(a) as "customer-authorised transactions". The 1 January 2027 framework† closes that gap for small retail losses (gross loss ≤ ₹50,000) by creating a tripartite compensation pool shared by the RBI, the customer's bank, and the beneficiary bank—provided the victim reports to both their bank and the 1930 / NCRP portal within 5 calendar days†. For a full breakdown of the new rules, read our dedicated guide on the RBI Fraudulent Transaction Framework 2027.

11. RBI Zero & Limited Liability Eligibility Checker (Static Yes/No + Interactive Calculator)

Verify the 5-point statutory Yes/No rulebook checklist below or use the interactive calculator to determine your exact refund entitlement under RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18:

12. Official RBI Customer Liability Tables (Table 1, Table 2 & 2017 vs. 2027 Framework)

Below are the exact statutory liability slabs reproduced from Paragraph 7 of RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18 alongside a side-by-side comparison with the upcoming 1 January 2027 Revised Framework†:

13. Statutory Escalation Flowchart: From Unauthorised Debit to 10-Day Shadow Credit & Ombudsman Award

Follow this 5-stage statutory escalation rail to lock in your 3-working-day Zero Liability timestamp and force your bank to release your refund:

15. Worked Case Study: Account Holder Recovers ₹1,42,000 Unauthorised IMPS/UPI Debits After Bank Refused 10-Day Shadow Credit

16. Banking Evidence Checklist: 6 Essential Records Before Serving a Zero-Liability Legal Notice

Under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (BSA), electronic banking logs, SMS timestamps, and NCRP dockets are primary evidence before the RBI Ombudsman and Consumer Commissions. Assemble these 6 records:

17. Honest Recovery Scope: What LegalRecovery Can and Cannot Do in Banking Fraud Disputes