Unauthorised Transaction in Your Bank Account? Report Within 3 Days for Zero Liability: RBI Rules
Report within three working days. That one rule decides whether you lose nothing or something when money leaves your account without your permission. Under RBI’s customer protection rules, how much of an unauthorised transaction (made electronically) you bear depends on who was at fault and how fast you told the bank. Here is the checklist, from RBI’s circular of 6 July 2017.
Unauthorised transaction: the 5-step checklist
- Block the card or channel at once. Use the bank’s app, SMS or helpline. RBI requires banks to offer a 24×7 reporting channel and to stop further debits once you report.
- Report to the bank in writing, today. Use the bank’s app, email or the link in the alert SMS, and note the complaint number and time. The clock starts when the bank’s alert reaches you.
- Report cyber fraud to the police. Call 1930 or file at cybercrime.gov.in, especially for UPI or account-takeover frauds.
- Watch for the shadow credit. The bank must credit the disputed amount to your account within 10 working days of your report.
- Escalate after 30 days. If the bank does not reply or you disagree, complain to the RBI Ombudsman.
How much you lose depends on timing
| Situation | Your liability |
|---|---|
| Fraud due to the bank’s negligence or deficiency | Zero liability, whenever you report |
| Third-party breach (fault neither yours nor the bank’s), reported within 3 working days | Zero |
| Third-party breach, reported in 4 to 7 working days | Limited: the lower of the amount or the cap below |
| Third-party breach, reported after 7 working days | As per the bank’s board-approved policy |
| Your negligence (e.g. you shared an OTP or PIN) | Full loss until you report; after that, the bank bears it |
The caps for 4–7 day reports
| Account type | Maximum liability per transaction |
|---|---|
| Basic savings bank deposit (BSBD) account | ₹5,000 |
| Other savings accounts, prepaid instruments and gift cards, MSME current/CC/OD, individual current/CC/OD with average balance or limit up to ₹25 lakh, credit cards with limit up to ₹5 lakh | ₹10,000 |
| Other current/CC/OD accounts, credit cards with limit above ₹5 lakh | ₹25,000 |
Example: ₹40,000 leaves your savings account through a skimmed card. You report on the fifth working day. Your liability is capped at ₹10,000. In a BSBD account it would be ₹5,000; on a credit card with a ₹6 lakh limit, ₹25,000. Report on day two and it is zero.
What the bank must do
- Send you SMS alerts for electronic transactions (you must register a mobile number).
- Credit the amount as a shadow reversal within 10 working days, value-dated to the day of the fraud, without waiting for any insurance claim.
- Resolve the complaint and decide your liability within 90 days. If it can’t, it must pay you the compensation as if you were not liable.
- Make sure you lose no interest on a debit card or account, and pay no extra interest on a credit card.
A bank may also choose to waive your liability even where you were negligent.
What to put in your complaint
- Your name, account or card number (last four digits only in email), and registered mobile number
- Date, time and amount of each transaction you did not make, copied from the alert
- When and how you received the alert, and when you blocked the card or channel
- A clear line: “I did not authorise these transactions and did not share my PIN, OTP or password” (only if true)
- A request for the shadow credit within 10 working days under the RBI circular of 6 July 2017
Mistakes that cost people money
- Waiting for the bank to call. The three working days run from the bank’s alert, not from when you notice.
- Only calling customer care. Get it in writing, with a reference number.
- Sharing an OTP with “the bank”. That counts as your negligence. Our post on online payment authentication rules explains what banks will and won’t ask.
- Confusing a failed transaction with fraud. Failed UPI debits follow a separate refund timeline; see failed UPI transaction refund.
If the bank freezes or holds funds while it investigates, read debit holds on bank accounts. For escalation, see our RBI Ombudsman complaint guide.
Short answers follow.
FAQs
How many days do I have to report an unauthorised transaction?
Three working days from the bank’s alert for zero liability in a third-party breach. Days 4 to 7 bring a capped liability.
When will I get my money back?
The bank must give a shadow credit within 10 working days of your report and settle the case within 90 days.
Does this apply to co-operative banks?
The 2017 circular we read covers scheduled commercial banks. Co-operative banks have separate RBI instructions, which we did not re-read today; check your bank’s customer protection policy.
I shared my OTP. Do I get anything back?
You bear the loss until you report. Anything taken after your report is the bank’s liability.
Takeaway: for an unauthorised transaction, block, report in writing within three working days, and expect a shadow credit within 10 working days.
Rules and helplines
- RBI circular: Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 6 Jul 2017
- National Cyber Crime Reporting Portal (helpline 1930)
- RBI Complaint Management System
Partly verified, 12 Oct 2026, 6:00 AM IST. Read in full: RBI circular of 6 Jul 2017 on limiting customer liability. Not re-checked: whether these paragraphs now sit in a later consolidated RBI Direction, and RBI’s separate instructions for co-operative banks. cybercrime.gov.in and cms.rbi.org.in load (checked today).
