Customer liability for unauthorised transactions

If money goes missing from your bank account because of fraud, and it was not your fault, RBI's rule says you do not have to bear the loss.

There are two situations where a customer has no liability at all. The first is when the unauthorised transaction happens because of fraud, contributory negligence or a deficiency on the bank's part — none of that is the customer's doing. The second is when neither the customer nor the bank is at fault, but something elsewhere in the system goes wrong — here the customer is still protected, but only if they report the problem within three days of getting an alert from the bank.

The one case where the customer does bear the loss is when the fraud happens because of the customer's own negligence — for example, sharing a PIN or password. Even then, liability is limited to the period up to when they report it.

RBI's rule, as the booklet states it: "a customer has no liability when an unauthorized transaction happens on account of fraud, contributory negligence or deficiency on part of the bank." Where neither the customer nor the bank is at fault but the problem lies elsewhere in the system, the customer still has no liability, "provided he/she notifies the bank about the unauthorized or illegal operation within three days of receiving an alert from the bank." The bank must then credit the amount to the customer's account within a specified time period.

Where the fraud is due to the customer's own negligence — for instance, sharing a password or PIN — "the entire loss, until the date of reporting the unlawful transaction, will be borne by the customer." Reporting stops the clock on further loss.

RBI requires banks to send SMS and e-mail alerts immediately after every transaction, and those alerts must be built to let the customer reply directly to report fraud.

Priyanka gets an SMS alert for a Rs 45,000 debit from her savings account that she never authorised — a fraudster has cloned her card details through no fault of hers. She reports it to her bank the next day, well within the three-day window.

Because the fraud happened through no fault of Priyanka's and she reported promptly, she bears no liability at all, and the bank must credit the Rs 45,000 back within the specified time period.

Compare this with Rohan, who wrote his ATM PIN on the back of his card and it was stolen along with the card. A Rs 30,000 unauthorised withdrawal followed before he noticed. Because the fraud traces to Rohan's own negligence — writing down the PIN — he bears the loss for the period up to the date he reports the theft to the bank; only unauthorised transactions after his report are protected.

Chapter 4 (Savings Related Products), Section H, sets out this RBI rule directly after the ATM card safety tips. Expect the exam to test the three-day reporting window, and to distinguish the three fact patterns — bank's fault, nobody's fault, and the customer's own negligence — each of which carries a different liability outcome.

• The three-day window applies to the "nobody's fault" scenario — where fraud or bank negligence is established, the customer has no liability regardless of when they report, though prompt reporting is always advisable.
• Customer negligence shifts the loss to the customer only up to the date of reporting — it is not an open-ended loss; reporting caps it.
• Banks are required to send SMS and e-mail alerts immediately after every transaction — the customer's ability to claim protection depends on those alerts actually being sent and acted on quickly.
• Do not confuse this RBI banking-transaction rule with SEBI's separate securities-market grievance process (SCORES) — different regulator, different channel.