Online Banking Fraud Refund: RBI Rules & Legal Rights in India

By Adv. Tarun Choudhury
Supreme Court Advocate | 25+ Years of Legal Experience

Losing money through online banking fraud can be devastating. For some people, it represents their life savings. For others, it may be money reserved for medical treatment, children’s education, retirement or business expenses.

The situation becomes even more frustrating when the bank refuses to refund the amount. Customers are often told that the transaction was authenticated using an OTP, password or other banking credentials. The bank may then suggest that the customer must have shared confidential information, even when the customer denies authorising the transaction.

Can a Bank Refuse a Refund for Online Banking Fraud?

But does the use of an OTP automatically make a customer responsible for online banking fraud? Can a bank refuse a refund merely because its computer system processed the transaction? And what can a customer do when the bank fails to resolve a genuine complaint?

RBI Rules on Customer Liability for Unauthorised Electronic Transactions

Indian banking regulations provide important protections against qualifying unauthorised electronic transactions. Depending on the facts, a customer may be entitled to zero or limited liability, a reversal of the disputed amount and further legal remedies if the bank fails to apply the relevant rules.

Bombay High Court Judgment on Online Banking Fraud Refund

A significant judgment on this issue is Subodh C. Korde v. Union of India & Ors., 2026 SCC OnLine Bom 1009, decided by the Bombay High Court on 6 April 2026. The Court directed HDFC Bank to refund ₹38.04 lakh to a customer, with interest, after examining the unauthorised transactions and the applicable RBI directions.

Your Legal Rights, Immediate Steps and Remedies Against the Bank

This article explains your legal rights, the RBI’s customer-liability framework, the steps to take immediately after discovering fraud, and the remedies available when a bank refuses to refund your money.

1. Can You Get a Refund After Online Banking Fraud?

Yes, you may be entitled to a refund when money has been debited through an unauthorised electronic banking transaction. However, recovery is not automatic in every case of online fraud.

The first question is whether the transaction was genuinely unauthorised and which party bears responsibility for the loss.

Consider a customer who discovers that several transfers have been made from their bank account during the night. The customer did not initiate the transactions, add the beneficiaries or knowingly approve the payments.

The fraud may have involved a compromised bank account, SIM-swap fraud, malware, identity theft or another security breach.

In such a situation, the customer should not assume that the money is permanently lost merely because the bank’s system processed the transactions.

The Reserve Bank of India has issued specific directions governing customer liability in unauthorised electronic banking transactions. These directions establish circumstances in which a customer may have zero or limited liability.

The principal reference for customers of banks covered by the circular is the RBI notification dated 6 July 2017, titled Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions.

Read the official RBI circular on customer liability in unauthorised electronic banking transactions.

The important point is that a bank should examine the facts and apply the relevant regulatory provisions. It should not automatically treat every disputed electronic transaction as the customer’s responsibility simply because its system recorded a successful authentication.

2. Bombay High Court Orders Refund of ₹38.04 Lakh in Online Banking Fraud Case

The Bombay High Court’s decision in Subodh C. Korde v. Union of India & Ors., 2026 SCC OnLine Bom 1009, is an important judgment for customers disputing unauthorised electronic transactions.

The case concerned unauthorised withdrawals totalling ₹38,04,000 from two bank accounts maintained with HDFC Bank.

What Happened in the Case?

The petitioner, Subodh C. Korde, approached the Bombay High Court after the disputed transactions were not reversed by the bank.

According to the judgment, eight unauthorised transactions took place within approximately 41 minutes. The sequence involved changes relating to beneficiaries and transaction limits. The petitioner disputed having authorised the transactions and maintained that he had not received the expected OTPs.

The money was transferred to accounts held by alleged fraudsters. The dispute also raised questions about the response of the banks involved and the application of the RBI’s customer-protection directions.

The bank disputed liability. The Court examined the material before it, the applicable RBI framework and whether the customer could properly be held responsible for the loss.

Also Read: Cyber Crime & Online Fraud in India: UPI Fraud, Hacking & Digital Arrest.

What Did the Court Decide?

The Bombay High Court directed HDFC Bank to refund ₹38.04 lakh within eight weeks, with interest at 6% per annum. The order provided for interest at 8% per annum if the bank failed to comply within the specified period.

The judgment is significant because it demonstrates that a bank’s refusal to reverse disputed transactions is not necessarily the end of the matter. The applicable regulatory framework and the evidence must be examined.

Why Is This Judgment Important for Customers?

There are three practical lessons.

First, the Bank’s Initial Decision Can Be Challenged

A customer should examine the reasons for rejection and compare them with the relevant RBI directions.

Second, Authentication Records Are Not Necessarily the Whole Story

Whether a customer can be held liable must be assessed under the applicable rules and the evidence. The fact that a transaction was processed using banking credentials does not, by itself, resolve every question about authorisation and negligence.

Third, Judicial Relief May Be Available in an Appropriate Case

Where the bank has failed to apply the relevant regulatory obligations, a customer may have grounds to seek relief through the appropriate legal forum.

The decision is fact-specific. It does not establish that every victim of online fraud will automatically receive a full refund or that every dispute with a private bank can be brought directly before a High Court.

Nevertheless, it is a valuable precedent for understanding the importance of the RBI’s customer-protection framework.

Read the Bombay High Court judgment in Subodh C. Korde v. Union of India & Ors..

3. What Does the RBI Say About Zero Liability?

The RBI circular dated 6 July 2017 sets out circumstances in which a customer’s liability for an unauthorised electronic banking transaction may be zero or limited.

The distinction between the categories is essential.

A. Zero Liability When the Bank Is Responsible

Paragraph 6(i) of the circular provides for zero customer liability where an unauthorised transaction occurs because of contributory fraud, negligence or deficiency on the bank’s part.

The circular states that this protection applies irrespective of whether the customer reports the unauthorised transaction.

This does not mean that a customer should delay reporting the incident. Immediate reporting remains essential to secure the account, preserve evidence and prevent further loss.

The legal point is that, where the relevant bank-side failure is established, the customer’s protection under this provision does not depend solely on how quickly the transaction was reported.

B. Zero Liability in Qualifying Third-Party Breaches

Paragraph 6(ii) deals with cases in which the deficiency lies neither with the bank nor with the customer, but elsewhere in the system.

In such a case, the circular provides for zero liability if the customer notifies the bank within three working days of receiving communication from the bank about the unauthorised transaction.

This condition is frequently misunderstood.

The three-working-day period is not a universal 72-hour deadline measured from the time the money was stolen. The circular links the reporting period to receipt of the bank’s communication about the unauthorised transaction.

The applicable rules on working days must also be considered.

C. What If the Customer Reports the Fraud After Three Working Days?

The RBI circular provides a separate framework for qualifying third-party breach cases reported after the initial three-working-day period.

Where the customer reports the transaction within four to seven working days, liability is generally limited to the transaction value or the prescribed ceiling, whichever is lower.

The prescribed ceiling depends on the type of account or facility. The circular specifies different limits for certain basic savings accounts, other savings accounts, specified current accounts, MSME accounts and credit cards.

Where reporting takes place beyond seven working days, the bank’s board-approved policy becomes relevant under the circular.

These provisions must be applied to the circumstances of the particular case. The type of account, nature of the transaction, source of the breach and customer’s conduct all matter.

Summary of RBI Customer Liability Rules

Situation	Applicable Rule	Important Point
Unauthorised transaction caused by bank fraud, negligence or deficiency	Zero customer liability under the relevant provision	Applies irrespective of whether the customer reports the transaction.
Qualifying third-party breach reported within three working days of receiving the bank’s communication	Zero customer liability	The reporting period is linked to the bank’s communication about the unauthorised transaction.
Qualifying third-party breach reported within four to seven working days	Limited customer liability	Liability is generally capped at the transaction value or the prescribed ceiling, whichever is lower.
Qualifying third-party breach reported beyond seven working days	The bank’s board-approved policy becomes relevant	The applicable policy and circumstances of the case must be examined.

Practical advice: Report suspected fraud immediately. Do not wait to decide which category applies before informing the bank.

The official RBI customer-protection circular should be consulted when assessing an individual claim.

4. Does the Use of an OTP Automatically Make the Customer Liable?

Banks sometimes reject fraud complaints by pointing out that the disputed transactions were authenticated through an OTP, password, customer ID or other credentials.

However, the existence of an authentication record should not automatically end the legal inquiry.

The relevant questions may include:

• Did the customer actually initiate or authorise the transaction?
• Was the OTP received by the customer?
• Was the registered SIM card compromised or subjected to an unauthorised SIM swap?
• Were unfamiliar beneficiaries added to the account?
• Was the transaction limit changed unexpectedly?
• Were there unusual transactions inconsistent with the customer’s established banking behaviour?
• Did the bank’s security systems detect suspicious activity?
• What do the bank’s logs, telecom records and investigation reports establish?
• Has the bank produced evidence supporting its allegation of customer negligence?

Who Has the Burden of Proving Customer Liability?

Paragraph 12 of the RBI circular places the burden of proving customer liability in an unauthorised electronic banking transaction on the bank.

This does not mean that the bank must refund every disputed payment regardless of the evidence. Nor does it mean that an OTP is irrelevant.

It means that liability must be assessed under the applicable rules and on the evidence, rather than through an automatic assumption that successful authentication proves customer negligence.

If you did not knowingly authorise the transaction, explain the circumstances clearly and request that the bank preserve and examine the relevant electronic records.

5. What Is the Ten-Working-Day Rule for Refunds?

Paragraph 9 of the RBI circular contains an important provision concerning the reversal of unauthorised electronic transactions.

Under the circular, the bank is required to provide a shadow reversal within ten working days of receiving the customer’s notification, in accordance with the prescribed framework.

The bank is not permitted to wait for the settlement of an insurance claim before making the prescribed shadow reversal. The credit is to be value-dated as of the date of the unauthorised transaction.

Paragraph 10 also provides a framework for determining customer liability within the applicable period, which is not to exceed 90 days under the circular.

These provisions matter because a customer should not be left indefinitely without a decision while the bank continues its internal investigation.

However, the ten-working-day rule should be read alongside the circular’s provisions on liability and the circumstances of the transaction. It should not be represented as a guarantee that every online scam payment must be refunded within ten working days.

Where applicable, refer to paragraphs 9, 10 and 12 of the circular in your written representation to the bank.

Official reference: RBI circular on unauthorised electronic banking transactions.

6. What Should You Do Immediately After Discovering Online Banking Fraud?

The first priority is to stop further transactions, report the incident and create a reliable documentary record.

Step 1: Contact the Bank Immediately

Use the bank’s official fraud helpline, branch, mobile application or other official communication channel.

Ask the bank to:

• Secure the compromised banking facility.
• Block affected cards or digital banking access where necessary.
• Register a formal complaint about the unauthorised transactions.
• Provide a complaint or acknowledgement number.
• Initiate the applicable dispute and refund process.
• Preserve relevant transaction logs, authentication records and security alerts.

If you suspect that your mobile number or SIM card has been compromised, contact your telecom provider as well.

Step 2: Report the Cyber Financial Fraud

Call the national cybercrime helpline 1930 as soon as possible and report the incident through the National Cyber Crime Reporting Portal.

The official portal advises victims of cyber financial fraud to call 1930 for immediate reporting.

Provide accurate information about the disputed transactions, the amount lost, transaction reference numbers and the payment facility involved.

Keep the acknowledgement number and copies of your complaint.

Prompt reporting may help the authorities and participating financial institutions take steps to trace or restrict the movement of funds. Recovery is not guaranteed, but delay can reduce the practical opportunities for intervention.

Step 3: Lodge a Police Complaint or FIR Where Appropriate

Give the police a clear account of the incident, including the dates, times, amounts, transaction IDs and suspicious calls, messages, links or applications involved.

Provide copies of the bank complaint and cybercrime acknowledgement.

Preserve messages, call records, emails and other electronic evidence that may help establish what happened.

Step 4: Send a Written Complaint to the Bank

A telephone call is useful for immediate action, but a detailed written complaint is also important.

State that the disputed transactions were unauthorised, explain when you discovered them and identify when you notified the bank.

Request a reasoned written decision addressing the applicable RBI directions. If the bank alleges that you shared credentials or were negligent, ask it to explain the evidence supporting that conclusion.

Attach relevant supporting documents. Never disclose your passwords, PINs or confidential authentication information in a complaint.

Step 5: Preserve the Evidence

Keep copies of:

• Bank statements showing the disputed debits.
• SMS messages, emails and transaction notifications.
• Bank complaint acknowledgements and replies.
• Cybercrime reporting acknowledgements.
• Police complaints or FIR details, where available.
• Relevant telecom-provider records.
• Screenshots and other evidence of suspicious activity.
• Correspondence with the bank and its grievance officers.

A well-organised record can strengthen your case if the dispute moves to the next stage.

7. How to Challenge a Bank That Refuses to Refund Your Money

If the bank rejects the complaint or fails to resolve it satisfactorily, consider escalating the dispute through the appropriate regulatory or legal channel.

The correct remedy depends on the facts, the bank’s response and the relief being sought.

A. Escalate the Complaint Within the Bank

If the branch or customer-service department has rejected the claim, send a detailed representation to the bank’s designated grievance officer or other appropriate higher-level authority.

Identify the disputed transactions, the applicable RBI provisions, the evidence supporting the complaint and the specific relief sought.

A focused complaint explaining why the bank’s decision is inconsistent with the applicable rules is generally more useful than a general allegation of unfair treatment.

B. Approach the RBI Ombudsman

The RBI Ombudsman mechanism provides a route for eligible complaints concerning deficiency in service by regulated entities covered by the applicable scheme.

The Reserve Bank–Integrated Ombudsman Scheme, 2026 (RB-IOS, 2026) came into force on 1 July 2026 and replaced the 2021 scheme for new complaints. The RBI has clarified that complaints received before that date, appeals arising from decisions under the earlier scheme and execution of awards issued under it continue to be governed by the 2021 scheme and relevant RBI instructions.

Ordinarily, a customer must first complain to the bank or other regulated entity.

If the entity does not respond within 30 days, or the customer is dissatisfied with the response, the complaint may be eligible for escalation under the applicable scheme, subject to its other requirements and exclusions.

The applicable filing period and procedural conditions should be checked before submission.

Complaints can be submitted through the RBI Complaint Management System.

When filing, include the bank complaint number, the bank’s response or evidence that no response was received, the transaction details, supporting documents and the relief requested.

The Ombudsman route can be useful where the customer believes that the bank has failed to apply RBI directions or has otherwise provided deficient service. However, the availability of relief depends on the applicable scheme and the facts of the complaint.

C. Consider a Consumer Complaint

A customer may consider proceedings under the Consumer Protection Act, 2019, where the facts support a claim of deficiency in service and the complaint is maintainable under the applicable law.

The case may require examination of the bank’s conduct, its regulatory obligations, the evidence relating to the disputed transactions and the loss suffered.

The appropriate forum, limitation period and relationship between different proceedings should be assessed before filing.

A consumer complaint is not an automatic route to a refund. The customer must establish the relevant legal grounds and support them with evidence.

D. Consider a Writ Petition Under Article 226

In appropriate circumstances, a customer may consider approaching a High Court under Article 226 of the Constitution of India.

The Bombay High Court’s decision in Subodh C. Korde illustrates that a writ petition can be entertained where the facts and the public-law element justify judicial review.

However, a writ petition is not automatically maintainable against every private bank merely because the bank is regulated by the RBI.

The nature of the duty sought to be enforced, the regulatory obligations involved, the availability of alternative remedies and the facts of the particular case all matter.

Before taking this route, obtain a legal assessment of whether writ jurisdiction is appropriate or whether another remedy would be more effective.

E. Consider Civil Proceedings Where Appropriate

Depending on the circumstances, civil proceedings or other legally available remedies may also need to be considered.

The appropriate course should be selected after examining the evidence, the bank’s position, the applicable limitation periods and the relief required.

The objective is not simply to file more complaints. It is to choose the remedy that is legally appropriate and supported by the evidence.

8. Is Every Online Scam Covered by the RBI Zero-Liability Rules?

No. This is one of the most important distinctions in online banking fraud cases.

There is a legal difference between an unauthorised transaction and a payment that the customer personally authorises after being deceived.

Example 1: Unauthorised Account Takeover

A fraudster gains access to a customer’s account and transfers money without the customer’s knowledge or authorisation.

The customer discovers the transactions and immediately informs the bank.

This may qualify as an unauthorised electronic banking transaction. The RBI’s customer-liability framework may apply, depending on the facts and applicable conditions.

Example 2: SIM-Swap Fraud

A criminal obtains control of a customer’s mobile number through a fraudulent SIM replacement and uses the compromised account or authentication process to transfer money.

The customer may have a claim under the applicable customer-protection rules. Telecom records, bank logs and evidence about the transactions may be particularly important.

Example 3: The Customer Shares Credentials

A customer knowingly shares an OTP, password or other confidential banking credential with a fraudster.

The bank may rely on this conduct when assessing liability. Under the RBI framework, customer negligence can affect liability until the unauthorised transaction is reported, subject to the applicable provisions.

Example 4: The Customer Personally Authorises a Payment After Deception

A fraudster impersonates a police officer, bank official or investment adviser and persuades the customer to transfer money to an account controlled by the fraudster.

Although the payment was induced by deception, the customer may have personally authorised the transfer.

The legal analysis can differ from a transaction executed without the customer’s authorisation. The RBI circular on unauthorised electronic banking transactions should not be assumed to guarantee a refund for every payment made under a scam.

The facts, payment mechanism, applicable regulatory framework and potential recovery remedies must be considered separately.

The first step in any online banking fraud refund claim is to establish exactly how the money left the account.

9. What Evidence Can Strengthen Your Refund Claim?

A strong claim rests on evidence, not merely on the assertion that fraud occurred.

Depending on the circumstances, the following material may be useful.

Type of Evidence	Relevant Records and Documents
Banking Records	Account statements, transaction reference numbers, beneficiary details and records showing when the disputed transfers occurred.
Authentication Records	Information about OTP generation and delivery, login activity, beneficiary additions, transaction-limit changes and relevant security alerts.
Telecom Evidence	Records relating to SIM replacement, loss of network access or other events that may help explain how the account was compromised.
Complaint Records	The time when the customer first notified the bank, complaint acknowledgements and subsequent communications.
Police and Cybercrime Records	Cybercrime acknowledgements, police complaints, FIR details where available and relevant investigation material.
Evidence of Customer Conduct	Material explaining whether the customer initiated, approved or knew about the disputed transactions, and whether any credentials were shared.

Request that the bank preserve relevant electronic records and explain the basis of its decision. Where necessary and legally appropriate, further evidence may be sought through the relevant proceedings.

Do not alter, delete or selectively present electronic material in a way that could undermine the credibility of your complaint.

10. Common Mistakes That Can Weaken an Online Banking Fraud Claim

Customers can avoid several common mistakes by acting promptly and keeping a clear record.

• Waiting Too Long to Report the Fraud: Delay may affect the applicable liability rules and reduce the opportunity to trace or restrict the funds.
• Relying Only on Telephone Calls: Written complaints create a record of what was reported, when it was reported and what action was requested.
• Accepting the Bank’s First Rejection as Final: Examine the reasons for rejection against the applicable RBI directions and the evidence.
• Assuming an FIR Guarantees a Refund: Criminal investigation and the bank’s obligations under customer-protection rules are related but distinct questions.
• Treating Every Scam Payment as an Unauthorised Transaction: A payment personally authorised under deception may require a different legal analysis.
• Ignoring Escalation Procedures and Deadlines: The applicable RBI scheme and other legal remedies have procedural requirements that must be checked carefully.
• Making Unsupported Allegations: Focus on the facts, documents and relevant legal provisions.

A carefully documented complaint is generally more effective than repeated complaints that do not address the bank’s stated reasons for rejecting the claim.

11. Frequently Asked Questions About Online Banking Fraud Refunds

Q1. Can I Get a Refund If Money Was Stolen From My Bank Account Without My Permission?

You may be entitled to a refund if the transaction qualifies as an unauthorised electronic banking transaction and the applicable customer-protection conditions are satisfied. The RBI’s circular dated 6 July 2017 provides for zero or limited customer liability in specified circumstances. The facts, reporting timeline and evidence must be examined before determining the outcome.

Q2. Is There a Three-Day Deadline to Report Online Banking Fraud?

The RBI circular provides for zero liability in qualifying third-party breach cases when the customer informs the bank within three working days of receiving communication from the bank about the unauthorised transaction. This is not a universal 72-hour deadline measured from the transaction date. Nevertheless, report suspected fraud immediately.

Q3. Can a Bank Refuse an Online Banking Fraud Refund Because an OTP Was Used?

The use of an OTP is relevant evidence, but it should not automatically end the inquiry into liability. The circumstances of authentication, the customer’s authorisation, the bank’s records and the applicable RBI directions must be considered. The circular places the burden of proving customer liability on the bank in cases covered by the relevant provision.

Q4. What Should I Do If My Bank Rejects My Online Banking Fraud Complaint?

Ask for a written decision and the reasons for rejecting the claim. Escalate the matter through the bank’s grievance-redressal mechanism. If eligible, consider a complaint under the applicable RBI Ombudsman Scheme. Depending on the facts, a consumer complaint, civil proceedings or a writ petition may also be considered after legal assessment.

Q5. Can I Approach the RBI Ombudsman for an Online Banking Fraud Refund?

You may be able to approach the RBI Ombudsman if the complaint concerns deficiency in service by a regulated entity covered by the applicable scheme and the procedural requirements are satisfied. Ordinarily, you must first complain to the bank and allow the prescribed response period or be dissatisfied with its response. Check the current scheme and filing requirements before proceeding.

Q6. Do I Need to File an FIR Before Claiming a Bank Refund?

A police complaint or FIR can be important evidence and may assist the investigation. However, the bank’s obligations under the applicable RBI customer-protection rules must be assessed on their own terms. Do not delay notifying the bank while waiting for an FIR to be registered.

Q7. Can I File a Case in the High Court Against a Bank That Refuses to Refund Fraud Money?

A writ petition under Article 226 may be considered in an appropriate case, particularly where a relevant public-law element exists. However, a writ petition is not automatically maintainable against every private bank. The facts, nature of the duty involved and available alternative remedies should be assessed before filing.

Q8. Will the Bank Have to Pay Interest on the Refunded Amount?

Interest may be available where the applicable legal provision or a court’s order supports it. In Subodh C. Korde v. Union of India & Ors., 2026 SCC OnLine Bom 1009, the Bombay High Court directed HDFC Bank to refund ₹38.04 lakh with interest at 6% per annum within eight weeks, increasing to 8% per annum if the bank failed to comply within that period. This direction was specific to that case and does not create an automatic interest entitlement in every fraud dispute.

Conclusion: Do Not Give Up Without Examining Your Legal Rights

When money disappears from a bank account, the first reaction is often fear. Frustration follows when the bank refuses to refund the amount.

But the bank’s first response does not necessarily settle the matter.

The RBI has prescribed a framework for determining customer liability in unauthorised electronic banking transactions. Where the relevant conditions are satisfied, a customer may have a legitimate claim for a refund. The bank’s records, the nature of the fraud, the reporting timeline and the evidence of customer conduct can all be important.

The Bombay High Court’s decision in Subodh C. Korde v. Union of India & Ors. reinforces the importance of examining these issues carefully.

At the same time, every online scam is not legally identical. A sound strategy begins by identifying the nature of the transaction, preserving the evidence and selecting the appropriate remedy.

If your bank has refused to refund money lost through an unauthorised transaction, do not assume that the matter is closed. Have the facts, documents and applicable RBI provisions examined before deciding your next step.

Need Legal Assistance for an Online Banking Fraud Refund?

If a substantial amount has been debited from your account without your authorisation, or your bank has rejected your refund request, a careful legal assessment may help you understand your options and determine the next steps worth considering.

The key questions include whether the transaction qualifies as unauthorised, whether the bank has correctly applied the RBI customer-protection directions, what the available evidence establishes and whether the matter should be escalated through the bank, the RBI Ombudsman or another appropriate legal forum.

Fraud Debit From Your Account? Act Within 72 Hours. Call for a Recovery Plan.

The 72-hour message is a practical urgency reminder, not a universal statutory deadline. Report suspected fraud immediately, even if more than 72 hours have already passed.

Adv. Tarun Choudhury
Supreme Court Advocate | 25+ Years of Legal Experience
Call: 9650499965
WhatsApp: 8851978611
Email: admin@legalserviceindia.com
Website: LegalServiceIndia.com

A case-specific review can help identify the applicable legal provisions, assess the bank’s response and determine the appropriate next step. No refund or recovery outcome can be guaranteed; the merits depend on the evidence and applicable law.

Key Takeaways: Online Banking Fraud Refund in India

• Online Banking Fraud Refund Eligibility: Online banking fraud victims may be entitled to a refund when money is lost through an unauthorised electronic banking transaction and the conditions under RBI’s customer-protection rules are satisfied.
• Zero Customer Liability: The RBI provides zero-liability protection in certain circumstances. Where an unauthorised transaction results from a bank’s contributory fraud, negligence or deficiency, the customer may have zero liability under the RBI framework.
• The Three-Working-Day Rule: In qualifying third-party breach cases, customers can have zero liability if they notify the bank within three working days of receiving the bank’s communication about the unauthorised transaction. This is not a universal 72-hour deadline from the date of fraud.
• Report Online Banking Fraud Immediately: Customers should contact the bank, call 1930, report the incident through the National Cyber Crime Reporting Portal and preserve all complaint acknowledgements and transaction records.
• An OTP Does Not Automatically Prove Customer Negligence: Whether the customer is liable depends on the circumstances, evidence, authentication records and the applicable RBI rules.
• Shadow Reversal Under RBI Rules: The RBI framework provides for shadow reversal. In qualifying cases, the bank is required to provide a shadow reversal within the applicable ten-working-day framework after notification of the unauthorised transaction.
• The Bank Bears the Burden of Proving Customer Liability: A bank’s allegation that the customer was negligent should therefore be supported by evidence.
• Not Every Online Scam Is Legally an Unauthorised Transaction: A payment made personally by a customer after being deceived may require a different legal analysis from a transaction executed without the customer’s knowledge or authorisation.
• Legal Remedies After a Bank Rejects a Refund: A bank’s refusal to refund is not necessarily the end of the matter. Depending on the circumstances, a customer may escalate the complaint through the bank’s grievance mechanism, the RBI Ombudsman and, where appropriate, consumer, civil or constitutional remedies.
• Bombay High Court Decision on Online Banking Fraud: The Bombay High Court’s 2026 decision in Subodh C. Korde v. Union of India & Ors. demonstrates that judicial relief can be available in an appropriate online banking fraud case. The Court directed HDFC Bank to refund ₹38.04 lakh with interest after considering the circumstances and applicable RBI directions.
• Evidence Is Critical to a Refund Claim: Bank statements, transaction IDs, OTP records, beneficiary changes, login records, SIM-swap evidence, bank complaints, cybercrime reports and communications with the bank can all become important.
• Act Quickly and Document Everything: Prompt reporting can help prevent further transactions, preserve evidence and improve the possibility of tracing or freezing the fraudulently transferred funds.

In Simple Terms

If money has been debited from your bank account without your authorisation, do not automatically accept the bank’s refusal to refund it. Report the fraud immediately, preserve the evidence, examine the RBI customer-liability rules and consider the appropriate legal remedy if the bank fails to resolve your claim.

Important Links

• Lawyers in India
• Copyright Registration in India
• Caveat Filing in Supreme Court of India
• Mutual Consent Divorce in Delhi/NCR : WhatsApp 9650499965