By S&S Co. Advocates & Solicitors · Published 22 January 2026 · Informational content, not legal advice
About this article: A general explainer prepared by S&S Co. Advocates & Solicitors on a recurring type of dispute. It does not report a specific judgment or order, names no parties and gives no case citation, so it should not be cited as authority. Law and practice change; please verify against the current statute and primary sources before relying on it.
The Reserve Bank of India's circular of July 2017 on limiting the liability of customers in unauthorised electronic banking transactions sets out how loss is shared. In summary, a customer has zero liability where the fraud arises from a contributory fraud, negligence or deficiency on the bank's side regardless of when it is reported, or from a third-party breach where the customer reports within three working days. Liability is limited for reports made in four to seven working days, and after that the bank's board-approved policy applies. A customer who is careless, for example by sharing credentials or an OTP, bears the loss until the fraud is reported. The current directions and the bank's policy should be checked.
A complaint to a consumer commission can rest on two separate footings. One is the customer's limited or nil liability under the framework. The other is a bank's own deficiency in service, such as an unexplained gap between a prompt report and the time at which the bank actually acts to freeze the beneficiary account, during which the funds are withdrawn.
Banks' records of the time of the report and of the freeze request are often important evidence. Relief can include re-credit of the disputed amount and compensation. Complaints can also be made to the bank's grievance officer and to the RBI Ombudsman under the Integrated Ombudsman Scheme, and the national cyber crime helpline and portal are available for reporting.