Yes, ATM fraud can be legally actionable against a bank in India, but whether the bank is financially responsible depends on how the fraud occurred and whether the customer contributed to the loss. RBI’s customer-protection framework provides specific rules for unauthorized electronic banking transactions, including ATM and debit-card transactions. Where the bank is negligent or deficient, the customer’s liability can be zero. In other situations, responsibility may depend on customer negligence, third-party breaches and how quickly the transaction was reported.
Therefore, an ATM fraud complaint should be treated differently from an ordinary dispute over a cash withdrawal.
What Is ATM Fraud?
ATM fraud occurs when money is withdrawn or a transaction is carried out without the account holder’s authorization.
Examples can include:
- Unauthorized cash withdrawals using a stolen debit card
- ATM transactions involving compromised card credentials
- Card cloning or skimming
- Unauthorized withdrawals after theft of banking information
- Fraudulent transactions resulting from compromised authentication details
- Other electronic transactions that the customer did not authorize
A customer who notices an unfamiliar ATM withdrawal should immediately verify the transaction and contact the bank rather than waiting for the monthly statement.
When Is the Bank Responsible for ATM Fraud?
A bank can be responsible where an unauthorized transaction results from negligence, deficiency or fraud on the part of the bank.
Under RBI’s framework, where the unauthorized transaction is attributable to the bank’s negligence or deficiency, the customer’s liability is zero, irrespective of whether the customer reported the transaction.
This protection is important because customers are not expected to bear losses caused by a bank’s own failure to provide appropriate security or banking services.
However, establishing bank negligence depends on the facts of the particular case. The mere fact that an unauthorized withdrawal occurred does not automatically prove that the bank was negligent.
What If a Third Party Commits the ATM Fraud?
RBI also provides protection for situations involving a third-party breach, where neither the bank nor the customer is responsible for the deficiency.
If the customer reports the unauthorized transaction to the bank within three working days of receiving the bank’s communication about the transaction, the customer can have zero liability under the applicable framework.
If the customer reports the transaction later, the applicable limited-liability provisions may change depending on the delay.
This makes immediate reporting one of the most important steps after discovering ATM fraud.
What If the Customer Was Negligent?
The customer’s own conduct can affect liability.
RBI’s framework gives sharing payment credentials as an example of customer negligence. Where the loss results from customer negligence, the customer generally bears the loss until the unauthorized transaction is reported to the bank. Loss occurring after notification is borne by the bank under the framework.
For example, if a customer voluntarily shares confidential card or authentication information and an unauthorized withdrawal subsequently occurs, the bank may assess the incident differently from a case involving a security failure for which the customer was not responsible.
How Quickly Should an ATM Fraud Be Reported?
Immediately.
The customer should contact the bank through its official customer-service channel as soon as an unauthorized withdrawal is discovered.
RBI specifically advises customers to notify their bank immediately after encountering a fraudulent or unauthorized electronic banking transaction. The bank must provide an acknowledgement of the complaint.
The customer should also request that the debit card be blocked or temporarily disabled to prevent further unauthorized withdrawals.
How Does the Bank Handle the Disputed Amount?
For cases covered by the zero- or limited-liability framework, RBI requires the bank to provide a shadow reversal of the amount involved within 10 working days from notification by the customer, without waiting for the outcome of an insurance claim.
The bank must also resolve the complaint and determine customer liability within the period prescribed under its board-approved policy, which cannot exceed 90 days from receipt of the complaint. If the bank cannot determine liability within that period, the RBI framework provides protections for the customer.
What If the ATM Debits the Account but Does Not Dispense Cash?
This is different from an unauthorized ATM withdrawal.
Suppose a customer uses an ATM legitimately, the account is debited, but no cash is dispensed or the ATM dispenses less cash than the amount debited. RBI has separate rules for failed ATM transactions.
Under RBI’s failed-transaction framework, where a customer’s account is debited but cash is not dispensed, the transaction should be reversed within a maximum of T+5 days. If the reversal is delayed beyond that period, compensation of ₹100 per day of delay is payable to the account holder.
Therefore, customers should distinguish between fraud and a technical ATM transaction failure.
What Evidence Should You Preserve?
A customer disputing an ATM withdrawal should preserve:
- Date and time of the withdrawal
- Amount withdrawn
- ATM location
- SMS or email transaction alert
- Bank statement
- Debit-card details
- Complaint or reference number
- CCTV-related information, where available
- Details of when the bank was informed
- Any other communications with the bank
The customer should avoid deleting transaction alerts or other relevant records.
Can the Bank Reject an ATM Fraud Complaint?
A bank may investigate the circumstances and determine whether the customer is liable under the applicable RBI framework.
If the bank concludes that the customer was responsible or negligent, the customer can request the basis for that conclusion and provide supporting evidence.
If the complaint is not satisfactorily resolved, the customer should use the bank’s grievance-redressal mechanism and may subsequently approach the applicable RBI complaint-redressal system, subject to its eligibility requirements.
Where the ATM fraud involves theft, card cloning, identity theft or other suspected criminal conduct, the customer can also report the incident to the appropriate law-enforcement or cybercrime authorities.
What Should You Do Immediately After ATM Fraud?
The safest approach is to act quickly:
- Contact the bank immediately.
- Block the affected debit card.
- Report every unauthorized transaction.
- Obtain a written complaint/reference number.
- Check the account for additional suspicious withdrawals.
- Preserve transaction alerts and statements.
- Report suspected criminal activity to the appropriate authorities.
- Follow up with the bank in writing.
Prompt reporting can directly affect the customer’s liability under RBI rules.
Conclusion
ATM fraud can be legally actionable against banks in India, but bank liability depends on the circumstances of the unauthorized transaction. Where the fraud results from bank negligence or deficiency, RBI’s framework provides zero customer liability. Certain third-party breaches can also result in zero liability when promptly reported, while customer negligence can affect the customer’s responsibility for the loss.
Customers should therefore report unauthorized ATM withdrawals immediately, block the affected card, preserve evidence and obtain a complaint reference from the bank.
It is also important to distinguish ATM fraud from a failed ATM transaction. If the account is debited but cash is not dispensed, RBI’s separate failed-transaction rules provide for reversal within the prescribed period and compensation for specified delays.
Ultimately, the customer’s liability depends on the facts, the source of the fraud, any negligence involved and how quickly the transaction was reported.
