Can banks be held liable for unauthorized transactions?

Understanding Bank Liability in Cyber Fraud: When Can Banks Be Held Responsible for Unauthorized Transactions in India?

You wake up one morning, check your phone, and find a bank alert: Rs. 47,000 debited from your account. A transaction you never authorized. Panic sets in. You call the bank. They tell you to file a complaint. Days pass. The money is gone. You ask yourself: isn't the bank supposed to protect my account? Can they just walk away?

This is not a hypothetical scenario. Thousands of Indians face unauthorized transaction incidents every year through phishing links, SIM swaps, UPI fraud, debit card cloning, and account takeovers. The question of bank liability in cyber fraud is not just legal theory. It determines whether you get your money back or lose it permanently.

In India, banking fraud involving digital transactions is governed by Reserve Bank of India (RBI) circulars, the Information Technology Act, 2000, the Banking Regulation Act, 1949, and increasingly by provisions under the Bharatiya Nyaya Sanhita, 2023 (BNS) where criminal offences are involved. The law recognizes that banks have a duty to protect customer funds, but it also expects customers to act responsibly.

This article explains when and how bank liability in cyber fraud applies in India, what your rights are as a customer, what the RBI says about unauthorized transaction reversals, and what steps you must take immediately after detecting fraud. It also clarifies what counts as customer negligence and when you may lose your claim entirely.

Legal Framework Governing Bank Liability in Cyber Fraud

Bank liability in cyber fraud cases in India is primarily governed by RBI Master Directions and specific circulars issued under the Banking Regulation Act, 1949 and the Payment and Settlement Systems Act, 2007.

RBI Circular on Customer Protection: Limiting Liability of Customers in Unauthorized Electronic Banking Transactions

The most critical document on bank liability in cyber fraud is the RBI Circular dated July 6, 2017, titled "Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions."

This circular categorizes liability depending on:

• When the customer reports the fraud
• Whether the customer was negligent
• Whether the bank failed in its system safeguards

Zero Liability of Customer

According to the RBI circular, the customer bears zero liability in the following cases:

1. Contributory fraud, negligence, or deficiency on the part of the bank: If the unauthorized transaction occurred due to the bank's failure in maintaining proper security systems, the customer is not liable at all.

2. Third-party breach where the deficiency lies neither with the bank nor the customer but elsewhere in the system. Again, the customer bears no liability.

3. Unauthorized transactions reported within three working days: If you notify the bank within this window and there is no negligence on your part, your liability is zero.

Limited Liability of Customer

If the unauthorized transaction is reported after three working days but within four to seven working days, the customer's liability is:

• Up to Rs. 10,000 for savings, current, cash credit, and overdraft accounts
• Up to Rs. 25,000 for credit card transactions (though this is subject to individual card issuer policies and RBI guidelines)

Full Liability of Customer

The customer may be held fully liable if:

• The unauthorized transaction occurred due to the customer's own negligence, such as:
  • Sharing OTP, PIN, CVV, or passwords with others
  • Clicking on phishing links and entering credentials
  • Storing credentials in insecure locations
  • Delaying reporting beyond seven working days without reasonable cause

These distinctions are critical. Bank liability in cyber fraud cases is not automatic. It depends heavily on customer conduct and reporting timelines.

Information Technology Act, 2000 and Banking Fraud

The Information Technology Act, 2000 provides the statutory backbone for cyber fraud enforcement in India.

Section 43 of the IT Act, 2000

Section 43 deals with civil liability for unauthorized access to computer systems. If someone gains unauthorized access to your bank account through hacking or phishing and causes damage or loss, the bank or intermediary may be held liable under this section if they failed to maintain reasonable security practices.

Section 66C and Section 66D of the IT Act, 2000

These provisions penalize identity theft and cheating by personation using computer resources. Banking fraud involving impersonation or credential theft may be prosecuted under these sections.

However, for the victim seeking recovery, criminal prosecution of the fraudster does not automatically translate into bank liability in cyber fraud. The two processes are independent.

Bharatiya Nyaya Sanhita, 2023 (BNS) Provisions Related to Cyber Banking Fraud

With the enactment of the Bharatiya Nyaya Sanhita, 2023 (BNS), older IPC provisions have been replaced. Cyber fraud and banking fraud cases now fall under new BNS provisions.

Section 318 BNS: Cheating

Section 318 of the BNS penalizes cheating and dishonestly inducing delivery of property. Many banking fraud incidents involving phishing, fake customer care calls, and OTP scams are prosecuted under this section.

Section 319 BNS: Cheating by Personation

Section 319 deals with cheating by impersonation, applicable when fraudsters pose as bank officials or payment gateway representatives to extract credentials.

Section 336 BNS: Forgery

If fraudulent documents, fake KYC, or forged signatures are used to facilitate unauthorized transaction, Section 336 of the BNS may apply.

Section 66 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS)

Under the BNSS, police have powers to investigate cyber fraud cases registered under IT Act and BNS provisions. However, investigation outcome does not determine civil liability of the bank. That is decided based on RBI norms and contractual duties.

Common Problems Faced in Bank Liability in Cyber Fraud Cases

Problem 1: Delayed Reporting by Customers

Many victims of unauthorized transaction delay reporting because they are unaware, travelling, or assume the transaction will auto-reverse. By the time they report, seven working days have passed and the bank denies liability citing delayed complaint.

Example: A senior citizen notices Rs. 30,000 debited from her account ten days after the transaction. The bank refuses reversal, stating the customer failed to report within the stipulated timeline under the RBI circular. She is told she bears full liability.

Problem 2: Disputes Over "Customer Negligence"

Banks often claim that the unauthorized transaction occurred due to customer negligence such as sharing OTP or clicking phishing links and refuse reversal. However, in many cases, customers genuinely did not share credentials but fell victim to sophisticated SIM swap attacks or malware.

Example: A businessman's UPI account is debited Rs. 1.2 lakh. The bank claims he shared his UPI PIN. He denies it. Forensic analysis later reveals SIM swap fraud initiated through telecom provider breach. The bank still delays reversal pending investigation.

Problem 3: NRIs Facing Additional Verification Barriers

NRIs often face banking fraud involving NRI accounts managed remotely. Time zone differences, lack of immediate mobile access, and delayed SMS alerts make it difficult to report unauthorized transaction within three days. Banks sometimes deny liability citing delayed intimation.

Example: An NRI based in the USA notices fraudulent debit from his NRO account five days after occurrence due to SMS delay. The bank refuses full reversal, citing reporting delay. He is asked to prove he had no access to timely alerts.

Practical Guidance: What to Do Immediately After an Unauthorized Transaction

Step 1: Report the Unauthorized Transaction Immediately

Call your bank's customer care within three working days of noticing the fraud. Do not delay even if the amount seems small.

Action: Use the bank's official fraud reporting number or internet banking complaint portal. Send a written email as well for documentation.

Step 2: Block Your Card, Change Passwords, and Disable Online Transactions

Immediately freeze your debit card, credit card, or UPI account to prevent further unauthorized transaction.

Action: Use mobile banking app or call customer care to block all access channels. Change internet banking password, UPI PIN, and mobile banking PIN.

Step 3: File a Written Complaint with the Bank

Send a written complaint via email and registered post detailing:

• Transaction date, amount, and reference number
• Statement that the transaction was unauthorized
• Request for immediate reversal under RBI circular on bank liability in cyber fraud

Timeline: Banks are required to respond within a stipulated period and credit the disputed amount during investigation if no negligence is apparent.

Step 4: Lodge an FIR or Cyber Crime Complaint

File an FIR at your local police station or register a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in).

Jurisdiction Note: Under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), cyber crime FIRs can be registered at any police station irrespective of territorial jurisdiction in certain cases. However, local police may still require you to approach the cyber cell.

Documentation Required:

• Bank statement showing unauthorized transaction
• SMS or email alerts
• Screenshots of phishing messages (if applicable)
• Written bank complaint acknowledgment

Step 5: Escalate to Banking Ombudsman if Bank Denies Liability

If the bank refuses to reverse the unauthorized transaction citing customer negligence or delayed reporting and you disagree, you can approach the Reserve Bank of India Banking Ombudsman Scheme, 2021.

How to File:

• Visit the RBI Ombudsman portal: https://cms.rbi.org.in
• File a complaint online within one year from the date of receiving the bank's final reply (or within one year and one month if no reply is received)
• No fee is charged

Timeline: The Ombudsman usually disposes of complaints within 30 days, though complex cases may take longer.

Remedy: The Ombudsman can direct the bank to reverse the transaction and compensate for loss, provided you establish that bank liability in cyber fraud applies under RBI norms.

Step 6: Initiate Legal Action if Ombudsman Relief is Insufficient

If the Banking Ombudsman's decision is unsatisfactory or if the amount involved is significant, you may file a civil suit for recovery or approach the consumer forum under the Consumer Protection Act, 2019.

Legal Remedy:

• File a consumer complaint under Section 35 of the Consumer Protection Act, 2019 before the District Consumer Disputes Redressal Commission if the transaction value is within jurisdiction limits
• Alternatively, file a civil suit for breach of contract and negligence in the appropriate civil court

Timeline: Consumer forum cases may take several months to a year depending on complexity and evidence.

Legal Advice and Things to Avoid

Common Mistakes People Make

1. Delaying Complaint: Many people wait for the bank to notice the fraud or assume the amount is too small to report. This is a critical mistake. Bank liability in cyber fraud cases hinges on timely reporting.

2. Sharing OTP or PIN: Never share OTP, CVV, ATM PIN, or UPI PIN with anyone, not even with someone claiming to be a bank official. No legitimate bank or payment platform will ever ask for these.

3. Clicking Unknown Links: Phishing links sent via SMS or WhatsApp are the primary cause of unauthorized transaction incidents. Do not click on links asking you to "update KYC," "claim refunds," or "verify your account."

4. Assuming the Bank Will Auto-Reverse: Banks do not automatically reverse unauthorized transaction amounts. You must formally report and request reversal under RBI norms.

5. Not Keeping Written Records: Always maintain email trails, written complaints, and SMS screenshots. Oral complaints are difficult to prove later.

6. Ignoring Evidence: Do not destroy or omit any documentation related to the unauthorized transaction. These records can be vital for your claim.

When to Consult a Legal Professional

• If the bank denies reversal citing customer negligence and you disagree
• If the unauthorized transaction amount is substantial (above Rs. 50,000)
• If you are an NRI facing jurisdictional or procedural complications
• If you need to file consumer complaints or civil suits for recovery
• If you are falsely accused of involvement in banking fraud due to account misuse by third parties

Clarification: This article provides general guidance on bank liability in cyber fraud under Indian law. It is not specific legal advice. Each case depends on transaction facts, bank response, and evidence of negligence or system failure.

Frequently Asked Questions (FAQs) on Bank Liability in Cyber Fraud

What is an unauthorized transaction?

An unauthorized transaction occurs when funds are withdrawn from your bank account without your consent. It can happen due to hacking, phishing, UPI fraud, SIM swap attacks, or other fraudulent activities.

Can I get my money back if someone used my debit card without my permission?

Yes, you can get your money back if you report the unauthorized transaction within three working days and did not share your PIN or OTP. The RBI circular on bank liability in cyber fraud states that customers bear zero liability if they report promptly and were not negligent. If you report between four to seven days, your liability is capped at Rs. 10,000. Beyond seven days, the bank may refuse reversal if they can prove you were negligent.

What if the bank says I shared my OTP and refuses to reverse the transaction?

If the bank claims customer negligence and refuses reversal, you should file a written complaint disputing this claim. Request the bank to provide evidence of your alleged negligence. If they cannot prove it, escalate the matter to the RBI Banking Ombudsman. Many banking fraud cases involve SIM swap or malware attacks where the customer did not actively share credentials, but the bank must investigate properly before denying liability.

How quickly should I report unauthorized transactions to my bank?

You should report unauthorized transactions as soon as you notice them, ideally within three working days. Quick reporting can help minimize your loss and establish your case for zero liability under RBI cyber fraud rules.

Can the bank hold me liable if I shared my credentials?

If a bank establishes that you breached security protocols, such as sharing your OTP, PIN, or passwords, they may hold you liable for the unauthorized transaction under RBI cyber fraud rules. However, if fraud occurred through SIM swap or malware without your active input, you may argue that negligence does not apply.

I am an NRI and noticed fraud in my NRO account five days late due to SMS delay. Will the bank still refund me?

NRIs face unique challenges due to time zone differences and delayed SMS alerts. If you can prove that the delay in reporting was due to circumstances beyond your control such as lack of real-time alerts, you may still argue for partial or full reversal. However, under the RBI circular on bank liability in cyber fraud, reporting beyond seven days without reasonable cause may lead to denial. Escalate to the Banking Ombudsman with evidence of delayed alerts or lack of access.

How long does it take for the bank to reverse an unauthorized transaction after I report it?

The RBI expects banks to respond to unauthorized transaction complaints within a reasonable period, usually 10 working days. During investigation, if no customer negligence is apparent, the bank should provisionally credit the disputed amount. If the bank delays beyond this or refuses reversal, you can escalate to the RBI Banking Ombudsman, which typically resolves complaints within 30 days.

Can I file a police complaint if the bank refuses to reverse the fraudulent transaction?

Yes, you should file an FIR or cyber crime complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) even if the bank refuses reversal. The police complaint is important for two reasons: first, it creates an official record of banking fraud; second, it may aid in tracing the fraudster and recovering funds through frozen accounts. However, the police complaint alone does not force the bank to reverse. You must separately pursue reversal through RBI Ombudsman or legal action.

What is the difference between bank liability and criminal prosecution in cyber fraud cases?

Bank liability in cyber fraud refers to whether the bank must compensate you for the unauthorized transaction under RBI norms and contractual duty. Criminal prosecution refers to filing an FIR under the Bharatiya Nyaya Sanhita, 2023 (BNS) and IT Act against the fraudster. These are two separate processes. The bank's liability is determined by RBI circulars and civil or consumer law, while criminal action is governed by BNS and BNSS provisions. You can pursue both simultaneously.

If I accidentally clicked a phishing link but did not share my PIN, am I still negligent?

Clicking a phishing link alone may not amount to full negligence if malware or session hijacking extracted your credentials without your active input. Bank liability in cyber fraud cases depends on whether you actively shared OTP, PIN, or passwords. If you clicked a link but did not enter sensitive information, and fraud still occurred due to malware or system breach, you may argue that negligence does not apply. However, banks may still dispute this, so you must escalate to the Ombudsman with technical evidence if needed.

Are banks required to reimburse customers for unauthorized transactions?

Under RBI guidelines, banks are required to refund customers for unauthorized electronic transactions, unless the customer has been negligent or failed to report within the prescribed timelines.

What is the role of the Banking Ombudsman?

The Banking Ombudsman is a quasi-judicial authority that addresses complaints of bank customers regarding the services provided by financial institutions. They help resolve disputes and can provide a binding decision on bank liability in cyber fraud cases.

How does the RBI protect customers from cyber fraud?

The RBI implements various regulations and guidelines such as the Payment and Settlement Systems Act, 2007, and the Master Direction on Limiting Customer Liability, which enforces safety protocols for electronic transactions and defines bank liability in cyber fraud cases.

Conclusion

Bank liability in cyber fraud cases in India is not automatic, but it is real and enforceable under RBI circulars, the Information Technology Act, 2000, and now the Bharatiya Nyaya Sanhita, 2023 (BNS) where criminal fraud is involved. The key to recovering your money after an unauthorized transaction is immediate reporting, proper documentation, and understanding your rights under the RBI's Customer Protection framework.

Banks have a legal duty to protect customer accounts, maintain secure systems, and reverse fraud when they fail in those duties or when customers report promptly without negligence. However, customer responsibility matters equally. Timely vigilance, secure credential management, and swift action determine whether you bear zero liability or face financial loss.

As cyber fraud continues to evolve with sophisticated techniques like SIM swaps, malware attacks, and AI-driven phishing, maintaining awareness and taking proactive measures can make the difference between full recovery and permanent loss. Know your rights, act quickly, and seek professional legal guidance when needed to protect your financial well-being in today's digital banking landscape.

This article is for informational purposes only and does not constitute legal advice. Please consult a qualified legal professional for specific guidance.

---

About LawCrust:

LawCrust Legal Consulting, a subsidiary of LawCrust Global Consulting Ltd., is a top full-service legal firm in Mumbai, Delhi, Bangalore & across India, delivering strategic legal solutions for NRIs, HNIs, and businesses with a global perspective. Since 2016, we have successfully handled over 10,000 cases through a strong network of 70+ in-house lawyers and senior partnered advocates. We represent clients across all levels of the judiciary from Magistrate Courts and High Courts to the Supreme Court of India handling complex matters including NRI divorce, cross-border property disputes, immigration, corporate governance, mergers & acquisitions (M&A), and structured finance.

For expert legal assistance, contact us: Call Now: +91 8097842911 Email: inquiry@lawcrust.in