Many people who lose money through unauthorised online transactions assume it is gone for good. In fact, the Reserve Bank of India has framed rules on customer liability, and courts have enforced them against banks.
The RBI framework
The RBI’s circular dated 6 July 2017 on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions sets out the general position:
- Zero liability where the fraud arises from a deficiency or negligence on the bank’s part, or from a third-party breach (where the fault lies neither with the bank nor the customer) and the customer reports it within three working days of receiving the bank’s communication.
- Limited liability where a third-party breach is reported within four to seven working days, subject to caps that depend on the type of account.
- Where the loss is caused by the customer’s own negligence, such as sharing a PIN or OTP, the customer bears the loss until it is reported to the bank.
- The bank must credit (shadow reverse) the amount within ten working days of notification and resolve the complaint within the prescribed period.
What the Supreme Court said
In State Bank of India v. Pallabh Bhowmick, 2025 LiveLaw (SC) 22 (order dated 3 January 2025), the Supreme Court declined to interfere with a Gauhati High Court order directing SBI to refund a customer who had been defrauded and had reported the transaction within 24 hours. The Court observed that it is the bank’s responsibility to deal with unauthorised and fraudulent transactions, while also cautioning customers not to share OTPs with third parties.
Practical steps
- Report the transaction to your bank immediately, in writing, and keep the acknowledgement.
- Also report it on 1930 or cybercrime.gov.in.
- If the bank does not respond within 30 days or rejects the claim, a complaint can be filed under the RBI Integrated Ombudsman Scheme, and consumer or civil remedies may also be available.
Key authority
- State Bank of India v. Pallabh Bhowmick, 2025 LiveLaw (SC) 22.
- RBI Circular on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 6 July 2017.
This article is published for general information only. It does not constitute legal advice or solicitation, and no lawyer–client relationship is created by reading it.