Noticed a credit or debit card transaction that you did not make or authorise? Report it quickly. How the transaction occurred and when it was reported can affect the customer’s liability.
Don’t recognise a card transaction? Report it immediately.
If you see a credit or debit card transaction that you did not make or authorise, report the unauthorised transaction to your bank or card issuer immediately.
What should you do now?
Report the transaction
Use a verified official reporting channel of your bank or card issuer. Clearly identify the transaction that you are reporting as unauthorised.
Secure the card
Block or secure the affected card if there is any possibility that the card or its details have been compromised.
Check for other transactions
Review recent card activity carefully. There may be more than one transaction that you do not recognise.
Keep proof of reporting
Preserve the complaint or reference number, acknowledgement, relevant SMS or email, and the date and time when you reported the transaction.
Who bears the loss?
RBI’s customer-protection framework treats the customer’s liability differently depending on how the unauthorised transaction occurred.
Bank is at fault
Where the unauthorised transaction occurs because of contributory fraud, negligence or deficiency on the part of the bank, the customer has zero liability, irrespective of whether the transaction was reported by the customer.
Neither is at fault
Where the fault lies neither with the bank nor with the customer, but elsewhere in the system, the timing of the customer’s reporting becomes important in determining liability.
Customer negligence
Where the loss is due to customer negligence, such as sharing payment credentials, the customer bears the loss until the unauthorised transaction is reported to the bank. Any loss occurring after reporting is borne by the bank.
How does the 3-working-day rule work?
Where the unauthorised transaction results from a third-party breach and the deficiency lies neither with the bank nor with the customer, RBI’s framework links customer liability to the reporting period.
The 3-working-day rule is not a universal refund guarantee. It applies to the third-party-breach situation described above. Different rules apply where the bank is at fault or where the loss results from customer negligence.
For this rule, RBI measures the reporting period from the customer’s receipt of the bank’s communication regarding the unauthorised transaction. The date of receipt of that communication is excluded while calculating the number of working days.
Working days are counted according to the working schedule of the customer’s home branch.
Do not wait for the 3-working-day period to expire. If you become aware of an unauthorised transaction, report it immediately.
What is the maximum liability, if reported, within 4–7 working days?
In a qualifying third-party breach where neither the bank nor the customer is at fault, reporting within 4–7 working days can result in limited customer liability.
The liability is the transaction value or the applicable RBI monetary limit, whichever is lower.
| Card / underlying account | Maximum liability |
|---|---|
| Debit card linked to a Basic Savings Bank Deposit (BSBD) Account | ₹5,000 |
| Debit card linked to another Savings Bank account | ₹10,000 |
| Credit card with limit up to ₹5 lakh | ₹10,000 |
| Credit card with limit above ₹5 lakh | ₹25,000 |
A debit card does not have one universal RBI liability cap. The applicable limit depends on the type of account to which the debit card is linked. Other account categories covered by RBI can have different limits.
Remember: These monetary limits apply to the 4–7-working-day situation where the responsibility for the unauthorised transaction lies neither with the bank nor with the customer, but elsewhere in the system. They are not universal limits for every unauthorised transaction.
How does the cap work?
Example 1 — Transaction below the cap
Credit-card limit: ₹3 lakh
Unauthorised transaction: ₹7,000
Applicable RBI cap: ₹10,000
Maximum customer liability: ₹7,000
The transaction itself is lower than the applicable ₹10,000 cap.
Example 2 — Transaction above the cap
Credit-card limit: ₹3 lakh
Unauthorised transaction: ₹40,000
Applicable RBI cap: ₹10,000
Maximum customer liability: ₹10,000
The applicable RBI cap is lower than the transaction value.
What happens after you report the transaction?
Reporting the unauthorised transaction starts an important regulatory timeline for the bank.
Within 10 working days
On being notified by the customer, the bank must credit the amount involved by way of shadow reversal within 10 working days from the date of notification, without waiting for settlement of an insurance claim, if any.
Within 90 days
The complaint must be resolved and customer liability, if any, established within the period specified in the bank’s Board-approved policy, but that period cannot exceed 90 days from receipt of the complaint.
What is a shadow reversal?
It is a credit of the disputed amount while customer liability is being determined. The credit must be value-dated to the date of the unauthorised transaction. A shadow reversal should not be confused with the bank having finally accepted the customer’s claim.
What about interest while the complaint is being decided?
Debit card / bank account
The customer should not suffer loss of interest because of the unauthorised transaction.
Credit card
The customer should not bear any additional burden of interest because of the unauthorised transaction.
Who has to prove customer liability?
RBI places the burden of proving customer liability on the bank.
The customer should still cooperate with the bank’s investigation and preserve relevant records, including transaction alerts, complaint acknowledgements and correspondence relating to the disputed transaction.
Common situations
My card is still with me. Can the transaction still be unauthorised?
Yes. Physical possession of the card does not rule out an unauthorised transaction. Card details can potentially be compromised or used without the physical card being lost.
If the transaction remains unrecognised, report it immediately and secure the card if compromise is suspected.
I did not receive an SMS or transaction alert. What should I do?
Mention this specifically when reporting the transaction to the bank.
For a qualifying third-party breach, RBI’s 3-working-day period is linked to receipt of the bank’s communication regarding the unauthorised transaction.
Do not delay reporting once you become aware of the transaction.
I shared an OTP, PIN or other payment credential. Is my claim automatically rejected?
Not automatically. RBI treats losses caused by customer negligence, such as sharing payment credentials, differently.
In such a case, the customer bears the loss occurring until the unauthorised transaction is reported to the bank. Any loss occurring after reporting is borne by the bank.
RBI also permits banks, at their discretion, to waive customer liability even in cases of customer negligence.
There are several unauthorised transactions. What should I report?
Report all the transactions that you do not recognise, not merely the first one noticed.
Secure the affected card and review recent activity carefully for any additional transactions.
The bank says the transaction was authenticated. Does that automatically make me liable?
Not necessarily. Authentication information can be relevant to the bank’s investigation, but customer liability under RBI’s framework depends on the circumstances of the unauthorised transaction and the applicable liability rules.
RBI places the burden of proving customer liability on the bank.
I don’t recognise the merchant name. Is it definitely fraud?
Not always. The merchant name appearing on a card statement can sometimes differ from the shop, app or service name familiar to the customer.
Check whether it could relate to your own purchase, subscription, recurring payment or an authorised/add-on cardholder. If it remains unrecognised, do not delay reporting it merely because the merchant description is unfamiliar.
Suspect cyber fraud?
If the unauthorised transaction appears to involve cyber fraud, take the appropriate cyber-fraud reporting steps as well.
Reporting cyber fraud does not replace reporting the unauthorised transaction to your bank or card issuer.
What if the bank rejects the claim or the matter remains unresolved?
Keep the bank’s response
Preserve the complaint/reference number, acknowledgements, correspondence and the bank’s written decision or response.
Use the bank’s escalation process
Escalate through the bank’s official grievance-redressal channels. BankBodh’s Bank Complaint Directory can help you locate the appropriate bank-specific complaint and escalation channels.
RBI Ombudsman
Where eligible, the customer can approach the RBI Ombudsman after first complaining to the bank. The applicable waiting period may depend on RBI, NPCI or card-network timelines. If the bank has already replied or resolved the complaint and the customer is dissatisfied, the customer may approach the Ombudsman subject to the Scheme’s requirements.
Related BankBodh help
Official RBI references
- Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions
- RBI Credit Card and Debit Card — Issuance and Conduct Directions
- RBI Complaint Management System (CMS)
Last regulatory verification: September 2026
Banking rules, contact details and procedures can change. If you notice something outdated, incorrect, unclear or missing, or have an idea that could improve BankBodh, please let us know.
If you need further clarification or want to suggest a related question for BankBodh, write to us at hello@bankbodh.com .