Unauthorised Transaction Complaint RBI: Liability and Burden

When a debit you never made appears in your statement, the bank's first instinct is to ask what you did wrong. The RBI's framework starts from the opposite premise: an unauthorised electronic transaction is the bank's problem first, and the customer's liability is limited by how quickly the loss was reported.

The unauthorised transaction complaint RBI framework sets out who bears the loss. This guide explains the liability rules that apply, the burden of proof, the turnaround times the bank must meet, and how to frame a complaint so that the liability question is answered on the record rather than in a call centre script.

What counts as an unauthorised electronic transaction

An unauthorised electronic transaction is one performed without the customer's consent and without the customer having initiated it. The RBI's customer protection directions define it by reference to the absence of authority, not by reference to the customer's mistake. A transfer made after a fraudster obtained an OTP by impersonation is unauthorised, even though the OTP was technically entered by the customer. A transfer made by a person who took the customer's phone and used the saved UPI PIN is unauthorised. A transfer the customer deliberately made to a person who later cheated them is a different category — that is a dispute with the beneficiary, not an unauthorised transaction, and the bank's role changes.

Getting this distinction right in the complaint matters. If you describe a commercial dispute as an unauthorised transaction, the bank will investigate it as a fraud claim and reject it because you authorised the payment. If you describe a genuine fraud as a commercial dispute, you lose the protection of the liability framework.

The unauthorised transaction complaint RBI liability ladder

The RBI's directions on limiting customer liability in unauthorised electronic banking transactions set out a graded structure. The exact figures and conditions are in the master direction and the harmonisation circular, and they are updated from time to time, so confirm the current text before you rely on a specific number in a complaint. The structure is this:

The commonly cited cap for reporting between the fourth and seventh working day is ₹10,000 or the transaction value, whichever is lower. Treat that figure as a starting point and verify it against the current master direction, because the directions have been revised and the applicable cap depends on the channel and the date of the transaction.

Where the customer has zero liability

Zero liability applies where the fraud is not attributable to the customer and the loss is reported within three working days. It also applies, regardless of the reporting delay, where the loss arises from a bank-side failure: a counterfeit card used at a terminal, a system breach at the bank or the payment network, or a transaction completed after the customer had already blocked the card or reported the fraud. In those cases the loss is borne by the bank or the network, not the customer.

Where the customer shares liability

Liability shifts to the customer where the loss is attributable to the customer's negligence — writing the PIN on the card, storing it in a phone note, sharing the OTP with a caller, or leaving a session open on a shared device. Even then, the bank cannot simply assert negligence; it must show it, and the framework requires the bank to investigate and give reasons.

The burden of proof sits with the bank

This is the part customers most often miss. The bank must prove that the transaction was authorised by the customer, or that the customer's negligence caused the loss. It cannot discharge that burden by pointing to a correct PIN entry. The directions require the bank to examine the transaction's characteristics — the beneficiary, the amount, the time, the device, the IP address, the location — and to determine whether they are consistent with the customer's usual pattern.

A ₹1,80,000 transfer at 2:14 am from a device never used on the account, to a beneficiary added ten minutes earlier, is not a normal transaction even if the PIN was correct. The complaint should list these anomalies and demand that the bank address them. If the bank's rejection letter does not engage with them, the rejection is weak on its face and the Ombudsman can be asked to set it aside.

Turnaround times the bank must meet

The RBI's harmonisation directions prescribe timelines for customer service requests and complaints. For unauthorised transactions, the bank must acknowledge the report promptly, investigate, and communicate its decision within the prescribed period. The framework also provides for compensation where a failed transaction is not reversed within the specified turnaround time — the delay compensation is calculated per day of delay, subject to the cap in the directions.

Practically, this means three things for your complaint:

• Ask for written acknowledgement with a ticket number on the day you report.
• Ask for the decision within the prescribed period and state that you will escalate if it is not received.
• If a failed or disputed transaction is not reversed within the turnaround time, claim the delay compensation as part of the complaint — it is a separate entitlement from the refund.

How to frame the complaint

The complaint should read as a set of facts the bank must answer, not as a request for sympathy. A structure that works:

1. Account and transaction particulars — account number, disputed transactions in a table, total amount.
2. Statement of non-authorisation — a clear declaration that you did not initiate the transaction and did not receive the goods or services.
3. The circumstances — how the fraudster obtained access, in chronological order, without exaggeration.
4. The anomalies — device, location, time, beneficiary age, amount relative to your usual pattern.
5. The reporting timeline — date and time of the 1930 call, the portal complaint, the bank call and the written complaint, each with its reference.
6. The request — refund, chargeback, freeze, logs, written decision, delay compensation.
7. The consequence — a sentence stating that you will escalate to the RBI Integrated Ombudsman and file a police complaint if the matter is not resolved within the prescribed period.

If the bank imposes liability on you

A decision imposing liability must be in writing and must give reasons. Read it against the framework and ask three questions: did the bank identify which limb of the liability ladder it applied; did it explain why the transaction is attributable to your negligence; and did it address the anomalies you raised. If the answer to any of these is no, the decision is open to challenge.

The challenge goes to the RBI Integrated Ombudsman Scheme, 2021. File through the RBI's complaint management system with the original complaint, the bank's decision, the transaction records, the police complaint and your anomaly list. The Ombudsman can direct the bank to refund the amount and pay compensation, and the process is free. Where the Ombudsman's award is not acceptable, the consumer commission or a civil suit remains available.

For digital payment disputes, the RBI also operates an online dispute resolution mechanism for digital payments, which allows a complaint to be taken through mediation and adjudication by an institutional mechanism without going to court. It is intended for exactly these disputes and is worth using where the amount is modest and the facts are documentary.

Evidence that decides the liability question

• Transaction logs — the bank holds the authentication records, device identifiers, IP addresses and timestamps. Ask for them in writing; they are the primary evidence and the bank cannot decide the case without disclosing them if you dispute the finding.
• Your own device records — the phone's call log, the SMS inbox showing the phishing message, the app's notification history.
• The beneficiary's account behaviour — whether the beneficiary account was newly opened or received multiple small credits, which the bank can see and you cannot.
• Your banking pattern — statements for the preceding six months showing that the disputed transaction is unlike your normal activity.
• Reporting records — the 1930 reference, the portal acknowledgement and the bank ticket, each with a timestamp.

Frequently asked questions

Does zero liability apply if I shared the OTP?

Sharing an OTP is generally treated as customer negligence, which can shift liability to you. But the bank must still prove that the loss resulted from that negligence and must consider whether its own systems failed to flag an anomalous transaction. The facts of how the OTP was obtained — impersonation, a fake bank website, a screen-sharing app — are central to the finding.

Who decides whether a transaction was authorised?

The bank decides in the first instance, on the evidence it holds. That decision is reviewable by the Ombudsman and, ultimately, by a consumer commission or a civil court. The bank's decision is not final merely because it is in writing.

Can I claim compensation for the delay in refund?

Yes. The harmonisation directions provide for delay compensation on failed transactions, and the Ombudsman can award compensation for the deficiency. Plead it separately from the refund so that the two claims are not conflated.

What is the difference between a chargeback and an Ombudsman complaint?

A chargeback is a network-level dispute raised by your bank against the beneficiary bank to reverse the credit. An Ombudsman complaint is a regulatory adjudication of your bank's handling of the dispute. The chargeback recovers the money if it is still available; the Ombudsman decides who must bear the loss. Use both, in that order.

What if the disputed amount is very small?

The framework applies regardless of amount, but the effort of escalation may exceed the loss. For small amounts, the written complaint and the bank's internal grievance route are usually sufficient; the Ombudsman route is free but takes time. Where the same fraudster has taken small amounts from many people, a group complaint to the cyber cell is more effective than individual escalation.

Drafting Support

Our drafting team prepares unauthorised transaction complaints that map the facts to the RBI liability ladder — anomaly schedules, log requests, and Ombudsman representations with the evidence index.