Bank not refunding an unauthorised transaction? What the RBI rules say

How to claim the RBI protection, step by step

1. 1

   Report to the bank at once, in writing

   Use the bank's official helpline, app, website or branch, then put it in writing as well. Keep the acknowledgement with the date and time: that date decides your liability.

2. 2

   Report on 1930 or cybercrime.gov.in too

   File the cyber fraud report and send the acknowledgement number to the bank. For transactions from 1 January 2027, reporting both on the portal or 1930 and to the bank within five calendar days is a condition for the new compensation.

3. 3

   Ask for the shadow credit

   For a transaction up to 31 December 2026, cite the RBI customer-liability rules (first issued by circular on 6 July 2017) and ask the bank to credit the disputed amount within 10 working days of your report, value-dated to the transaction date, while it investigates.

4. 4

   Escalate inside the bank

   If the credit or a decision does not come, write to the bank's grievance redressal or nodal officer, whose details are on its website, quoting your complaint number and the dates.

5. 5

   Complain to the RBI Ombudsman

   If the bank does not reply within 30 days, or you are not satisfied with its reply, file a free complaint on cms.rbi.org.in under the Reserve Bank – Integrated Ombudsman Scheme, 2026, within 90 days of the later of those 30 days running out or the bank's last reply.

Transactions on or after 1 January 2027: the new RBI rules

RBI's amendment Directions of 24 June 2026 replace these rules for electronic banking transactions made on or after 1 January 2027. They cover 'fraudulent' transactions, which include a payment made using credentials obtained from you by fraud and a payment you approved under coercion or duress, as well as unauthorised transactions.

• Zero liability where the bank was negligent, whether or not you reported it.
• Zero liability for a third-party breach reported to the bank within five calendar days of the transaction; after that, the bank's policy applies.
• Where you were negligent, you bear the loss until you report it, less any compensation under the new scheme.
• Compensation for small-value victims: a bona fide individual victim (including a sole proprietor) with a gross loss up to ₹50,000 from a fraud caused by their own negligence gets 85 per cent of the net loss or ₹25,000, whichever is less, once in a lifetime, if the fraud was reported on the portal or 1930 and to the bank within five calendar days. This applies to frauds in the first year of the new rules.
• The bank must decide a domestic complaint within 45 calendar days (60 for cross-border transactions).
• The burden of proof stays on the bank.

Wallets and other prepaid instruments

For wallets issued by non-bank companies, RBI's Master Directions on Prepaid Payment Instruments give zero liability for a third-party breach reported within three days, and a cap of ₹10,000 per transaction, or the transaction value if lower, when reported within four to seven days. These are calendar days, not working days. Report to the wallet issuer through its official app or website.

What people ask

Related questions