Am I liable for an unauthorised online transaction from my bank account?

Question

Money was fraudulently debited from my account through an unauthorised UPI transaction I did not make, and I reported it to the bank the next day. Will I get my money back? I have been reading conflicting things online and I would like to understand what Indian law actually says about this, which Act and Section applies, what the realistic timelines and costs are, and what I should be doing right now to protect my position. If the matter can be resolved without litigation I would prefer that route, but I want to know what my rights are before I agree to anything or sign any document.

MyVakeel Legal Desk · Accepted Answer

Am I liable for an unauthorised online transaction from my bank account? is governed in India primarily by RBI Master Circular on Customer Protection – Limiting Liability in Unauthorised Electronic Banking Transactions 2017, Information Technology Act 2000, Section 43 and Payment and Settlement Systems Act 2007. The short answer is set out below, followed by the practical steps most people in this situation need to take. Read it alongside the specific provisions named, because the exact relief available to you turns on the facts you can prove on paper.

RBI's 2017 circular on customer protection lays down a graded liability structure: if the unauthorised transaction results from a third-party breach with no fault of the bank or customer and is reported within 3 working days, the customer bears zero liability.

If reported between 4 and 7 working days, the customer's liability is limited to a specified amount depending on the type of account, ranging typically from Rs 5,000 to Rs 25,000, and if the negligence is entirely the bank's, liability remains zero regardless of reporting time.

Beyond 7 working days, liability is determined as per the bank's board-approved policy, so delayed reporting significantly weakens your claim, making prompt reporting the single most important step.

The bank must credit the disputed amount to the customer's account within 10 working days of notification, even before final determination of the customer's liability, to provide interim relief.

Where the customer's own credentials were compromised due to their negligence such as sharing OTP or PIN, liability shifts to the customer, so the facts of how the fraud occurred matter greatly.

What to do next: 1) Report the unauthorised transaction to your bank immediately via phone, email and the official complaint channel, and note the complaint reference number; 2) Block your card, UPI or net banking access right away to prevent further unauthorised transactions; 3) Follow up in writing within 3 working days to claim zero liability protection under RBI's circular; 4) If the bank delays crediting the disputed amount or wrongly denies your claim, escalate to the RBI Ombudsman.

If the other side has already issued a notice, filed a case or set a deadline, treat the matter as time-sensitive — most remedies under RBI Master Circular on Customer Protection – Limiting Liability in Unauthorised Electronic Banking Transactions 2017 carry limitation periods, and a delay you cannot explain weakens an otherwise strong case. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in this practice area.