Money Gone From Your Account? Report It Within Three Days and Your Liability Is Zero

The single most valuable thing to know about a fraudulent debit from your account is that the clock matters more than the amount. Report it fast enough and, under the Reserve Bank’s customer-protection framework, you owe nothing at all.

The rule

RBI’s circular of 6 July 2017 on limiting customer liability in unauthorised electronic banking transactions sets out a sliding scale that turns almost entirely on two things: whose fault it was, and how quickly you told the bank.

• Zero liability where the loss arises from the bank’s own negligence or a deficiency on its side — regardless of whether you reported it quickly.
• Zero liability where the fault lies with neither you nor the bank (a third-party breach), provided you notify the bank within three working days of receiving its communication about the transaction.
• Limited liability where you delay beyond that window, with the amount depending on the account type and how long the delay ran.
• Your loss where the transaction happened because you shared your credentials — your PIN, your OTP, your password — up to the point you report it. After you report it, the bank carries the loss.

The three-day clock starts when the bank tells you

This is the detail people get wrong. The window runs from the date you receive the bank’s communication about the transaction — the SMS or email alert — not from the date you happened to open your banking app and notice.

Two practical consequences follow. First, the alert channel has to work: an outdated mobile number registered with the bank is the most common way a customer loses the protection, because the clock starts running on a message that never arrived. Second, working days excludes the bank’s holidays, so a Friday-night fraud does not consume your window over the weekend.

What the bank must do, and when

On being notified, the bank is required to credit the disputed amount to your account within ten working days of your notification. Crucially, that credit is value-dated to the date of the unauthorised transaction — so you do not lose the interest, and any consequential charge that the missing balance triggered should not stand against you.

The ten-day credit is not the end of the bank’s enquiry. It is a shifting of the burden: your money comes back while the investigation continues, rather than after it.

What to do, in order

1. Notify the bank immediately, through a channel that produces a record — the app’s dispute flow, the registered-email route, or the phone line with the reference number written down. A verbal report you cannot evidence is the weakest position to argue from.
2. Get the complaint reference number. Every later step depends on it.
3. Block the instrument — card, UPI handle, net banking — so the same channel cannot be used again.
4. If it was an online fraud, also report at cybercrime.gov.in or call 1930. The banking dispute and the criminal complaint are separate processes and you should run both.
5. If the bank does not credit you within ten working days, escalate free of charge to the RBI Ombudsman at cms.rbi.org.in.

The thing worth internalising now, not later

Check that the mobile number and email registered with every bank you hold an account with are current, and that transaction alerts are switched on for all of them. The protection above is built entirely on the assumption that the bank can reach you and that you can act within three working days. A dormant account with a five-year-old phone number attached to it is the one that will cost you.

How to use this page

This page describes rules published by the Reserve Bank of India, IRDAI or NPCI, identified by instrument and date so you can verify them yourself. It is general information about those rules, not advice on your particular dispute, and your bank’s or insurer’s own policy document governs the specifics of your account or policy.

Nobody should charge you to claim what is yours

Every process described here is free and can be started by you directly. No agent, consultant or “recovery service” can obtain an outcome you cannot obtain yourself, and none is required at any stage. Oquilia takes no fee from readers, offers no recovery service, and refers no one to any legal practice or intermediary.

If the rule was not followed

Escalate in order: the entity’s own grievance channel first, then the RBI Ombudsman via cms.rbi.org.in for banks, NBFCs and payment systems, or the Insurance Ombudsman for insurers. Complaints to the ombudsman are free, and you do not need a lawyer to file one.