Yes, a bank can be legally responsible for an unauthorized digital transaction in India, but the bank’s liability depends on how the transaction occurred and whether the customer contributed to the loss. RBI’s customer-protection framework distinguishes between bank negligence, customer negligence and third-party breaches. In certain circumstances, the customer can have zero liability, while in others the customer may bear some or all of the loss.
The most important practical rule is simple: report an unauthorized transaction to the bank immediately. RBI advises customers to notify their bank as soon as they discover a fraudulent or unauthorized electronic transaction.
What Is an Unauthorized Digital Transaction?
An unauthorized digital transaction is an electronic banking transaction that the customer did not approve or initiate.
Examples can include:
- Unauthorized UPI transfers
- Internet banking transactions
- Fraudulent mobile banking payments
- Unauthorized debit card transactions
- Electronic fund transfers made without the customer’s permission
- Other digital transactions resulting from compromised credentials or security breaches
However, an unfamiliar transaction is not automatically fraudulent. A customer should first verify the merchant, transaction details and account activity before concluding that a transaction is unauthorized.
When Is the Bank Responsible?
The bank can be responsible when the unauthorized transaction results from negligence, deficiency or fraud on the part of the bank.
Under RBI’s framework, where the unauthorized transaction is attributable to the bank’s negligence or deficiency, the customer’s liability is zero, regardless of whether the customer reported the transaction.
For example, if a transaction occurs because of a deficiency in the bank’s systems or security controls and the customer did not contribute to the incident, the customer’s liability may be zero under the applicable framework.
This does not mean that every disputed transaction automatically establishes bank negligence. The circumstances surrounding the transaction must be examined.
What If a Third Party Causes the Fraud?
RBI also recognises situations where an unauthorized transaction results from a third-party breach, while the deficiency lies neither with the bank nor with the customer.
In such cases, the customer can have zero liability if the transaction is reported to the bank within three working days of receiving the bank’s communication about the transaction.
This is why immediate reporting is important. Delaying the complaint can affect the customer’s liability under the RBI framework.
What If the Customer Was Negligent?
The position can be different when the customer contributed to the loss through negligence.
RBI gives sharing payment credentials, such as passwords or other security information, as an example of customer negligence. In such circumstances, the customer generally bears the loss until the unauthorized transaction is reported to the bank. Any loss occurring after the customer reports the transaction is to be borne by the bank under the framework.
For example, if a customer voluntarily shares confidential banking credentials with another person and that information is subsequently misused, the bank may assess the incident differently from a fraud caused entirely by a bank security failure.
What Happens If the Customer Reports the Fraud Within Three Days?
Prompt reporting can provide significant protection.
Where the customer is not negligent and a qualifying third-party breach is involved, reporting the transaction within three working days can result in zero liability under RBI’s framework.
If the customer reports the transaction between four and seven working days, liability is subject to the limits specified under RBI’s framework. Beyond seven working days, liability is generally determined according to the bank’s board-approved policy.
The relevant working days are calculated according to the prescribed banking schedule.
How Quickly Must the Bank Act?
Once the customer reports an unauthorized electronic transaction, the bank must take appropriate steps to prevent further unauthorized transactions.
For cases involving zero or limited customer liability, RBI requires the bank to provide a shadow reversal of the transaction amount within 10 working days of receiving the customer’s notification, without waiting for settlement of an insurance claim.
The bank must also resolve the complaint and determine customer liability within the period specified in its board-approved policy, which cannot exceed 90 days from receipt of the complaint. If the bank cannot determine liability within that period, the RBI framework provides for compensation in accordance with the applicable provisions.
Does the Customer Have to Pay Interest on the Fraudulent Amount?
For credit card transactions, RBI’s framework provides that an eligible customer should not bear an additional burden of interest arising from an unauthorized electronic transaction.
For bank accounts and debit-card transactions, the framework also protects customers from certain interest-related losses in cases covered by zero or limited liability.
The treatment of the disputed amount should nevertheless be confirmed with the bank while the investigation is underway.
What Should You Do After Discovering an Unauthorized Transaction?
A customer should act immediately rather than waiting for the monthly statement.
Recommended steps include:
- Contact the bank immediately through its official channel.
- Report the unauthorized transaction and obtain a complaint number.
- Block the affected card or digital banking facility if necessary.
- Change compromised passwords or credentials.
- Preserve SMS alerts, emails, screenshots and transaction details.
- Report suspected cyber fraud to the appropriate law-enforcement or cybercrime channel.
- Follow up with the bank in writing.
- Escalate the complaint if it is not resolved satisfactorily.
RBI specifically advises customers to notify their bank immediately because delay can increase potential losses.
What Evidence Should Be Preserved?
Useful evidence can include:
- Transaction ID or reference number
- Date and time of the transaction
- Amount involved
- UPI ID, account or merchant details
- Bank statement
- SMS and email alerts
- Screenshots
- Details of when the fraud was reported
- Complaint/reference number
- Relevant communications with the bank or suspected fraudster
This information can help establish what happened and when the customer notified the bank.
What If the Bank Rejects the Complaint?
If the bank determines that the customer is liable, the customer can request the reasons and supporting information for that decision.
The customer should first use the bank’s internal grievance-redressal mechanism. If the complaint is not satisfactorily resolved, the customer may use the applicable RBI complaint mechanism, subject to its eligibility requirements and procedure.
Where the incident involves identity theft, fraud or other criminal conduct, a separate complaint to the appropriate law-enforcement authority may also be appropriate.
Conclusion
A bank can be legally responsible for unauthorized digital transactions in India, but responsibility depends on the circumstances. RBI’s framework provides zero-liability protection where the bank is negligent or deficient and in specified third-party breach situations where the customer promptly reports the transaction.
On the other hand, if the customer’s own negligence, such as sharing payment credentials, contributed to the fraud, the customer may bear the loss until the transaction is reported.
The most important step is therefore immediate reporting. Customers should contact their bank as soon as they discover an unauthorized transaction, preserve evidence and follow the bank’s complaint procedure. Prompt action can significantly affect how liability is determined and can help prevent additional unauthorized transactions.
