{"id":683,"date":"2026-06-27T14:22:54","date_gmt":"2026-06-27T08:52:54","guid":{"rendered":"https:\/\/advmriduljindal.com\/blog\/?p=683"},"modified":"2026-06-27T18:05:04","modified_gmt":"2026-06-27T12:35:04","slug":"zero-liability-unauthorized-card-transaction-rbi","status":"publish","type":"post","link":"https:\/\/advmriduljindal.com\/blog\/zero-liability-unauthorized-card-transaction-rbi\/","title":{"rendered":"Card Fraud, Zero Liability and the 3-Day Window: What Every Indian Bank Customer Must Know"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n \t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Your phone buzzes. A transaction alert: \u20b915,000 debited. You didn\u2019t make it. You call the bank. After twenty minutes on hold, an executive says: \u201cThe transaction was OTP-verified there is nothing we can do. Please file a police complaint.\u201d<\/p>

This happens to thousands of Indians every day. Most accept it. They should not.<\/p>

Indian law anchored in a binding Reserve Bank of India circular and reinforced by consumer courts, High Courts, and the Supreme Court gives every bank customer a specific and enforceable protection: zero liability for unauthorised card and banking transactions, if you act within three working days. Most people have never heard of it.<\/p>

The RBI Circular That Changed Everything<\/strong><\/h3>

The Reserve Bank of India issued a comprehensive and binding circular on 6 July 2017 (No. RBI\/2017-18\/15 DBR.No.Leg.BC.78\/09.07.005\/2017-18) titled \u201cCustomer Protection Limiting Liability of Customers in Unauthorised Electronic Banking Transactions.\u201d This applies to every scheduled commercial bank, small finance bank, payment bank, and prepaid payment instrument issuer in India.<\/p>

The circular establishes three tiers of customer liability:<\/p>

Zero Liability <\/strong>applies when: (a) the fraud is due to the bank\u2019s own negligence or a third-party breach and the customer had no role in it; or (b) the customer reports the unauthorised transaction within 3 working days<\/strong> of receiving the bank\u2019s communication about the transaction.<\/p>

Limited Liability <\/strong>applies when the customer reports within 4\u20137 working days. The cap on what you must bear: \u20b95,000 for basic savings accounts; \u20b910,000 for other savings accounts and prepaid instruments; \u20b925,000 for credit cards with limits above \u20b95 lakh.<\/p>

Full Liability <\/strong>(customer bears the loss) applies only where: (a) the loss results entirely from the customer\u2019s own negligence voluntarily sharing credentials without any manipulation; and (b) the customer fails to report beyond 7 working days.<\/p>

The critical number: <\/strong>3 working days from the date you receive the bank\u2019s communication not from the date you discover the fraud yourself. If the bank sent you an SMS alert, that is the clock starting.<\/p>

Once you report, the RBI circular requires banks to provisionally credit the disputed amount to your account within 10 working days and complete the investigation within 90 days.<\/p>

\u201cBut I Shared the OTP\u201d What Courts Say<\/strong><\/h3>

The most common reason banks refuse refunds is: \u201cThe transaction was OTP-verified, so you authorised it.\u201d This argument has been specifically rejected by Indian courts.<\/p>

The Delhi High Court, in Hare Ram Singh v. Reserve Bank of India & Ors.<\/em><\/strong> [W.P.(C) 13497\/2022], held that when fraud involves complex social engineering phishing calls, vishing, or technical manipulation banks cannot rely on OTP generation alone as a complete defence. The burden of proving the customer\u2019s negligence lies on the bank, not on you.<\/p>

The Supreme Court in\u00a0State Bank of India v. Pallabh Bhowmick & Ors.\u00a0<\/b><\/em>SLP (C) No. 30677 of 2024, order dated 03.01.2025 <\/span>went further, holding that banks must use the best available technology to detect and prevent unauthorised transactions. A bank\u2019s obligation does not end with issuing an OTP.<\/span><\/p>

There is a further protection most people miss: even if your own negligence contributed to the fraud before reporting, once you report the transaction, your liability for all losses occurring after that point is zero. Reporting cuts off your exposure immediately.<\/p>

In Roopam Kumar v. SBI Cards & Payment Services Pvt. Ltd.<\/em><\/strong> [District Consumer Disputes Redressal Commission, Chandigarh, 6 February 2026], the Commission directed the bank to refund the disputed amount, remove the complainant from CIBIL records, and pay compensation squarely applying the zero liability principle.<\/p>

Step-by-Step: What to Do Immediately<\/strong><\/h3>

Acting quickly and in sequence is what determines whether you recover your money.<\/p>

  1. Call your bank immediately.<\/strong> Block the card. Note the complaint reference number, date, and time.<\/li>
  2. Send a written complaint within 3 working days.<\/strong> An email to the bank\u2019s official registered ID creates an undeniable timestamp. Cite: \u201cI am claiming zero liability under RBI Circular No. RBI\/2017-18\/15 DBR.No.Leg.BC.78\/09.07.005\/2017-18 dated 6 July 2017.\u201d<\/li>
  3. Preserve all evidence.<\/strong> Screenshots of the transaction alert, your complaint reference number, all email exchanges, and any fraudulent call or SMS received.<\/li>
  4. Follow up in writing.<\/strong> The bank must provisionally credit the amount within 10 working days. If they do not, their silence itself is a deficiency in service.<\/li>
  5. Escalate if the bank refuses.<\/strong><\/li><\/ol>
    • RBI Banking Ombudsman: File at cms.rbi.org.in under the Integrated Ombudsman Scheme, 2021. Free, fast, and carries regulatory authority.<\/li>
    • District Consumer Commission \/ NCDRC: Under the Consumer Protection Act, 2019 claim the refund, compensation, and litigation costs.<\/li>
    • National Cyber Crime Portal: Report at cybercrime.gov.in, especially if the fraud involved impersonation, phishing, or vishing.<\/li>
    • \u00a0<\/li><\/ul>

      Can the Bank Report You to CIBIL?<\/strong><\/h3>

      If you are disputing a fraudulent transaction and have not paid the disputed amount, the bank is not permitted to report you as a defaulter to credit bureaus for that amount during the pendency of the dispute. Courts have consistently directed banks to remove complainants from CIBIL defaulter lists in proven fraud cases. Make this a specific, written demand in your complaint from Day 1.<\/p>

      Conclusion<\/strong><\/h3>

      The 3-day window under the RBI circular is not a favour it is a legally binding obligation enforceable against every scheduled bank in India. Do not accept a bank\u2019s first refusal. Send a written complaint, cite the RBI circular by number and date, and escalate methodically. The legal tools are in place. The question is only whether you know how to use them.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\n<\/div>\n

      \n \t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\n