Vakil AI
Banking & payments

Money taken from your account through UPI, card or net banking without your permission

RBI rules limit what you lose to an unauthorised electronic transaction, and they depend heavily on how quickly you report it. Here is how the rules work today.

Reviewed by Anjali & NaveenUpdated 7 min read

In short

  • RBI rules limit a customer's liability for unauthorised electronic banking transactions, such as UPI, card, net banking and other digital payments from a bank account.
  • How quickly you report to your bank matters most. Under the current rules, reporting within three working days can mean zero liability where the fault lies with a third party, not you or the bank.
  • Where the bank was at fault, the customer's liability is zero whether or not they reported it.
  • Banks must credit the disputed amount to your account within 10 working days of your report, while they investigate, and must resolve the complaint within 90 days.
  • Cyber fraud can also be reported on the national helpline 1930 or at cybercrime.gov.in (opens in new tab). Different RBI rules will apply only to transactions made on or after 1 January 2027. They are not in force yet.

Reviewed by 2 advocates · 2 Bar Councils

  • Approved ·

    Practises civil and consumer law

    Reviewed this guide for accuracy against the sources listed below. How we review guides →

02What the law says

The rules that apply now. The rules were first set out in an RBI circular of 6 July 2017. In November 2025, RBI consolidated them into the Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Directions, 2025. Similar directions apply to small finance, payments, regional rural and co-operative banks. The core rules did not change in the consolidation, and they apply to every transaction made before 1 January 2027.

Under these rules, your liability depends on who was at fault and when you reported:

  • Bank's fault (fraud, negligence or deficiency by the bank): zero liability, whether or not you reported.
  • Third-party breach (the fault is neither yours nor the bank's, but somewhere else in the system): zero liability if you report within three working days of receiving the bank's message about the transaction. If you report in four to seven working days, your liability is the transaction value or a fixed cap, whichever is lower. The cap is ₹5,000 for basic savings (BSBD) accounts; ₹10,000 for other savings accounts, prepaid instruments, gift cards, credit cards with a limit up to ₹5 lakh, and some current accounts; and ₹25,000 for other current accounts and credit cards with a limit above ₹5 lakh. After seven working days, the bank's Board-approved policy decides.
  • Your own negligence (for example, sharing your PIN, OTP or password): you bear the loss until you report it. Any loss after you report is the bank's.

The bank has to prove that the customer is liable. Working days are counted by your home branch's schedule, not counting the day you received the bank's message.

The change from 1 January 2027 (not yet in force). On 24 June 2026, RBI issued the Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026. They take effect on 1 January 2027 and apply only to transactions made on or after that date. For those transactions, the zero-liability window for a third-party breach becomes five calendar days, banks must resolve domestic fraud complaints within 45 days, and a one-time compensation scheme is added for some small losses caused by the customer's own negligence. Transactions before 1 January 2027 stay under the current rules described above.

03Where you can go

  1. Your bank. Banks must offer 24x7 reporting channels (such as app, SMS, phone, website or branch). The complaint number creates a record.
  2. National Cyber Crime Reporting Helpline 1930 / cybercrime.gov.in (opens in new tab). For reporting cyber fraud, including financial fraud. The helpline is available 24 hours a day.
  3. RBI Ombudsman. At cms.rbi.org.in (opens in new tab), if the bank doesn't reply within 30 days or you are unhappy with its reply. The complaint is generally due within 90 days after that.
  4. Police or civil and consumer forums. Some people also file a police complaint or use other legal routes, depending on the facts.

04How it usually works

  1. 01

    The customer notices a debit they didn't make, often through the bank's SMS or email alert.

  2. 02

    The customer reports it to the bank and gets a complaint number. Many people also block the card or UPI access and report on 1930.

  3. 03

    The bank is expected to credit the disputed amount within 10 working days of the report, backdated to the transaction date, while it investigates.

  4. 04

    The bank investigates and decides who is liable. It must do this within 90 days.

  5. 05

    If the bank rejects the claim or doesn't reply within 30 days, a complaint can be filed with the RBI Ombudsman.

05Time limits

These are the current rules, for transactions made before 1 January 2027:

  • 3 working days: report within this time for zero liability in a third-party breach.
  • 4 to 7 working days: your liability is limited to the transaction value or the cap for your account type, whichever is lower.
  • After 7 working days: the bank's Board-approved policy applies.
  • 10 working days: for the bank to credit the disputed amount after your report.
  • 90 days: for the bank to resolve your complaint.

For transactions on or after 1 January 2027 (not yet in force):

  • 5 calendar days: the reporting window for zero liability in a third-party breach.
  • 45 days: for the bank to resolve a domestic fraud complaint.

06Documents to gather

  • The bank's SMS or email alert for the transaction, with date and time
  • Bank or card statement showing the debit
  • Complaint numbers from the bank and from 1930 or cybercrime.gov.in (opens in new tab)
  • Screenshots of any suspicious calls, messages, links or apps
  • Any police complaint copy, if filed
  • A short timeline of what happened and when you reported it

07Common questions

Under the current rules, sharing payment credentials is usually treated as customer negligence. The loss until you report falls on you, and the loss after you report falls on the bank. A bank can choose to waive liability, but it doesn't have to.

The rules require the bank to credit the amount within 10 working days of your report, value-dated to the transaction date. The final outcome depends on the bank's investigation.

The new rules apply only to transactions on or after 1 January 2027. For those, the zero-liability window for a third-party breach changes to five calendar days, and domestic complaints must be resolved within 45 days. Individuals who lose up to ₹50,000 through their own negligence may get 85% of the net loss or ₹25,000, whichever is less, once in a lifetime. This applies only if they report to the bank and to 1930 or the cybercrime portal within five calendar days, and it covers frauds in the first year of the new rules.

These rules apply to your bank. Wallets and other prepaid instruments may be covered by separate RBI rules. Many people report to both the app and the bank.

08Questions to ask an advocate

If you speak to an advocate, these questions can help make the conversation useful.

  • Would my case be treated as the bank's fault, a third-party breach, or my own negligence?
  • Was my report within the time limits, counted in working days from the bank's alert?
  • The bank rejected my claim. Is the Ombudsman, a consumer commission or a civil court the better forum for my facts?
  • Should I also file a police complaint, and how does that affect the bank's process?

09Sources

Related guides

Banking & payments

Complaining to the RBI Ombudsman

The Reserve Bank – Integrated Ombudsman Scheme, 2026 is a free way to escalate complaints about banks, many NBFCs and payment providers. Here is how it works.

6 min read
Legal tools

Fake notices and "digital arrest" scams

Scammers pose as police, CBI, courts or advocates to frighten people into paying. Here's what the government says, how to check a notice, and where to report.

5 min read
Consumer & online shopping

Order not delivered or refund delayed?

What e-commerce rules and RBI payment rules say when an online order goes wrong, and how complaints are usually escalated.

4 min read

This guide is general legal information for India, not legal advice. Laws and procedures change and can differ by state. For advice on your situation, speak to a qualified advocate.

Editorial policy

Get your situation organised

Vakil helps you understand your situation and prepare before you see a lawyer.