My ATM card details were cloned/skimmed and used for fraudulent withdrawals, what can I do?

I noticed unauthorised ATM withdrawals from my account that I never made, and suspect my card was skimmed at an ATM. I have been reading conflicting things online and I would like to understand what Indian law actually says about this, which Act and Section applies, what the realistic timelines and costs are, and what I should be doing right now to protect my position. If the matter can be resolved without litigation I would prefer that route, but I want to know what my rights are before I agree to anything or sign any document.

My ATM card details were cloned/skimmed and used for fraudulent withdrawals, what can I do? is governed in India primarily by Information Technology Act, 2000 – Section 66C, RBI Circular on Customer Liability in Unauthorised Electronic Transactions, 2017 and Bharatiya Nyaya Sanhita, 2023 – Section 318. The short answer is set out below, followed by the practical steps most people in this situation need to take. Read it alongside the specific provisions named, because the exact relief available to you turns on the facts you can prove on paper.

Card skimming (copying magnetic stripe data via a hidden device) followed by unauthorised withdrawal is identity theft under Section 66C of the IT Act and cheating under Section 318 BNS.

Under the RBI's 2017 circular, if the fraud is due to a third-party breach (like a compromised ATM) and you report within 3 working days, your liability is zero regardless of whether you contributed to the breach.

Banks are required to have real-time SMS/email alerts for card transactions; if such alerts were absent or delayed, the burden shifts to the bank to prove your negligence, strengthening your refund claim.

Report the specific ATM location and transaction time to the bank so they can check CCTV footage and flag the ATM for a skimming device inspection, which helps both your case and prevents further victims.

File the complaint on cybercrime.gov.in/1930 in addition to the bank dispute, as the criminal investigation can trace the skimming device/gang across multiple victim complaints.

What to do next: 1) Block your card immediately and report the fraudulent transactions to the bank in writing; 2) Report within 3 working days to claim zero liability under RBI norms; 3) File a complaint at cybercrime.gov.in and 1930; 4) Escalate to the Banking Ombudsman if refund is delayed beyond 90 days.

If the other side has already issued a notice, filed a case or set a deadline, treat the matter as time-sensitive — most remedies under Information Technology Act, 2000 – Section 66C carry limitation periods, and a delay you cannot explain weakens an otherwise strong case. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in this practice area.

Disclaimer: This information is for general awareness and does not constitute legal advice. Statutes and their interpretation change, and outcomes depend on the facts of your case. Please consult a qualified advocate before acting on it.