Unauthorized Digital Transactions: Who Bears the Loss?
If money is deducted from a bank account without permission, the bank may have to bear the loss under RBI rules. In India, liability for unauthorised digital transactions depends on who caused the fraud and how quickly it was reported. Customers may have zero liability, limited liability or full liability in different situations. The RBI also provides rules for refunds and complaint resolution.
An unauthorised digital transaction is an electronic banking transaction carried out without the account holder’s permission or valid authorisation. Such transactions may involve internet banking, mobile banking, debit cards, credit cards or digital payment systems.
Add LawBhoomi as your preferred source on Google.
For example, if ₹20,000 is transferred from a bank account without the account holder’s knowledge or consent, it may qualify as an unauthorised transaction.
Common situations include:
- Unauthorised UPI transfers: Fraudsters gain access to a person’s banking credentials and transfer money without permission. Such cases may involve stolen devices, compromised accounts or other security breaches.
- Debit or credit card fraud: Criminals obtain card details and use them to make unauthorised payments. These transactions may occur online or through compromised payment systems.
- Internet banking fraud: Unauthorised persons gain access to an online banking account and transfer funds without the account holder’s consent.
However, a payment personally authorised after being deceived by a fraudster may raise different liability issues. The exact nature of the transaction is important when determining responsibility.
The Reserve Bank of India issued guidelines on 6 July 2017 concerning customer liability in unauthorised electronic banking transactions.
Find the latest legal internship opportunities, updated daily.
Under these rules, the financial responsibility generally depends on whether the loss occurred because of bank negligence, a third-party security breach or customer negligence.
When the Bank Is Responsible
If an unauthorised transaction occurs because of fraud, negligence or deficiency on the bank’s part, the customer has zero liability.
For example, if a bank’s security failure allows fraudsters to access an account and withdraw ₹50,000, the customer cannot be made responsible for that loss under the applicable RBI rules.
This protection applies irrespective of whether the customer reports the transaction.
When a Third Party Is Responsible
Sometimes, fraud occurs because of a security breach elsewhere in the payment system, without negligence by either the bank or the customer.
In such cases, the customer has zero liability if the unauthorised transaction is reported to the bank within three working days of receiving the transaction communication.
If the reporting is delayed, the customer’s liability may increase according to RBI guidelines.
When the Customer Is Responsible
If the loss occurs because of customer negligence, such as voluntarily sharing an OTP, password or payment credentials, the customer generally bears the loss occurring before the bank is informed.
Explore the latest legal opportunities for law students and lawyers.
However, once the unauthorised transaction is reported, the bank must bear any further unauthorised loss.
For example, suppose ₹30,000 is withdrawn after a customer shares banking credentials. If another ₹10,000 is withdrawn after the fraud has been reported to the bank, the bank must bear that subsequent loss under the RBI framework.
The RBI’s three-day rule provides zero customer liability for qualifying third-party security breaches reported within three working days.
The reporting period begins from the bank’s communication about the unauthorised transaction, excluding the date on which the communication was received. Working days are calculated according to the customer’s home branch schedule.
The following table explains the applicable liability.
| Time Taken to Report | Customer Liability |
| Within 3 working days | Zero liability |
| Within 4–7 working days | Limited liability under RBI limits |
| Beyond 7 working days | According to the bank’s board-approved policy |
These reporting rules apply to qualifying third-party breaches. They do not automatically remove liability where the customer caused the loss through negligence.
Reporting the transaction immediately is therefore important for protecting the customer’s financial interests.
How Much Can a Bank Customer Lose Under RBI Rules?
Where a qualifying third-party breach is reported within four to seven working days, RBI rules prescribe maximum customer liability based on the account category.
| Type of Account | Maximum Liability |
| Basic Savings Bank Deposit account | ₹5,000 |
| Other savings bank accounts | ₹10,000 |
| Eligible MSME current, cash credit and overdraft accounts | ₹10,000 |
| Eligible individual current, cash credit and overdraft accounts with balances or limits up to ₹25 lakh | ₹10,000 |
| Credit cards with limits up to ₹5 lakh | ₹10,000 |
| Other current, cash credit and overdraft accounts | ₹25,000 |
| Credit cards with limits above ₹5 lakh | ₹25,000 |
These amounts represent maximum liability limits. If the unauthorised transaction amount is lower than the applicable limit, the customer cannot be charged more than the transaction amount.
Learn at your own pace with LawBhoomi's recorded law courses.
For instance, if ₹8,000 is fraudulently withdrawn from a regular savings account and the qualifying breach is reported on the fifth working day, the maximum customer liability is ₹8,000, not ₹10,000.
A bank may hold a customer responsible when an unauthorised transaction results from negligence, including sharing an OTP, PIN or banking password.
However, sharing an OTP does not automatically establish responsibility for every disputed transaction. The bank must examine the circumstances and determine whether the loss resulted from customer negligence.
The RBI also places the burden of proving customer liability on the bank.
If a bank rejects a complaint, the customer can seek clarification regarding the reasons for rejection and challenge the decision through the available grievance-redress mechanisms.
Under the RBI’s 2017 framework, banks must provide a shadow reversal of the disputed transaction amount within 10 working days of receiving the customer’s notification.
A shadow reversal is a provisional credit made while the complaint is being examined. It is not necessarily the final settlement of the dispute.
The bank must resolve the complaint and establish customer liability within the period specified in its board-approved policy, which cannot exceed 90 days.
If the bank cannot resolve the complaint or establish liability within 90 days, it must provide compensation according to the applicable liability provisions.
Banks must also ensure that customers do not lose applicable interest on debit accounts or suffer additional interest burdens on credit cards because of unauthorised transactions covered by these protections.
Immediate action can reduce financial losses and help establish when the fraud was reported.
Report the Transaction to the Bank
The unauthorised transaction should be reported through the bank’s official customer care number, mobile application, website or branch.
The bank should provide a complaint reference or acknowledgement that can be used to track the case.
Block the Affected Banking Facilities
The affected debit card, credit card, UPI facility or internet banking access should be blocked or secured immediately.
Passwords and PINs should also be changed where account compromise is suspected.
File a Cybercrime Complaint
Digital payment fraud can be reported through the National Cyber Crime Reporting Portal at cybercrime.gov.in or the national cybercrime helpline, 1930.
The complaint should include the transaction date, amount, reference number and relevant banking information.
Preserve Evidence of the Fraud
Transaction alerts, account statements, screenshots and complaint acknowledgements should be retained.
These documents can help establish the transaction details, reporting timeline and the customer’s attempts to resolve the dispute.
What If the Bank Refuses to Refund the Money?
If a bank rejects a legitimate claim or fails to provide satisfactory assistance, the customer may approach the RBI Ombudsman.
Under the Reserve Bank – Integrated Ombudsman Scheme, 2026, which came into force on 1 July 2026, eligible complaints concerning deficiencies in services provided by regulated entities can be examined without charging the complainant.
Generally, the complaint must first be raised with the concerned bank. If the bank does not respond within 30 days, rejects the complaint or provides an unsatisfactory response, the customer may approach the RBI Ombudsman, subject to the Scheme’s requirements.
Complaints can be submitted through the RBI’s Complaint Management System at cms.rbi.org.in.
The Ombudsman examines eligible complaints and may provide relief according to the applicable regulations.
Do the Same Rules Apply to UPI and Digital Wallet Fraud?
Unauthorised UPI transactions linked to bank accounts generally fall within the relevant RBI electronic banking customer-protection framework.
However, non-bank prepaid payment instruments, including certain digital wallets, are covered by specific RBI directions.
For qualifying third-party breaches involving non-bank prepaid payment instruments, the customer’s liability is zero when reported within three days. Reporting within four to seven days can attract a maximum liability of ₹10,000 per transaction or the transaction value, whichever is lower.
Beyond seven days, the issuer’s board-approved policy applies.
These distinctions are important because the applicable rules depend on the payment instrument, its issuer and the circumstances of the transaction.
What Are the New RBI Rules for Digital Fraud Compensation?
In June 2026, the RBI announced a revised framework to strengthen protection against fraudulent electronic banking transactions.
The framework introduces compensation for eligible small-value fraud losses, including certain situations that may not qualify for reimbursement under the earlier unauthorised transaction rules.
Under the new mechanism, an eligible victim suffering a gross loss of up to ₹50,000 may receive 85% of the net loss or ₹25,000, whichever is lower. The benefit is subject to specific conditions, including reporting requirements and a once-in-a-lifetime limit.
Importantly, these revised provisions are scheduled to apply from 1 January 2027. They do not replace the currently applicable customer-liability rules before that date.
Conclusion
The responsibility for losses from unauthorised digital transactions depends on the cause of the fraud and the reporting timeline. RBI rules provide zero liability in cases involving bank negligence and qualifying third-party breaches reported within three working days.
Customers may face limited or greater liability when reporting is delayed or negligence is established. Prompt reporting, proper documentation and timely complaints are essential for securing refunds and enforcing customer rights under Indian banking regulations.
Join LawBhoomi’s 100K+ Community
