OTP Fraud and Banking Loss: Is the Bank Responsible?
A bank can be responsible for money lost through OTP fraud if the loss occurs because of the bank’s negligence, security failure or certain unauthorised transactions. However, if a customer voluntarily shares an OTP, the bank may not be liable for the loss before the fraud is reported. RBI guidelines explain when customers are entitled to refunds and how liability is determined in banking fraud cases.
What Is OTP Fraud in Banking?
OTP fraud is a type of financial fraud in which criminals obtain or misuse a One-Time Password (OTP) to carry out unauthorised banking transactions. An OTP is a temporary security code used to verify payments, account access or other banking activities.
Add LawBhoomi as your preferred source on Google.
Fraudsters often pretend to be bank employees, customer support representatives or officials from trusted organisations. They may contact customers through phone calls, messages or fraudulent websites to obtain confidential banking information.
Once the OTP is obtained, the fraudster may use it to transfer money or complete an unauthorised transaction.
However, not every fraudulent banking transaction involves a customer sharing an OTP. Some transactions may result from technical weaknesses, compromised systems or other security failures.
Is the Bank Responsible for Money Lost Through OTP Fraud?
Yes, a bank can be held responsible for OTP fraud losses, depending on the circumstances of the transaction. The Reserve Bank of India (RBI) has established rules governing customer liability in unauthorised electronic banking transactions.
Discover the latest legal jobs and career openings.
According to RBI guidelines, bank responsibility generally depends on three situations.
Fraud Caused by the Bank’s Negligence
If an unauthorised transaction occurs because of fraud, negligence or a deficiency attributable to the bank, the customer has zero liability.
For example, if a banking security failure allows criminals to access customer funds, the bank may be responsible for the resulting loss.
Fraud Caused by Customer Negligence
If a customer shares confidential payment credentials, including an OTP, and this causes the loss, the customer generally bears the loss until the transaction is reported to the bank.
However, any additional unauthorised loss occurring after reporting the incident must be borne by the bank.
Fraud Caused by a Third-Party Breach
Sometimes, an unauthorised transaction occurs without negligence by either the bank or the customer.
In such circumstances, the customer’s liability depends on how quickly the incident is reported to the bank.
What Do RBI Guidelines Say About OTP Fraud?
The RBI’s customer protection rules on unauthorised electronic banking transactions provide safeguards for customers affected by banking fraud.
Explore practical law courses to build career-ready legal skills.
The RBI circular dated 6 July 2017 established important principles concerning customer liability, reporting obligations and refunds.
Zero Liability of Customers
A customer has zero liability in two major situations:
- Bank negligence or security failure: When fraud, negligence or deficiency on the bank’s part causes the unauthorised transaction, the customer is not responsible for the loss, regardless of when the incident is reported.
- Third-party security breach: When neither the bank nor the customer is responsible, the customer has zero liability if the unauthorised transaction is reported within three working days of receiving the bank’s transaction communication.
These provisions protect customers from bearing losses caused by failures beyond their control.
Limited Liability of Customers
When an unauthorised transaction results from a third-party breach, and the customer reports it within four to seven working days, liability is limited.
The maximum liability depends on the type of account and applicable RBI limits. For example, the prescribed ceiling for several ordinary savings bank accounts is ₹10,000, while certain other accounts have different limits.
If the transaction amount is lower than the applicable ceiling, the customer’s liability cannot exceed the transaction amount.
Reporting After Seven Working Days
When a third-party breach is reported after seven working days, customer liability is determined according to the bank’s Board-approved policy.
Importantly, these reporting periods do not automatically protect customers whose own negligence caused the loss.
Generally, a bank is not liable for losses occurring before reporting when the loss was caused by the customer’s negligent disclosure of an OTP or other payment credentials.
Find the latest legal internship opportunities, updated daily.
For example, suppose a customer receives a fraudulent call from someone pretending to be a bank employee. The caller requests an OTP for account verification.
If the customer shares the OTP and the fraudster transfers ₹40,000, the bank may treat the transaction as resulting from customer negligence.
However, this does not automatically settle every dispute.
The bank must establish that the customer was responsible for the loss. If the customer disputes having shared the OTP or alleges a banking security failure, the surrounding circumstances require examination.
Further, once the customer reports the unauthorised transaction, the bank becomes responsible for additional unauthorised losses occurring after reporting.
Who Has to Prove Negligence in an OTP Fraud Case?
Under RBI customer protection rules, the burden of proving customer liability rests with the bank.
This means the bank must establish the grounds on which it considers the customer responsible for the unauthorised transaction.
The bank may examine transaction records, authentication details, fraud reports and other relevant evidence.
For example, the fact that an OTP was used during a transaction does not necessarily establish that the customer voluntarily shared it.
If the customer claims that the transaction occurred without authorisation, the bank must examine the complaint according to applicable RBI requirements.
This requirement is important because customers may not have access to the technical records needed to understand how a fraudulent transaction occurred.
How Quickly Must a Bank Refund Money Lost Through OTP Fraud?
RBI rules prescribe specific timelines for handling eligible unauthorised electronic banking transactions.
Refund Within 10 Working Days
After receiving a report of an unauthorised transaction, the bank must provide a shadow reversal, or provisional credit, within 10 working days under the applicable customer protection framework.
The credit is provided without waiting for the settlement of any insurance claim.
However, provisional credit does not automatically mean that the bank has accepted final liability for the entire disputed amount.
Complaint Resolution Within 90 Days
Banks must resolve unauthorised transaction complaints and determine customer liability within the period specified in their Board-approved policy, subject to a maximum of 90 days.
If liability cannot be determined within this period, the applicable compensation provisions must be followed.
These timelines are particularly important where the customer disputes responsibility for the fraudulent transaction.
What Should Be Done Immediately After OTP Fraud?
Quick action can reduce financial losses and improve the possibility of recovering stolen money.
Report the Fraud to the Bank
The first step is to contact the bank through its official fraud-reporting helpline, mobile application or website.
The complaint should include the transaction amount, transaction date and relevant payment details. A complaint reference number should also be obtained.
The bank should be asked to block compromised banking channels and take steps to prevent further unauthorised transactions.
Report the Fraud Through the Cybercrime Helpline
Financial cyber fraud can be reported by calling 1930, the national cybercrime helpline.
A complaint can also be submitted through the National Cybercrime Reporting Portal.
Early reporting may help authorities take steps to trace or freeze funds, although recovery is not guaranteed.
Preserve Evidence of the Fraud
Relevant evidence should be preserved, including bank transaction messages, screenshots, call records, suspicious links and complaint acknowledgements.
These records can help establish when the fraud occurred, how the transaction was conducted and when the bank was informed.
Submit a Written Complaint
If the matter remains unresolved, a written complaint should be submitted through the bank’s grievance redressal mechanism.
The complaint should clearly explain why the transaction was unauthorised and request an investigation under RBI customer liability rules.
Can a Complaint Be Filed With the RBI Ombudsman?
Yes. If a bank does not resolve an OTP fraud complaint satisfactorily, an eligible customer can approach the RBI Ombudsman.
The Reserve Bank – Integrated Ombudsman Scheme, 2026, which came into effect on 1 July 2026, provides a grievance redressal mechanism for complaints involving deficiencies in services provided by regulated entities.
Ordinarily, a complaint must first be submitted to the bank. If the bank rejects it, provides an unsatisfactory response or fails to respond within the applicable waiting period, generally 30 days unless another prescribed period applies, the customer may approach the Ombudsman.
Complaints can be filed through the RBI Complaint Management System.
Under the 2026 Scheme, the Ombudsman may award compensation of up to ₹30 lakh for consequential loss and an additional amount of up to ₹3 lakh for qualifying inconvenience, expenses or harassment.
These amounts are maximum limits, not guaranteed compensation for every case.
Can a Customer Take Legal Action Against the Bank?
Yes. Depending on the circumstances, a customer may pursue legal remedies when a bank fails to comply with its obligations.
For example, where a bank negligently handles an unauthorised transaction complaint or refuses a refund contrary to applicable RBI rules, the customer may consider proceedings before an appropriate consumer commission.
The Consumer Protection Act, 2019, provides remedies for deficiency in services, including qualifying banking services.
However, the success of a complaint depends on the available evidence, the bank’s conduct, applicable regulations and whether the customer contributed to the loss.
Appropriate remedies may include reimbursement, compensation or other relief permitted by law.
How Can OTP Banking Fraud Be Prevented?
Although banking institutions must maintain appropriate security systems, customers also have an important role in preventing financial fraud.
- Never disclose an OTP or banking PIN: Banks do not require customers to share confidential authentication codes with callers. Such information should not be disclosed even when the caller claims to represent the bank.
- Avoid suspicious payment links: Fraudsters frequently circulate fake KYC update links, refund messages and account verification requests. Banking activities should be carried out through verified banking channels.
- Monitor banking transactions: Transaction alerts can help identify suspicious activity quickly. Immediate reporting is particularly important because customer liability may depend on the time taken to notify the bank.
- Use official reporting channels: Fraud should be reported through verified bank contact details rather than telephone numbers or links provided by suspicious callers.
Conclusion
Banks are not automatically responsible for every OTP fraud loss. Liability depends on whether the fraud resulted from bank negligence, customer negligence or a third-party breach.
Under RBI rules, customers may receive full or partial protection against unauthorised banking losses. However, voluntarily sharing an OTP can affect the right to a refund.
Prompt reporting, preservation of evidence and understanding RBI customer liability guidelines are essential for resolving OTP fraud disputes.
Join LawBhoomi’s 100K+ Community
