My ATM card details were cloned/skimmed and used for fraudulent withdrawals, what can I do?

Question

I noticed unauthorised ATM withdrawals from my account that I never made, and suspect my card was skimmed at an ATM. I would like to understand which provision governs this, what it entitles me to, and how long I have before the remedy lapses. I also want to know whether I need a lawyer for this or can do it myself.

MyVakeel Legal Desk · Accepted Answer

In India, the answer to "My ATM card details were cloned/skimmed and used for fraudulent withdrawals, what can I do?" turns on Information Technology Act, 2000 – Section 66C, RBI Circular on Customer Liability in Unauthorised Electronic Transactions, 2017 and Bharatiya Nyaya Sanhita, 2023 – Section 318. The points below set out the position and then what to do about it, in the order it should be done.

Card skimming (copying magnetic stripe data via a hidden device) followed by unauthorised withdrawal is identity theft under Section 66C of the IT Act and cheating under Section 318 BNS.

Under the RBI's 2017 circular, if the fraud is due to a third-party breach (like a compromised ATM) and you report within 3 working days, your liability is zero regardless of whether you contributed to the breach.

Banks are required to have real-time SMS/email alerts for card transactions; if such alerts were absent or delayed, the burden shifts to the bank to prove your negligence, strengthening your refund claim.

Report the specific ATM location and transaction time to the bank so they can check CCTV footage and flag the ATM for a skimming device inspection, which helps both your case and prevents further victims.

File the complaint on cybercrime.gov.in/1930 in addition to the bank dispute, as the criminal investigation can trace the skimming device/gang across multiple victim complaints.

In practice, in this order: 1) Block your card immediately and report the fraudulent transactions to the bank in writing; 2) Report within 3 working days to claim zero liability under RBI norms; 3) File a complaint at cybercrime.gov.in and 1930; 4) Escalate to the Banking Ombudsman if refund is delayed beyond 90 days.

Timing matters here: Information Technology Act, 2000 – Section 66C works on limitation periods, so a atm skimming fraud claim that is right on the merits can still fail if it is brought late. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in cyber law.