Yes, an unauthorized bank account withdrawal can be legally actionable in India. When money is withdrawn from a bank account without the account holder’s authorization, the incident may involve banking liability, consumer remedies, and, depending on the circumstances, criminal offences such as cheating, dishonest misappropriation, or offences involving stolen property. For unauthorized electronic transactions, the Reserve Bank of India (RBI) also provides a framework dealing with customer liability and bank responsibilities.
The appropriate action depends on how the withdrawal occurred, who made it, whether the customer authorized or contributed to the transaction, and how quickly the incident was reported.
What Is an Unauthorized Bank Withdrawal?
An unauthorized withdrawal occurs when money is taken from a bank account without the account holder’s permission or lawful authority.
Examples can include:
- An unauthorized ATM withdrawal
- Money transferred through internet or mobile banking without permission
- Unauthorized UPI transactions
- Fraudulent debit-card transactions
- Withdrawal using a forged cheque
- Unauthorized use of banking credentials
- A person accessing another individual’s account without authority
The legal treatment can differ depending on whether the transaction was electronic, cheque-based, ATM-based, or carried out through another banking mechanism.
Is Unauthorized Withdrawal a Criminal Offence?
It can be.
The Bharatiya Nyaya Sanhita, 2023 (BNS) contains several offences that may become relevant when a person dishonestly obtains or misappropriates another person’s money.
For example, Section 318 deals with cheating, including situations where deception dishonestly induces a person to deliver property or causes harm to property. Depending on the facts, unauthorized withdrawal obtained through deception may potentially fall within this provision.
Other provisions may also become relevant depending on how the money was obtained, whether entrusted property was misused, whether documents or credentials were forged, and whether stolen property was involved.
Therefore, an unauthorized withdrawal should not automatically be treated as merely a dispute with the bank.
What If the Withdrawal Was an Electronic Transaction?
Electronic banking fraud has a specific RBI framework.
RBI’s customer-protection rules distinguish between transactions involving customer negligence, bank negligence, and third-party breaches. Customers are advised to notify their bank immediately after discovering an unauthorized electronic banking transaction.
Where there is no customer negligence and the unauthorized transaction is reported within three working days, RBI’s framework provides for zero customer liability in specified circumstances.
This makes prompt reporting particularly important.
What If the Customer Shared an OTP or Password?
The customer’s conduct can affect liability.
If the loss results from the customer’s negligence, such as voluntarily sharing passwords, PINs or other security credentials, the customer may bear the loss until the transaction is reported to the bank. RBI’s financial-awareness material specifically warns customers about this distinction.
However, the precise liability depends on the facts and the applicable RBI framework. A customer should still report the transaction to the bank immediately rather than assuming that sharing information automatically ends the possibility of recovery.
What Should You Do After an Unauthorized Withdrawal?
Speed is important. A person discovering an unauthorized withdrawal should generally:
- Contact the bank immediately through its official fraud-reporting or customer-service channel.
- Block the relevant card or banking access where appropriate.
- Change passwords and security credentials if compromise is suspected.
- Obtain a complaint or acknowledgement number from the bank.
- Preserve transaction alerts, statements and screenshots.
- Report suspected fraud to the appropriate cybercrime or police authority.
- Follow up with the bank in writing if the disputed amount has not been resolved.
RBI states that banks should provide an acknowledgement when a customer reports an unauthorized electronic transaction and should resolve the complaint within the applicable framework.
Can the Bank Be Liable?
Potentially, depending on the circumstances.
RBI’s framework recognises situations where the deficiency or negligence lies with the bank. It also addresses third-party breaches where the deficiency lies neither with the customer nor the bank. In specified cases, customer liability may be zero or limited.
For unauthorized electronic transactions, RBI’s framework also provides for a shadow reversal of the disputed amount within 10 working days after notification in cases covered by the relevant liability provisions.
The bank’s internal investigation can determine the circumstances and applicable customer liability.
What Evidence Should Be Preserved?
Evidence can be important when disputing an unauthorized withdrawal.
Useful records may include:
- Bank statements
- SMS and email transaction alerts
- ATM receipts
- UPI transaction details
- Card transaction records
- Bank complaint acknowledgement
- Screenshots
- Relevant phone numbers or messages
- Details of suspicious communications
- Police or cybercrime complaint records
The original transaction information should be preserved rather than deleted.
What If the Withdrawal Was Made Through a Forged Cheque?
A forged-cheque withdrawal can raise different legal issues from an unauthorized electronic transaction.
If someone creates or uses a forged cheque to withdraw money, criminal provisions concerning false documents and forgery may become relevant depending on the circumstances. The bank may also investigate the signature, cheque image, account records and manner in which the cheque was presented.
The account holder should immediately notify the bank and preserve the relevant cheque and transaction records.
Can a Person Seek Legal Remedies Against the Bank?
Yes, depending on the circumstances.
If the bank fails to resolve a properly reported unauthorized transaction, the customer may have additional avenues under the applicable banking grievance framework and other laws. The appropriate route depends on the nature of the dispute, the bank’s response and the applicable regulatory requirements.
A customer should first maintain a complete record of the complaint and the bank’s response.
Conclusion
Unauthorized bank account withdrawal is legally actionable in India, but the appropriate remedy depends on how the withdrawal occurred and the circumstances surrounding it. Electronic banking fraud is subject to RBI’s customer-liability framework, while deliberate unauthorized taking of money may also attract criminal provisions under the BNS.
Customers should report unauthorized transactions to their bank immediately, preserve evidence and secure their banking credentials. For electronic transactions covered by RBI’s framework, timely reporting can significantly affect the customer’s liability. Where fraud or deliberate unauthorized access is suspected, a police or cybercrime complaint may also be appropriate.
Because liability can depend on the transaction method, customer conduct and evidence, an actual dispute should be assessed on its specific facts before legal proceedings are initiated.
