# Unauthorized or Fraudulent Transactions (India: RBI Zero-Liability Framework)

This is the crown jewel of Indian banking consumer protection and the mechanism most people have never heard of. RBI's circular "Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions" (RBI/2017-18/15, dated 6 July 2017, extended later to co-operative banks) creates hard liability tiers and hard clocks for banks. It covers cards, net banking, mobile banking, UPI, prepaid wallets, and card-not-present transactions.

## The liability tiers: timing is everything

**Zero liability** (the bank must reverse the full amount) when:
- The fraud is due to the **bank's own negligence or deficiency**, regardless of whether the customer reports it, or
- It's a **third-party breach** (fault lies neither with the bank nor the customer, e.g. a system compromise, skimming, phishing infrastructure) and the customer **reports within 3 working days** of receiving the bank's communication (SMS/email alert) about the transaction.

**Limited liability**, report on **days 4–7**: the customer's exposure is capped at **₹5,000** (basic savings/BSBD accounts), **₹10,000** (other savings accounts and prepaid instruments/wallets), or **₹25,000** (credit cards with limits above ₹5 lakh; other higher-tier accounts).

**Beyond 7 working days**: liability is per the **bank's board-approved policy**, weaker ground, but not automatically hopeless; banks can and do waive liability, so the complaint should still go in.

Two critical details:
- **The clock runs from the bank's communication** (the SMS alert), not from when the person discovered the fraud. This is why registered mobile alerts matter and why acting the same day is the advice.
- **Reporting cuts off further exposure.** Even where the customer's own negligence contributed (e.g. they were socially engineered), any loss occurring **after** they report is the bank's, not theirs. Report immediately even if the person feels they were at fault.

## What the bank is obligated to do

- **Provisionally credit the disputed amount within 10 working days** of notification, without waiting for any insurance claim or investigation to conclude.
- **Resolve the complaint within 90 days.** If it can't, the customer is to be compensated per the framework.
- Provide 24x7 reporting channels and issue a complaint reference, the person should demand and record it.

## The "you shared your OTP / it was OTP-verified" pushback

Banks' most common refusal is "the transaction was authenticated, so you authorized it." This argument has been **rejected by Indian consumer commissions and courts** in social-engineering cases, authentication having technically occurred does not by itself make a fraudulent transaction "authorized" where the customer was deceived. The letter should not concede this point: state plainly that the transaction was unauthorized, that the person did not knowingly authorize any payment, and that they reported within the timeline.

## The action sequence (give this to the person in order)

1. **Call the bank's helpline immediately**, block the card/UPI/channel. Note the time and the complaint reference number.
2. **Same day, send a written complaint** to the bank's official grievance email quoting the transactions (date, time, amount, ID), stating they are unauthorized, and citing the RBI circular. Email creates the undeniable timestamp that proves the 3-day reporting.
3. **File a cybercrime report**, the national cybercrime portal (cybercrime.gov.in) or helpline **1930** (for financial cyber fraud; fast reporting to 1930 can get payment channels frozen while money is still in transit). This is separate from the bank claim but strengthens it and is the right step for a crime.
4. Track the **10-working-day provisional credit** and the **90-day resolution**, if the bank misses either, that failure goes into the escalation.

## Language to include

- "I am reporting **unauthorized electronic transactions** on my [account/card]. I did not make or authorize these transactions."
- Transaction specifics: date, time, amount, transaction ID/UTR, merchant/description as shown.
- "I am reporting within 3 working days of your alert dated [date]. Under RBI's circular on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, my liability is **zero**."
- "As required, please **provisionally credit ₹[amount] within 10 working days** and resolve this complaint within 90 days. Please provide the complaint reference number in writing."
- If pushed back on OTP: "Authentication having occurred does not make a fraudulent transaction authorized; I did not knowingly authorize any payment."

## Escalation

- If the bank refuses, stalls past its clocks, or closes the complaint unsatisfactorily: escalate to the **RBI Ombudsman** (read `banking-ombudsman.md`), free, and banks take it seriously.
- The **consumer commission** route (read `consumer-commissions.md`) is available in parallel for deficiency of service, and commissions have ordered refunds plus compensation and even credit-record corrections in zero-liability cases.
- Keep the cybercrime complaint (1930 / cybercrime.gov.in) active, its findings support the civil claim.