Finding out that money has been withdrawn from your bank account without your permission can be alarming. Whether the fraud involves an unauthorised online payment or an unexpected debit, acting quickly can help prevent further losses and protect your money.
The Reserve Bank of India (RBI) requires banks to provide round-the-clock channels for reporting unauthorised electronic transactions. Customers can therefore report suspected fraud at any time, including outside regular banking hours.
What should you do first if money is stolen from your bank account?
Contact your bank immediately through its official customer care number, mobile app or website. Tell the bank that you did not authorise the transaction and ask it to secure the affected account and prevent further unauthorised debits.
Obtain an acknowledgement or complaint reference number and keep it for future correspondence. Save the transaction alert, bank statement, screenshots and other relevant details as evidence.
You should also report cyber financial fraud through the national cybercrime helpline at 1930 or the National Cyber Crime Reporting Portal. If you cannot reach the helpline, contact your bank without delay rather than waiting for the call to connect.
Who bears the loss when money is stolen from your account?
Under RBI guidelines, a customer’s liability depends on how the unauthorised transaction occurred and how quickly the customer reported it to the bank.
Zero liability: Customers are not liable if an unauthorised transaction results from negligence or a deficiency on the bank’s part, regardless of when it is reported. They also have zero liability if a third-party breach occurs, with neither the bank nor the customer at fault, and they notify the bank within three working days of receiving the transaction alert.
Limited liability: If a third-party breach occurs and the customer reports it within four to seven working days of receiving the alert, their liability is capped at the transaction amount or the applicable RBI limit, whichever is lower. The cap depends on the type of account and can range from ₹5,000 to ₹25,000.
If you share your PIN, password or OTP: If the loss results from the customer’s negligence, such as sharing payment credentials, the customer must bear the loss until the unauthorised transaction is reported to the bank. Any further loss after the report must be borne by the bank.
If you report the fraud after seven working days: The customer’s liability is determined under the bank’s board-approved policy.
The reporting period for these rules is counted in working days according to the home branch’s working schedule, excluding the day on which the customer receives the transaction alert.
How long does a bank have to refund the money?
For unauthorised transactions covered by the RBI’s zero- or limited-liability rules, banks must provide a provisional credit, known as a shadow reversal, within 10 working days of being notified by the customer. The credit must be dated as of the original transaction date.
Banks must resolve the complaint and establish the customer’s liability, if any, within a period set out in their board-approved policy, which cannot exceed 90 days from the date the complaint is received.
If the bank cannot resolve the complaint or determine the customer’s liability within 90 days, it must provide the compensation prescribed under the RBI’s rules. For debit cards and bank accounts, customers must also not suffer a loss of interest as a result of the unauthorised transaction.
Customers should report suspected fraud to their bank as soon as possible. Delays can affect how much of the loss they may have to bear.