Unauthorised Transaction? RBI Zero Liability Rules 2026

"There is a debit of ₹38,000 on my account that I never made." If this is you, the one-line fix is: block the channel and report the transaction to your bank's 24x7 fraud line right now, then to 1930 or cybercrime.gov.in, because under RBI's rules the day you report decides whether your liability is zero or not. Reported within three working days, a third-party breach costs you nothing under the rules in force until 31 December 2026; from 1 January 2027, commercial banks give you five calendar days.

This guide focuses on the liability rules themselves: who pays, how much, and by when. For the scam-specific recovery steps, see our guides on UPI scams and cyber fraud money recovery.

What to do, step by step

In the first hour

1. Block the card, UPI or net banking using the app, net banking, the bank's official helpline or SMS-based blocking. Banks must offer 24x7 channels to report unauthorised transactions.
2. Report the specific transaction as unauthorised through the same channel. Note the complaint number and the exact time; RBI requires banks to acknowledge immediately with a complaint number and the date and time of your report.
3. Call 1930 or file on cybercrime.gov.in. This can trigger a hold on the money in the receiving account. Under the 2027 rules, reporting to the cyber portal is also a condition for the small-value compensation.

On the first day

4. Write to the bank using the template below, stating clearly that you did not authorise, initiate or benefit from the transaction.
5. Change passwords and PINs, remove unknown devices from your banking app, and uninstall any remote-access app.
6. Collect evidence: SMS alerts, email alerts, call logs, screenshots and the 1930 acknowledgement.

If it is unresolved

7. Track the shadow reversal. Under the current rules, the bank should credit the amount provisionally within 10 working days of your report in eligible cases.
8. Escalate to the grievance or nodal officer, then to the RBI Ombudsman at cms.rbi.org.in if there is no final reply within 30 days or the bank holds you liable without proof. See bank not resolving your complaint.

The rules until 31 December 2026

RBI's July 2017 circular on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions covers transactions such as UPI from bank accounts, net banking, debit cards, credit cards and prepaid instruments issued by banks.

Caps for reporting in 4 to 7 working days (you pay the transaction value or the cap, whichever is lower):

Other protections: the bank must reverse within 10 working days (shadow reversal), resolve within 90 days, and if it misses those, pay as if you had zero liability. For credit cards, you should not lose interest-free period or pay interest on a reversed amount. The burden of proving customer liability is on the bank.

The rules from 1 January 2027 (commercial banks)

RBI issued the Commercial Banks (Responsible Business Conduct) Third Amendment Directions, 2026 on 24 June 2026. They replace the 2017 provisions for electronic banking transactions on or after 1 January 2027. Similar directions have been issued or proposed for other bank types; check your bank's customer protection policy, which must be on its website.

Reversals must be value-dated to the original transaction date, so you lose no interest. The compensation is for individuals, including sole proprietors, and joint holders can claim it only once across all accounts.

Worked example

Case A, card skimmed (third-party breach), ₹38,000 from a savings account.

Note the trade-off: the new five-day window is longer in most weeks, but it counts weekends and holidays.

Case B, you shared an OTP with a fake caller (negligence), ₹20,000 lost on 15 January 2027. You report to the bank and 1930 the same day. Under the 2027 rules, compensation is the lesser of 85% × ₹20,000 = ₹17,000 and ₹25,000, so ₹17,000. If ₹4,000 is later recovered from the fraudster's account, the net loss falls to ₹16,000, 85% of which is ₹13,600, and the bank recalculates.

If an unauthorised charge on a credit card is not reversed before your due date, interest can build quickly; our credit card interest calculator shows the cost, which is one more reason to insist on the shadow reversal. For card disputes that are not fraud (goods not delivered), see credit card chargeback vs refund.

Where to complain

Ready-to-copy complaint message

Subject: Unauthorised electronic transaction – request for reversal under RBI customer liability rules

Dear Sir/Madam,

I report the following transaction(s) on my account/card [last 4 digits]
as unauthorised. I did not initiate, authorise or benefit from them.

Date/time: [ ]   Amount: ₹[ ]   Reference/UTR: [ ]   Channel: [UPI/card/net banking]

I became aware of it at [time] on [date] through [SMS/email/statement]
and reported it at [time] on [date], complaint no. [ ]. I have also
reported it on cybercrime.gov.in / 1930, acknowledgement no. [ ].

Under RBI's customer liability framework, please:
1. Block further debits on the affected channel;
2. Credit the amount (shadow reversal) within the prescribed time; and
3. Share the outcome in writing, including the basis of any customer
   liability you propose, since the burden of proof lies with the bank.

[Name], [registered mobile], [account/card last 4 digits]

What not to do

• Do not delay reporting to "check with family" or wait for Monday. Days matter; use the 24x7 channel.
• Do not accept a verbal "you shared your OTP, so no refund". Ask for the bank's evidence in writing.
• Do not sign any statement admitting negligence that you do not agree with.
• Do not pay "recovery agents" or anyone promising to get the money back for a fee.
• Do not keep SMS and email alerts off. Banks must send them, and they are your earliest warning.

Key takeaways

• Until 31 December 2026: zero liability for third-party breaches reported within 3 working days, capped liability of ₹5,000 to ₹25,000 for days 4 to 7.
• From 1 January 2027 (commercial banks): zero liability within 5 calendar days, and one-time compensation of up to ₹25,000 even where you were negligent, for losses up to ₹50,000.
• Banks bear any loss caused by their own negligence, whether or not you report.
• The bank must prove your liability, reverse value-dated, and resolve within 90 days now and 45 days from 2027.
• Report to the bank and 1930 at once, put it in writing, and escalate to cms.rbi.org.in after 30 days.