Banks and Fraud Liability: RBI Circulars Explained

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law

When money leaves a customer's account without authorisation, the first question is usually wrongly framed. It is not simply whether the bank is liable or the customer is liable; the Reserve Bank of India's directions on limiting customer liability in unauthorised electronic banking transactions set out tiers, and where the loss falls depends on the cause of the loss and on how quickly the customer reported it. A customer whose loss was caused by a bank-side failure and who reported promptly stands in a different position from one whose own credentials were shared.

Those directions sit alongside the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023 and the Consumer Protection Act, 2019, and they interact with the RBI's Integrated Ombudsman Scheme. This guide sets out the tiers, the timelines a bank must meet, what a bank owes its customer, and the complaint ladder that runs from the branch to the Ombudsman to a court.

How RBI decides who bears the loss

The RBI's framework for unauthorised electronic transactions classifies liability by cause, and its logic is straightforward: a customer is not made to pay for a failure that was not the customer's fault. Where the loss arises from a bank-side deficiency, or from a third-party breach where neither the bank nor the customer was negligent, the customer's liability is zero. Where the loss arises from the customer's own negligence, the customer bears a limited liability, subject to the customer having reported the transaction without delay.

The important word in the framework is negligence, and it cuts both ways. A customer who never enabled transaction alerts, who shared an OTP, or who left a card detail in a saved payment page has made the bank's argument easier. A bank that failed to detect a clearly fraudulent transaction pattern, or that allowed a withdrawal before completing verification, has made the customer's argument easier.

The timelines a bank must meet

Timelines are where most disputes are actually won or lost, and they are not discretionary. The RBI framework requires a customer to report an unauthorised transaction promptly so that liability can be fixed on the correct side, and it requires the bank to respond to the complaint in a defined window. The commonly cited structure is that reporting within three working days from the date of the unauthorised transaction supports zero liability where the customer was not negligent, while reporting within four to seven working days leads to a limited liability determined under the bank's policy.

The bank's own obligations are equally concrete. Under the RBI framework the bank is expected to credit the disputed amount provisionally within ten working days of the complaint, and to inform the customer of the credit. A bank that sits on a complaint past these windows cannot later rely on the customer's delay to reduce its own responsibility. These numbers come from the RBI directions, and a customer who can show the date of the complaint and the date of the credit is arguing about fact rather than opinion.

What a bank owes its customer

Three duties are worth stating plainly. The first is a duty of security over the electronic channels it operates, and section 43A of the IT Act gives it statutory shape: a body corporate that is negligent in maintaining reasonable security practices and procedures and thereby causes wrongful loss is liable to compensate. A bank is a body corporate for this purpose, and its security posture is a question of fact, not a matter of assurance.

The second is a duty of candour. A bank that decides a fraud was the customer's fault should be able to say, in writing and with reference to records, how it reached that conclusion. A bare assertion of customer negligence, without the transaction logs and the alert records, is not an answer.

The third is a duty to act on a report. Within the framework, the bank must acknowledge the complaint, assign a reference and progress it. Where the loss involves an offence, the bank must also cooperate with the police and the cybercrime portal rather than treat the matter as closed by its own internal finding.

When the bank points to customer negligence

This is the most contested question in electronic-banking disputes, and it is worth knowing what a bank will look for. It will examine whether transaction alerts were enabled and received, whether the customer kept credentials confidential, whether the customer responded to the alert, and whether the account had been handed to a third party in any way. It will also examine its own records: whether the transaction was inconsistent with the account's usual pattern, and whether any step was skipped.

A customer facing this argument should gather the same material from the other side: the alert history on the registered mobile number and email, the bank's dispute references, and the timeline of the report. Where the bank's own logs show an alert that was never sent, the negligence argument weakens considerably.

Where the IT Act and the BNS enter

On the criminal side, the person who took the money can be charged with cheating under section 318 of the Bharatiya Nyaya Sanhita, 2023, and, where a forged instrument is used, with forgery under section 336 or forgery of a valuable security under section 338. Where an account or credential was obtained, sections 66C and 66D of the IT Act on identity theft and impersonation are usually in play. A bank employee who misappropriates money or data entrusted in the course of employment can face criminal breach of trust under section 316 of the BNS 2023.

The complaint that sets this in motion is registered under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, and where the police decline to register it, the complainant can apply to the Magistrate under section 175(3) of the BNSS for a direction to investigate. Banking records held elsewhere can be reached through the BNSS provisions on production of documents and electronic records.

The complaint ladder

1. Report to the bank at once, in writing, on the channel the RBI framework recognises, and keep the reference number.
2. Dial 1930 and file on cybercrime.gov.in so that the transaction can be flagged and, where possible, the funds traced.
3. If the bank refuses to treat the loss as unauthorised, escalate in writing to its nodal officer and grievance redressal authority.
4. If the bank's answer is unsatisfactory or not given within the prescribed window, approach the RBI Ombudsman under the Integrated Ombudsman Scheme, 2021, which provides a single window for complaints against regulated entities.
5. Where compensation is the aim and the Ombudsman route does not resolve it, pursue a civil claim, including one under the Consumer Protection Act, 2019 where the facts amount to a deficiency in service.
6. Where an offence is involved, pursue the criminal complaint in parallel with the civil and ombudsman routes.

The Integrated Ombudsman Scheme is the practical centre of the ladder because it is free and it covers banks and other regulated entities through one process. It does not, however, replace the criminal case against the offender, and it does not by itself decide a claim for damages beyond the specific dispute placed before it.

Business accounts and the corporate customer

A company that loses money from its current account faces the same RBI framework, but the practical argument is different. A business is expected to run controls of its own: dual authorisation for payments, restricted access to net-banking credentials, and a periodic reconciliation. Where a company ignored its own controls, the bank's case on negligence becomes easier, and where the bank allowed a transfer that departed from the mandate the company had registered, the company's case becomes easier.

Companies should also look inward. Most large-value electronic frauds begin with a compromised email account or a payment redirected by a person inside the business. In that situation the company's remedy is partly against its own employee, under section 316 of the BNS 2023 for criminal breach of trust, and partly contractual, and the banking complaint is usually the smallest part of the loss.

The role of the cybercrime portal and 1930

Reporting through the national cybercrime portal and dialling 1930 is not a substitute for the complaint to the bank, but it does something the bank cannot. It alerts the system while the money is still moving, which is the only realistic chance of stopping funds before they are withdrawn through a chain of accounts. The earlier the report, the greater the chance that a transaction can be frozen in the first hop, which is why the advice to dial 1930 before finishing the argument with the bank is not an exaggeration.

What decides the outcome

In a dispute between a customer and a bank over an electronic fraud, three things decide the result. The cause of the loss, because the framework allocates liability by cause. The speed and form of the customer's report, because delay is read against the customer. And the quality of the records on both sides, because a bank that cannot produce its alerts and its transaction logs is arguing from memory, while a customer who kept the dispute reference and the bank's written replies is arguing from documents.

There is a fourth factor that is often decisive: whether the transaction pattern was anomalous and the bank failed to act on it. Fraud detection is part of the security the framework expects, and a bank that let an unusual transfer through without the verification it applies in similar cases has a harder case to make.

What not to do

• Do not delay the report to the bank while you try to sort out the facts; the window matters.
• Do not communicate only by phone; use the written channel and keep the reference.
• Do not accept a verbal finding of customer negligence without a written reason.
• Do not let the criminal complaint and the banking complaint be the only steps; use the Ombudsman route as well.
• Do not assume recovery is impossible because the funds left the account quickly.
• Do not treat the bank's internal finding as the end of the matter.

When to involve a lawyer

Advice is worth taking when the bank has denied a claim in writing, when the amount is significant enough to justify the effort, or when the loss involves an insider at the institution. A cyber crime lawyer in Kolkata can run the Ombudsman complaint, the criminal complaint and the civil claim as a single strategy rather than three disconnected steps, and can press for the records on which the bank's decision was actually based. The firm's cyber crime practice in Kolkata handles both the banking dispute and the offence against the person who took the money.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Property Fraud Online: Duties of Real Estate Agents
• E-Commerce Sellers: Fraud, Duties and Legal Remedies
• Patient Data Breach: Legal Duties of Hospitals in India
• Data Breach Duties for CA Firms in India: What to Do
• Cyber Security Legal Checklist for Startups in India
• Cyber Crime Compliance for Companies in India: Legal Duties

Cyber crime lawyer in your city · Bank account freeze help · Contact