Money Taken from Your Bank Account by Fraud in Hyderabad: RBI Rules on Refunds
This guide is for bank customers in Hyderabad and Telangana who lost money through an electronic transaction they did not authorise: a UPI, card or net banking debit after a SIM swap, a shared OTP, a remote-access app or a fake call. It explains what the Reserve Bank of India’s directions say about when a customer bears none, some or all of the loss, the reporting deadlines, the bank’s deadlines, the RBI Ombudsman and the consumer commission. The rules depend on the date of the transaction: one set applies up to 31 December 2026 and a revised set from 1 January 2027.
What to do first · Which rules apply · Up to 31 December 2026 · From 1 January 2027 · Co-operative banks and wallets · The Supreme Court · The RBI Ombudsman · Consumer commission · Checklist
What to do first
- Tell the bank at once: under RBI’s directions, banks must give customers 24×7 access through several channels to report unauthorised transactions, including a dedicated toll-free helpline, and a direct link on the bank’s website for reporting them. The 2017 text tells banks to advise customers that “the longer the time taken to notify the bank, the higher will be the risk of loss to the bank/ customer.”
- Keep the acknowledgement: the bank’s system must send an immediate acknowledgement with the registered complaint number. RBI says the recorded time and date of alerts and responses “shall be important in determining the extent of a customer’s liability.”
- Call 1930: the Indian Cybercrime Coordination Centre says financial cyber frauds can be reported by calling the National Helpline 1930, and that complainants then make a formal complaint on cybercrime.gov.in “within 24 hrs using the acknowledgement number received on SMS.” Complaints are handled by the State police selected in the complaint. See our guide on the first 48 hours after a cyber fraud.
- Ask the bank to block further debits: on receiving the report, banks “must take immediate steps to prevent further unauthorised transactions in the account.”
Which rules apply: the date of the transaction
- Up to 31 December 2026: RBI’s circular of 6 July 2017 on “Limiting Liability of Customers in Unauthorised Electronic Banking Transactions” was withdrawn as a circular on 28 November 2025, when RBI consolidated its instructions into Master Directions on an “as-is” basis. RBI states that these instructions “have been consolidated in the Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Directions, 2025”. The rules below are quoted from the 2017 text.
- From 1 January 2027: on 24 June 2026 RBI replaced those paragraphs with a new section on “Customer Protection in Fraudulent Electronic Banking Transactions”, which applies to “electronic banking transactions undertaken by customers of a bank on or after January 1, 2027”. Parallel directions of the same date cover small finance banks, payments banks, local area banks, regional rural banks and urban and rural co-operative banks.
Transactions up to 31 December 2026
For scheduled commercial banks, the 2017 text says:
- Zero liability where the bank is at fault: “Contributory fraud/ negligence/ deficiency on the part of the bank (irrespective of whether or not the transaction is reported by the customer).”
- Zero liability for a third-party breach reported within three working days: “Third party breach where the deficiency lies neither with the bank nor with the customer but lies elsewhere in the system, and the customer notifies the bank within three working days of receiving the communication from the bank regarding the unauthorised transaction.”
- Third-party breach reported in four to seven working days: the customer’s per transaction liability is limited to the transaction value or the amount in the table below, whichever is lower.
- Third-party breach reported after seven working days: “the customer liability shall be determined as per the bank’s Board approved policy.” Banks must give details of this policy at account opening and display it publicly, and on their website with the grievance and escalation procedure.
- Customer negligence: “In cases where the loss is due to negligence by a customer, such as where he has shared the payment credentials, the customer will bear the entire loss until he reports the unauthorised transaction to the bank. Any loss occurring after the reporting of the unauthorised transaction shall be borne by the bank.”
- Counting the days: working days are “counted as per the working schedule of the home branch of the customer excluding the date of receiving the communication.”
| Type of account | Maximum liability, third-party breach reported in 4 to 7 working days |
|---|---|
| BSBD accounts | Rs 5,000 |
| All other savings accounts; prepaid payment instruments and gift cards; current, cash credit and overdraft accounts of MSMEs; such accounts of individuals with annual average balance or limit up to Rs 25 lakh; credit cards with limit up to Rs 5 lakh | Rs 10,000 |
| All other current, cash credit and overdraft accounts; credit cards with limit above Rs 5 lakh | Rs 25,000 |
- Credit within 10 working days: under the heading on the reversal timeline for zero and limited liability, the 2017 text says: “On being notified by the customer, the bank shall credit (shadow reversal) the amount involved in the unauthorised electronic transaction to the customer’s account within 10 working days from the date of such notification by the customer (without waiting for settlement of insurance claim, if any).” The credit is value dated to the date of the unauthorised transaction.
- 90 days: the complaint is to be resolved and the customer’s liability, if any, established within the time in the bank’s policy, “but not exceeding 90 days from the date of receipt of the complaint”; where the bank cannot resolve it or determine liability within 90 days, “the compensation as prescribed in paragraphs 6 to 9 is paid to the customer”.
- Interest: for a debit card or bank account, “the customer does not suffer loss of interest”, and for a credit card, “the customer does not bear any additional burden of interest.”
- Burden of proof: “The burden of proving customer liability in case of unauthorised electronic banking transactions shall lie on the bank.”
- Waiver: banks “may also at their discretion decide to waive off any customer liability … even in cases of customer negligence.”
Transactions on or after 1 January 2027
The June 2026 directions for commercial banks change several points:
- Five calendar days: “A customer shall be entitled to zero liability and reversal of the transaction in cases of third-party breach where the customer reports the unauthorised fraudulent EBT to the bank within five calendar days from the date of its occurrence.” After five calendar days, liability is “as per the bank’s policy”. The day count now runs from the transaction, not from the bank’s alert, and the four-to-seven-day table is not carried over.
- Bank at fault: zero liability and reversal where the fraud “occurs due to negligence / deficiency on the part of the bank, irrespective of whether the transaction is reported by the customer or not.” Negligence by a bank includes not sending mandatory alerts, not providing 24×7 reporting channels, not acting diligently on a customer’s notification, and “system malfunctions / security breaches / internal frauds”.
- Negligence by a customer is defined: it includes “failing to exercise reasonable care in usage of credentials such as PIN, password, OTP or other details (e.g., providing credentials for carrying out transactions to another person, whether intentionally or otherwise …)”, not notifying the bank promptly, “not paying attention to specific, directed and clear warnings from the bank that a prospective transaction is likely a scam”, “downloading malicious apps”, and failing to update a changed mobile number or email.
- Third parties: a third-party breach now expressly “includes deficiency on the part of an intermediary such as a Third-Party Application Provider (TPAP), Payment Aggregator (PA), Payment Gateway (PG), Telecom Service Provider (TSP), etc.”
- Bank’s deadline: the bank decides within its policy period, which “shall not exceed 45 calendar days from the date of receipt of the complaint” for a domestic fraud and 60 calendar days for a cross-border fraud. For a credit card, the bank shall give a shadow reversal “within five calendar days from the date of receipt of notification from the customer.” If the bank rejects the complaint, it “shall disclose the reason for such rejection and with the supporting details, if any”.
- Burden of proof: “The burden of proving customer liability in complaints involving fraudulent EBTs shall lie on the bank.”
- Report to the police too: banks must advise customers to report to the bank “and also lodge a complaint through National Cyber Crime Reporting Portal or National Cyber Crime Helpline (1930) at the earliest.”
- Small-loss compensation: for a fraud caused by customer negligence, a bona fide victim who is an individual, including a sole proprietor, with a gross loss up to Rs 50,000, “shall be compensated 85 per cent of the net loss amount … or ₹25,000, whichever is less, once during her / his lifetime”, subject to the loss being established as bona fide under the bank’s policy and the victim having reported on the National Cyber Crime Reporting Portal or 1930 “and to the bank within five calendar days from its occurrence.” The directions say this compensation is payable for frauds “occurring up to one year from the effective date of these Directions.”
Co-operative banks and wallets
- Co-operative banks: RBI’s December 2017 circular for urban, state and district central co-operative banks followed the same scheme of three working days, four to seven working days, and the bank’s policy after seven, with a 10 working day credit and 90 days to resolve. Its table has no separate line for credit cards with a limit above Rs 5 lakh. It too was withdrawn as a circular on 28 November 2025, and the June 2026 directions for co-operative banks apply from 1 January 2027.
- Wallets issued by banks: RBI’s Master Directions on Prepaid Payment Instruments (updated 30 September 2026) say a bank issuer “shall continue to be guided by” the 2017 circulars.
- Wallets issued by non-banks: the same Master Directions set zero liability where the issuer is at fault, and for a third-party breach zero liability if reported “Within three days”, the lower of the transaction value or Rs 10,000 per transaction within four to seven days, and the issuer’s policy after that. These are days, not working days. The issuer must credit the amount within 10 days of notification, and if it cannot resolve the complaint within 90 days, the amount “shall be paid to the customer, irrespective of whether the negligence is on the part of customer or otherwise.”
The Supreme Court
In State Bank of India v Pallabh Bhowmick (SLP (C) No. 30677 of 2024, order dated 3 January 2025), the Supreme Court dismissed the bank’s special leave petition against a Gauhati High Court judgment. It agreed with the High Court that the transactions were “unauthorized and fraudulent”, that no negligence of the customer was established, and that clauses 8 and 9 of the 2017 circular applied. It said: “It is the responsibility of the bank so far as such unauthorized and fraudulent transactions are concerned. The Bank should remain vigilant.” It noted that the customer told the bank within 24 hours. It also said: “We expect the customers, i.e., the account holders also to remain extremely vigilant and see to it that the O.T.Ps. generated are not shared with any third party. In a given situation and in the facts and circumstances of some case, it is the customer also who could be held responsible for being negligent in some way or the other.”
The RBI Ombudsman
The Reserve Bank Integrated Ombudsman Scheme, 2026 came into force on 1 July 2026 and repealed the 2021 Scheme; complaints received before that date continue under the 2021 Scheme.
- Complain to the bank first: the complainant must first have complained to the bank, in writing or any mode “where proof of having made a complaint can be produced”.
- When you can go to the Ombudsman: if there is no reply within 30 days, or within any longer time specified by RBI, NPCI or card network guidelines, after the bank received the complaint, or if you are not satisfied with the bank’s reply.
- Time limit: the complaint must be made “within 90 days from the date on which the timeline specified in sub-clause (1)(f) expires or the date of the last communication from the concerned Regulated Entity, whichever is later”. The complaint to the bank must itself have been made within the Limitation Act period.
- How to file: online at cms.rbi.org.in, by email to crpc@rbi.org.in, or by post to the Centralized Receipt and Processing Centre, Reserve Bank of India, Central Vista, Sector 17, Chandigarh 160 017. RBI’s contact centre is 14448.
- Who can file: the customer personally, or an authorised representative, defined as “a person, other than an advocate”.
- Other cases: a complaint is not maintainable if the same grievance is pending before or decided by a court, tribunal, arbitrator or other forum, but this “does not include criminal proceedings pending or decided before a Court or Tribunal or any police investigation initiated in a criminal offence.”
- Amounts: “There is no limit on the amount in a dispute that can be brought before the RBI Ombudsman”. For consequential loss, the Ombudsman has “the power to provide a compensation up to ₹30 lakh”, and up to Rs 3 lakh for loss of time, expenses and harassment.
- Rejection and awards: the Ombudsman may reject a complaint if there is “no deficiency in service”, or if it “requires consideration of elaborate documentary and oral evidence”. An award lapses unless the complainant sends the bank a letter of acceptance within 30 days. A complainant aggrieved by an award may appeal to the Appellate Authority within 30 days.
Consumer commission
- Banking is a service: under the Consumer Protection Act, 2019, “service” includes “the provision of facilities in connection with banking”, and “deficiency” includes “any act of negligence or omission or commission by such person which causes loss or injury to the consumer” (section 2(11)).
- Where: a complaint may be filed in the District Commission where the opposite party “carries on business or has a branch office”, among other places (section 34(2)).
- Which commission: jurisdiction depends on “the value of the goods or services paid as consideration”; under the 2021 Jurisdiction Rules, the District Commission’s limit is Rs 50 lakh, the State Commission’s above Rs 50 lakh up to Rs 2 crore, and the National Commission’s above Rs 2 crore. How this applies to a fraud loss is a question to take advice on.
- Two years: a complaint must be filed “within two years from the date on which the cause of action has arisen”, with delay condonable for sufficient cause (section 69).
Because the Ombudsman cannot take up a grievance pending before another forum, and a consumer case on the same grievance is such a forum, choose the route with care. See also our guide on consumer complaints in Telangana.
Checklist
- The date and time of each debit, and of the bank’s SMS or email alert.
- The time you reported to the bank, and the complaint number in the acknowledgement.
- The 1930 acknowledgement number and the cybercrime.gov.in complaint.
- Your bank’s customer protection policy, from its website.
- Whether your bank is a commercial, small finance, payments, regional rural or co-operative bank, or a wallet issuer.
- Copies of all replies from the bank, and the date of the last one, for the Ombudsman’s 90 days.
- A note of anything the bank says you did, such as sharing an OTP or installing an app, and your account of what happened.
Related guides: cyber fraud: the first 48 hours, bank account frozen after a cyber complaint, digital arrest scams, investment and trading scams and consumer complaints.
Frequently asked questions
Money was debited from my account by fraud. Do I have to bear the loss?
For transactions up to 31 December 2026, RBI’s 2017 rules, which RBI consolidated into its Responsible Business Conduct Directions 2025 in November 2025, provide zero liability where the fraud is due to the bank’s fault, and for a third-party breach where the customer tells the bank within three working days of receiving the bank’s alert. For a third-party breach reported between four and seven working days, liability is capped at the transaction value or Rs 5,000, Rs 10,000 or Rs 25,000 depending on the account, whichever is lower, and beyond seven working days, the bank’s Board-approved policy applies. Where the customer was negligent, such as by sharing payment credentials, the customer bears the loss until reporting it. The burden of proving customer liability is on the bank.
What changes for bank frauds from 1 January 2027?
RBI’s June 2026 directions apply to transactions on or after 1 January 2027. Zero liability for a third-party breach then requires reporting to the bank within five calendar days of the transaction, the bank must decide within 45 calendar days (60 for cross-border frauds), customer negligence is defined to include sharing an OTP, downloading malicious apps and ignoring specific scam warnings from the bank, and individuals with a negligence-related loss up to Rs 50,000 may receive 85% of the net loss or Rs 25,000, whichever is less, once in a lifetime, if the bank finds the loss bona fide under its policy and they reported to 1930 or the cyber crime portal and to the bank within five calendar days. The directions limit this compensation to frauds occurring up to one year from their effective date.
How soon should the bank credit the money back?
For transactions up to 31 December 2026, the 2017 text, under its heading on reversal for zero and limited liability, says the bank shall credit the amount (shadow reversal) within 10 working days of the customer’s notification, and that a complaint not resolved within 90 days is to be compensated as the rules provide. For transactions from 1 January 2027, the new directions give the bank up to 45 calendar days to decide a domestic complaint, and require a shadow reversal within five calendar days for credit card frauds.
I shared an OTP with a fraudster. Will the bank refund me?
RBI’s 2017 rules say that where the loss is due to the customer’s negligence, such as sharing payment credentials, the customer bears the entire loss until reporting it to the bank, and the bank bears any loss after reporting. Banks may at their discretion waive customer liability even where the customer was negligent. For frauds from 1 January 2027, the new directions provide a one-time compensation for individuals with negligence-related losses up to Rs 50,000, subject to conditions, including that the bank finds the loss bona fide and the fraud was reported to 1930 or the cyber crime portal and to the bank within five calendar days. The directions limit this compensation to frauds occurring up to one year from their effective date. In State Bank of India v Pallabh Bhowmick (2025), the Supreme Court said customers should not share OTPs and that a customer could be held negligent in some cases.
What is the time limit to complain to the RBI Ombudsman?
Under the Reserve Bank Integrated Ombudsman Scheme 2026, in force from 1 July 2026, you must first complain to the bank. You can then go to the Ombudsman if the bank does not reply within 30 days (or a longer time set by RBI, NPCI or card network rules) or you are not satisfied with its reply, within 90 days from the expiry of that period or the bank’s last communication, whichever is later. Complaints can be filed at cms.rbi.org.in.
Can a lawyer file my RBI Ombudsman complaint?
The Integrated Ombudsman Scheme 2026 allows a complaint to be filed personally or through an authorised representative, which it defines as a person other than an advocate.
Can I go to the consumer commission against my bank for a fraudulent transaction?
The Consumer Protection Act 2019 includes banking within “service” and negligence causing loss within “deficiency”. A complaint must be filed within two years of the cause of action, and can be filed where the bank has a branch office. The RBI Ombudsman cannot take up a grievance that is pending before or decided by another forum such as a consumer commission, so choose the route with care.
Does a police or 1930 complaint stop me from going to the RBI Ombudsman?
Not by itself. The Integrated Ombudsman Scheme 2026 bars complaints on a grievance pending before a court, tribunal or other forum, but says this does not include criminal proceedings or any police investigation of a criminal offence.
For a discussion about an unauthorised bank transaction, a bank’s refusal or a consumer complaint with Musab Hashmi & Associates, call +91 89771 24916 or send an enquiry. Do not include card numbers, OTPs, passwords or identity numbers in any message.
General legal information, not legal advice. Checked on 28 October 2026 against RBI’s circular of 6 July 2017 on limiting liability of customers in unauthorised electronic banking transactions and its December 2017 circular for co-operative banks (both withdrawn as circulars on 28 November 2025 and consolidated into the Responsible Business Conduct Directions, 2025), RBI’s Responsible Business Conduct amendment directions of 24 June 2026 for commercial banks and other bank types, the Master Directions on Prepaid Payment Instruments (updated 30 September 2026), the Reserve Bank Integrated Ombudsman Scheme, 2026, the Indian Cybercrime Coordination Centre’s FAQ, the Consumer Protection Act, 2019 and the Consumer Protection (Jurisdiction) Rules, 2021, and the Supreme Court’s order in State Bank of India v Pallabh Bhowmick (3 January 2025).