Understanding the Tiers of Liability
When it comes to unauthorised electronic transactions, the Reserve Bank of India (RBI) has established clear guidelines to protect consumers. Your liability, or the amount of loss you have to bear, is not arbitrary. It falls into three specific categories:
zero liability, limited liability, and full liability. These rules apply to all scheduled commercial banks, payment banks, and even prepaid instrument issuers like mobile wallets. The fundamental principle is that a customer who acts responsibly and promptly should be protected. The burden of proving that a customer was negligent lies with the bank, not the other way around.
The Critical 3-Day Window for Zero Liability
Time is the most critical element in determining your liability. According to RBI rules, you are entitled to 'zero liability' if you report an unauthorised transaction within three working days of receiving the notification (like an SMS or email alert) from your bank. This applies in cases of a 'third-party breach' — meaning the fault lies neither with you nor the bank, but elsewhere in the system, such as with a data breach at a merchant's end. You also have zero liability if the fraudulent transaction occurred due to the bank's negligence or system failure, regardless of when you report it.
What Happens if You Delay Reporting?
If you miss the three-day window but report the transaction between four and seven working days, your liability becomes limited. The maximum loss you would have to bear is capped based on your account type. For Basic Savings Bank Deposit (BSBD) accounts, the liability is capped at ₹5,000. For other savings accounts and most prepaid instruments, it's capped at ₹10,000. For credit cards with a limit over ₹5 lakh, the maximum liability is ₹25,000. If you report a transaction after seven working days, your liability will be determined by the bank's board-approved policy. However, even in cases where you might have been negligent by, for instance, sharing your PIN, you are only liable for the loss until the moment you report the fraud to the bank. Any loss that occurs after you report it becomes the bank's responsibility.
The Correct Way to Report a Dispute
Simply noticing the fraud isn't enough; you must report it through the proper channels. Banks are required to provide 24/7 mechanisms for reporting. The first step should always be to call your bank’s dedicated helpline to block your card or account immediately. Follow this up with a written complaint via email to the bank's official dispute resolution address. This creates a documented timestamp, which is crucial evidence. Always make sure to get a complaint reference or service request number. For cyber fraud, you should also file a report on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or call the helpline number 1930.
The Resolution Process and Timelines
Once you've reported an unauthorised transaction, the clock starts for the bank. As per RBI guidelines, the bank must credit the disputed amount back to your account on a provisional basis within 10 working days of you reporting it. This is often called a 'shadow reversal' and ensures you don't suffer from a lack of funds while the investigation is ongoing. The bank then has a total of 90 days to investigate and resolve the complaint. If the bank fails to resolve the issue within 30 days, or if you are unsatisfied with the outcome, you can escalate the matter to the RBI's Banking Ombudsman through their online Complaint Management System (CMS).
