RBI zero-liability rules for an unauthorised transaction: when the bank bears the loss

Written and verified by the Grahak Mitra research team — an independent project documenting digital consumer self-help in India.

Last updated: 2026-07-10

Short answer: it depends on how the money left your account, and how fast you report it. The Reserve Bank of India (RBI) has a framework for limiting a customer's liability in an unauthorised electronic transaction. Where the loss was caused by a third party — not by you and not by any lapse on the bank's side — and you report it promptly, the rules can place zero or limited liability on you, meaning the bank bears the loss. This is a conditional right, not a promise of a refund.

Where you shared an OTP, PIN, password or card details, or approved the payment yourself, banks routinely treat the loss as arising from customer negligence and may hold you liable. Whether the RBI rules protect you turns on who was at fault and how quickly you told the bank.

Who typically bears the loss

This table is a plain guide to how the RBI framework is generally applied. It is not a ruling on your specific case — that is decided by your bank on the facts, and can be escalated to the RBI Ombudsman.

Why reporting speed matters

Under the RBI framework, the sooner you report an unauthorised transaction, the stronger your position. The circular sets specific time thresholds — reporting within them can keep your liability at zero, while delay can shift more of the loss onto you. The exact number of days and the liability tiers are set by the RBI and can change, so the current numbers are on the linked RBI source — check them there rather than relying on a figure quoted second-hand. The safe rule that never goes stale: report in writing the moment you notice.

How to put yourself in the strongest position

1. Report to your bank in writing immediately — through the app, netbanking, the branch, or the bank's fraud helpline — and get a complaint reference number. Written, dated notice is what the framework turns on.
2. Call 1930, the national cyber-crime helpline, and file at cybercrime.gov.in if this was fraud — this creates the official record and helps trace the money. See the first-hour guide.
3. Ask the bank to record it as unauthorised and to block further debits.
4. Keep everything — the reference number, dates, screenshots, and any letters. This is your evidence if the bank disputes fault.
5. If the bank refuses or delays, escalate to the RBI Ombudsman (see below). A refusal is not the end of the road.

Beware a second scam: the only ways to report are your own bank, 1930, and cybercrime.gov.in. Anyone who phones or messages offering to recover your lost money for a fee — a "recovery agent", "refund officer", or fake "cyber cell" — is a fresh fraud. No genuine refund ever requires you to pay first. Never pay to get your money back.

If the bank refuses the refund

A denial by the bank is not final. If your bank does not resolve the complaint within a reasonable time, or you disagree with its decision on liability, you can escalate:

• RBI Integrated Ombudsman (cms.rbi.org.in) — the free, independent route for a bank or payment-system grievance the bank did not resolve. You will need your bank complaint reference.
• National Consumer Helpline (1915) — general consumer grievance support.

See the companion guide on how to file a bank dispute for an unauthorised transaction for the step-by-step process. All the official routes are linked below so you can act directly.