Card in Hand, Money Gone: RBI's Zero-Liability Rule for Unauthorized Transactions (3-Day Deadline)

Scenario: at 11 pm your phone buzzes with SMS after SMS — ₹42,000 spent on a foreign website on your card. The card is still in your pocket; you never gave the OTP to anyone. Before panicking, remember: RBI’s ‘Customer Protection — Limiting Liability’ circular exists precisely for this situation — report promptly and the entire liability for the money is the bank’s, not yours. But the window is only 3 working days.

---

1. RBI’s Liability Table

When You Reported	Your Liability
Within 3 working days of the SMS/email	Zero — the entire amount is the bank’s responsibility
Within 4–7 working days	Limited — a cap of ₹5,000–25,000 (by fraud type and card type)
After 7 working days	Per the bank’s board-approved policy (negotiable)
Bank’s own fault/system leak	Zero at any time

The fine condition: zero liability applies only when you were not negligent in the fraud — meaning you gave no one the OTP/PIN/CVV and did nothing on a phishing link. Even with negligence, reporting within 3 days limits the liability, though the bank can argue its case.

2. Step by Step: What to Do in the First Hour

1. Block the card immediately — via the app/net-banking/helpline. Blocking prevents further fraudulent transactions.
2. File a written report: on the bank’s fraud email or the app’s dispute option — transaction date-time-amount, UTR, and a clear statement: ‘I did not perform this transaction and have not shared any OTP/PIN.’ The date of the report is the basis for counting the 3-day window — keep proof.
3. File a cyber complaint: the 1930 helpline and cybercrime.gov.in — a fast complaint increases the chance of the money being intercepted (the holding mechanism).
4. Don’t delete the SMS/emails — the 3-day clock runs from the notification time; these are your evidence.
5. Demand provisional credit within 7 working days — RBI’s rule is that the disputed amount must be credited to your account even while the investigation continues.

3. What the Bank Must Do — and What You Can Demand

• Investigation in 10 working days: the bank will investigate and communicate the outcome; the burden of proving negligence is the bank’s, not yours.
• The silence rule: if the bank says ‘you were negligent’, it must prove it — you don’t have to prove your innocence.
• Reverse charges: interest/late fees on the fraudulent transaction (on credit cards) cannot be billed to you — the bank must reverse those too.

4. If the Bank Refuses — Escalation Matrix

1. Written complaint to the grievance cell — keep the report number.
2. Nodal Officer — if unresolved within 30 days.
3. RBI Ombudsman (cms.rbi.org.in) — free of cost; attach: proof of the report date (meeting the 3-day limit), SMS notifications, and correspondence with the bank.
4. Keep the cyber complaint (1930/cybercrime.gov.in) running in parallel to trace the fraud’s money flow.

5. Protecting Yourself Going Forward

• Keep international/online usage turned off on the card (toggle in the app) and enable it only when needed.
• Keep transaction alerts on via both SMS and email — the 3-day clock starts the moment the SMS arrives.
• Hide the CVV on the back of the card, and avoid card payments on public Wi-Fi.
• Reconcile your card statement line by line once a month.

---

Remember: in card fraud, timing is the biggest weapon — a written report within 3 working days means near-certain zero liability.

For failed UPI/ATM transaction rules, read the T+1 auto-refund guide, and for protecting your credit score, see the CIBIL dispute guide.