What is my liability if fraudsters make an unauthorised transaction from my bank account?

Question

Someone made an unauthorised online transaction from my account through phishing and I reported it to my bank promptly. I want to know how much of the loss I have to bear. Specifically, I want to know how RBI Circular on Customer Protection - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 2017 applies to a situation like mine and what the consumer law position in India actually is. If there is a deadline I should be aware of, I need to know that now.

MyVakeel Legal Desk · Accepted Answer

What is my liability if fraudsters make an unauthorised transaction from my bank account? is governed in India primarily by RBI Circular on Customer Protection - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 2017, Information Technology Act 2000, Section 43, Consumer Protection Act 2019, Section 2(11) and RBI Master Circular on Customer Service in Banks. Outcomes in unauthorised transaction liability disputes depend heavily on documentation, so check what you can actually evidence as you read.

The RBI's 2017 circular on limiting customer liability provides that if the customer reports an unauthorised electronic transaction within three working days of receiving the communication from the bank, the customer bears zero liability regardless of who was at fault.

If the report is made between four and seven working days, the customer's liability is capped at a limited amount depending on the type of account, and beyond that period liability is determined as per the bank's board-approved policy.

The bank must credit the disputed amount to the customer's account within ten working days of the complaint, even before completing its own investigation, to protect the customer from being deprived of funds during the inquiry.

Section 43 of the Information Technology Act 2000 makes unauthorised access to a computer resource or account actionable, and the bank as the entity responsible for the security of its digital channels can be held liable if its system safeguards were deficient.

A bank's failure to credit the shadow amount within the prescribed period or to correctly apply the zero/limited liability framework is a deficiency in service under Section 2(11) of the Consumer Protection Act 2019, entitling the customer to a consumer complaint for the balance amount and compensation.

What to do next: 1) Report the unauthorised transaction to the bank by phone or email immediately and follow up with a written complaint; 2) Also register a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or dial 1930; 3) Check that the shadow reversal credit is made to your account within ten working days as mandated by RBI; 4) File a complaint with the RBI Integrated Ombudsman or the consumer commission if the bank denies the zero/limited liability protection.

If you are unsure whether your facts fall inside RBI Circular on Customer Protection - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 2017, that is worth checking with an advocate before you commit to a route, because switching later costs time. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in consumer law.