Unauthorised transaction on bank account: beat the RBI clock

The rules come from RBI's circular on limiting the liability of customers in unauthorised electronic banking transactions, RBI/2017-18/15 dated 6 July 2017, published at https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11040. It covers remote transactions such as internet banking, mobile banking and card-not-present purchases, and face-to-face ones such as ATM and shop-counter card use.

It sorts every case into three. If the bank was at fault, through fraud, negligence or a deficiency in its systems, you owe nothing whenever you report. If you were negligent, for example by sharing a PIN, an OTP or your card details, you carry the whole loss up to the moment you report it, and the bank carries everything after. If the breach was neither yours nor the bank's, but somewhere else in the system, your liability depends on how quickly you report. Card data stolen in a leak at a merchant you once used is the typical case, and here the calendar does all the deciding.

The count is in working days. Here is one alert, received on a Friday evening, at a home branch that, for illustration, is shut at weekends.

Within three working days of the bank's communication, your liability in a third-party breach is zero. From the fourth to the seventh working day, it is the transaction value or the cap below, whichever is lower. Beyond seven working days, the circular sets no number: the bank's board-approved policy decides, so ask for that policy in writing.

Two more lines carry weight in any argument with a bank. The burden of proving you are liable lies on the bank. And the bank may, at its discretion, waive your liability even where you were negligent, so a customer who shared an OTP under pressure still has something to ask for. The same ₹48,000 fraud, reported on working day 6, by account type:

Take a credit card with an illustrative limit of ₹3 lakh, so the ₹10,000 row applies. A card-not-present charge of ₹48,000 appears at an online merchant you have never used. The card details were taken in a breach at a site you shopped on months ago: neither you nor your bank is at fault. Three cardholders get the same alert and report on different working days.

Do these in order, and do not investigate first. If the charge turns out to be yours, blocking cost you a replacement card; if it was fraud, every hour of investigating was an hour of the band. A two-minute check is fair, since many unfamiliar lines are real purchases under a gateway or parent-company name; the page on unknown credit card charges covers decoding one. If two minutes do not settle it, block.

Once you notify it, the bank must credit the disputed amount to your account, as a shadow reversal, within 10 working days of the notification, without waiting for any insurance claim to be settled. It then has 90 days from receiving the complaint to resolve it and establish your liability, if any. If it does not manage that, it must pay you the compensation set by your reporting band: a customer who reported inside three working days is owed the full amount even if the investigation never finishes. On a bank account you must not lose interest on the disputed money; on a credit card you must not bear any additional burden of interest.

The interest point is worth money. At an illustrative card rate of 3.5 percent a month plus 18 percent GST on the interest, ₹48,000 carried for three months would cost ₹1,982.40 a month, ₹5,947 in all. The rule keeps that off your bill. The bill still arrives: pay the undisputed part in full by the due date, and ask the bank in writing to confirm the disputed amount is excluded from what is due.

Report UPI fraud in writing to the bank that holds the debited account, not only inside the UPI app: the bank is the one bound by the liability rules. Use the app's complaint option on the transaction as well, so the reference is on record in both places.

When money has been pushed to a fraudster, speed matters on the receiving side too. The national cyber crime helpline, 1930, and the reporting portal at cybercrime.gov.in exist for immediate reporting of financial fraud, with the stated aim of stopping fraudsters from siphoning the funds away; the Press Information Bureau describes both at https://www.pib.gov.in/PressReleasePage.aspx?PRID=2085609. It does not replace the written report to your bank; make both.

Merchant disputes are the ordinary cases: goods or a service never delivered, one order charged twice, a charge after a cancellation, a refund promised and never credited, the wrong amount. Try the merchant first and keep its reply, then use your card issuer's dispute or chargeback form. The issuer passes it to the merchant's bank under the card network's rules, which set the time limits and the evidence each dispute needs.

Those limits are the network's, not RBI's; the three-working-day bands do not apply. Because they feel distant, people let them slip: a refund 'processing' for weeks can fall outside the window. Ask your issuer for the limit when you file.

Everything on this page depends on seeing the debit while the three working days are still open. Unyfy reads your bank and card transaction emails and, on Android, transactional SMS, with no manual entry, and puts the debits from your accounts and cards into one list. In the app you see each transaction with the merchant name, the amount and the date; UPI handles are mapped to merchant names through a database of about 10,000 entries, so a charge at a merchant you have never used stands out from the ones you know. On Pro, the Fixed Expenses screen lists your recurring subscriptions with their amounts and usual payment days, so a recurring debit you once approved is not mistaken for fraud.

It reads the same bank alert that starts the RBI clock and sets it beside the rest of your month, so you are better placed to notice within the time you have. Block the card and make the written report to your bank as soon as you spot a debit you did not make. It never asks for your bank password or UPI PIN, and every payment is one you authorise. Install Unyfy on Android, or use the web app at app.unyfy.co.in on an iPhone.