Legal Notice to Bank for Fraud and Unauthorised Transactions

The message arrives at 2:14 am: six debits from an account the customer did not touch, each routed through a payment gateway she has never used. By morning the balance is gone. The bank's first response is that the transactions were authenticated with an OTP, so the customer must have shared it. The second is that the complaint was filed after the deadline. Neither answer is necessarily correct, and both are worth challenging in writing. A legal notice to bank for fraud is how that challenge begins.

Bank fraud and unauthorised electronic transactions sit at the intersection of contract, consumer protection and criminal law. The customer has rights under the Reserve Bank of India's customer protection framework, under the Consumer Protection Act 2019, and under the Information Technology Act 2000 where identity credentials were misused. The notice is the document that puts the bank on formal notice, starts the clock on its internal complaint process, and preserves the record needed for the banking ombudsman or a consumer commission.

Legal notice to bank for fraud: what the notice must establish

The bank's standard defence is contributory negligence: the customer shared an OTP, clicked a phishing link, or failed to report the loss in time. The notice must therefore establish four facts with documents. First, that the customer did not authorise the transactions. Second, that the customer reported the loss promptly. Third, that the bank's own systems or staff failed in some identifiable way. Fourth, that the loss is quantifiable to the rupee.

The promptness point is decisive. Under the RBI's framework for limiting customer liability in unauthorised electronic banking transactions, the customer's liability depends on how quickly the unauthorised transaction is reported after it appears in the statement. Where the fraud is due to the bank's own systems or the customer has not shared credentials, the customer's liability is nil. Where the customer shared credentials, the liability is limited and depends on the reporting delay. The notice should set out the date and time of each report — the call to the helpline, the email, the branch visit — with the reference numbers.

The RBI liability framework in practice

The Reserve Bank of India has issued directions on customer protection for unauthorised electronic banking transactions. The framework distinguishes between fraud caused by the bank's own systems or staff, fraud where the customer shared credentials, and fraud through a third-party breach where neither the bank nor the customer was at fault. The liability allocation differs in each case, and the reporting delay determines how much of the loss the customer bears.

The framework also requires banks to provide a 24-hour helpline, to acknowledge a complaint within a specified period, and to resolve it within a defined timeline. Where the bank fails to resolve the complaint within the stipulated period, the customer can escalate to the RBI's Integrated Ombudsman Scheme 2021. The notice should reference the bank's failure to comply with these directions, because the ombudsman treats non-compliance as a significant factor.

Where the customer shared an OTP

OTP sharing is the most contested issue in Indian banking fraud claims. Banks argue that an OTP-authenticated transaction is authorised by definition. Customers argue that they were deceived into sharing the OTP by a fraudster impersonating the bank. The distinction matters: if the customer was tricked, the transaction was not authorised by the customer in the legal sense. The notice should set out the deception in detail — the call, the caller's claims, the sequence of instructions — and state that the customer did not intend to authorise the transaction.

Where the customer genuinely shared an OTP knowing what it was for, the claim is weaker, and the notice should focus on the bank's failure to flag an anomalous transaction, such as a large debit to a newly added beneficiary immediately after a SIM swap or a password change.

Account takeover and SIM swap fraud

SIM swap fraud occurs when a fraudster obtains a duplicate SIM from the telecom operator and intercepts the OTPs. In that case the customer did nothing wrong; the failure lies in the telecom operator's verification process and in the bank's failure to detect the change in device or location. The notice should demand the bank's internal logs of the transaction — IP address, device identifier, beneficiary addition history and OTP delivery records — because those logs will show whether the bank's systems flagged the anomaly.

Essential contents of the notice

The notice should be drafted on the customer's advocate's letterhead and addressed to the bank's principal officer, with a copy to the branch manager and the nodal officer for customer grievances. The following contents are standard.

• Customer and account particulars. Name, account number, branch, and the contact details registered with the bank.
• Transaction details. Date, time, amount, channel and beneficiary for each unauthorised debit, taken from the statement.
• Absence of authorisation. A statement that the customer did not initiate the transactions and did not receive the goods or services paid for.
• Reporting history. The date, time and mode of each report to the bank, with the complaint or ticket reference numbers.
• Bank's response. What the bank said, when it said it, and why the response is inadequate.
• Account freeze and reversal requests. A demand to freeze the beneficiary account if the funds have not been withdrawn, and to credit the amount back.
• Liability allocation. A reasoned statement that the customer's liability is nil or limited under the RBI framework, with the reasons.
• Compensation. A demand for interest, compensation for mental agony and the cost of the correspondence, with the basis.
• Deadline and consequence. Typically fifteen days, failing which a complaint will be filed with the RBI Ombudsman and the consumer commission.
• Reservation of rights. A clause preserving the right to file a criminal complaint for cheating and identity theft, and to claim damages.

Enclosures should include the bank statement highlighting the debits, the complaint acknowledgements, screenshots of the SMS and email alerts, the FIR or police complaint copy if filed, and the customer's identity proof to establish that the account was operated by the account holder.

Criminal remedies and the police complaint

Unauthorised use of another person's electronic credentials is a criminal offence. Under the Information Technology Act 2000, identity theft and cheating by personation using a computer resource are punishable offences. The Bharatiya Nyaya Sanhita 2023 covers cheating and criminal breach of trust, and the Bharatiya Nagarik Suraksha Sanhita 2023 governs the procedure for filing and investigating the complaint.

In practice, the customer should file a complaint with the cyber crime cell or the local police station as soon as the fraud is detected, and should include the transaction details and the bank complaint reference. The police complaint number should be quoted in the notice to the bank. Where the bank refuses to cooperate, the police complaint becomes the document that establishes that the customer acted promptly and in good faith.

Stamp duty, service and limitation

Stamp duty on a notice to a bank varies by state and is generally nominal or nil. The requirement should be confirmed with the sub-registrar or the local bar. Registration is not required. Serve the notice by registered post with acknowledgement due to the bank's registered or corporate office, by speed post to the branch, and by email to the nodal officer's published address. Banks are required to maintain a designated grievance redressal mechanism, and the notice should be sent to the address published for that purpose.

Limitation is generally three years from the date the customer knew of the unauthorised transaction. The clock does not pause while the bank's internal complaint is pending, although the ombudsman route may extend the practical timeline. Customers should send the notice within weeks of the fraud, not months, because the RBI framework itself makes prompt reporting the basis of the liability allocation.

Common mistakes customers make

The first is reporting only by phone. A phone call leaves no reliable record unless the customer notes the time, the executive's name and the reference number. The report should be confirmed by email the same day. The second is continuing to use the compromised account, card or credentials after the fraud. That conduct supports the bank's argument that the customer did not treat the matter as urgent.

The third is accepting the bank's first refusal as final. Most banks initially reject the claim and reverse the decision only when the customer escalates with documentation. The fourth is failing to file a police complaint, which the bank often requires before processing the reversal. The fifth is claiming an amount that does not match the statement. The sixth is missing the ombudsman's time limits after the bank's final response.

Frequently asked questions

Who is liable for an unauthorised transaction in India?

Liability is allocated under the RBI's customer protection framework. Where the fraud is due to the bank's own systems or staff, or where the customer has not shared credentials, the customer's liability is nil. Where the customer shared credentials, the liability is limited and depends on how quickly the transaction was reported after it appeared in the statement.

What if the bank says the OTP was shared, so the transaction was authorised?

Sharing an OTP under deception is not the same as authorising the transaction. The notice should set out how the customer was tricked, and should demand the bank's logs to show whether the transaction was anomalous. Regulators have repeatedly held that banks cannot escape liability merely because an OTP was used.

Should I file an FIR before sending the notice?

It is advisable to file the police complaint as soon as the fraud is detected, and to quote the complaint number in the notice. The bank frequently asks for it before processing a reversal. The notice and the police complaint can proceed in parallel; neither depends on the other.

How do I escalate to the RBI Ombudsman?

First exhaust the bank's internal grievance process and obtain its final written response. Then file a complaint under the RBI Integrated Ombudsman Scheme 2021 through the online portal, attaching the bank's response and the transaction records. The scheme is free and does not require a lawyer, though a drafted notice makes the complaint file stronger.

Can I claim compensation for mental agony?

Yes, in an appropriate case. The consumer commission can award compensation for deficiency in service, including mental agony and litigation costs. The notice should quantify the claim with a basis rather than stating an arbitrary figure. Compensation is usually modest relative to the amount lost.

What documents should I preserve?

Keep the bank statement showing the debits, all SMS and email alerts, the complaint acknowledgements with timestamps, the police complaint copy, and any correspondence with the bank. If the fraud involved a phone call, note the number and the time. Do not delete the messages or the app notifications; they are evidence.

Drafting Support

Our drafting team prepares notices to banks for unauthorised transactions with the transaction ledger, the reporting timeline and the liability argument set out, so the complaint file is ready for the ombudsman.