The Plainspeak / Money safety

Money safety · 4 min

Unauthorised transactions in your bank account: limits on your liability

A debit you did not make. In that moment most people panic about the amount. Under the Reserve Bank's rules, the amount is not what decides your loss. How fast you report it does, and from 1 January 2027 the clock changes.

By 37xBetter · Last reviewed October 2026

The Reserve Bank of India sets how much a customer can be made to bear when an electronic transaction, by UPI, card, net banking or mobile banking, was not made by them. There are now two sets of rules, and the date of the transaction decides which one applies to you.

What stays the same under both

• If the fault is the bank's, in its own systems or its staff, you owe nothing, however late you report.
• Anything taken from your account after you report it is the bank's loss, not yours.
• The burden of proof sits on the bank. If the bank says you were careless, the bank has to prove it. You do not have to prove your innocence.
• When money is put back, it is dated to the day it was taken, so you lose no interest.

Transactions up to 31 December 2026

Zero liability. If the fault lies neither with you nor with the bank, but somewhere else in the system, you owe nothing as long as you report within three working days. The three days count from when you receive the bank's alert about the transaction, not from when the money left.

A capped amount for four to seven working days. Report between four and seven working days after the alert and you pay the transaction value or the cap below, whichever is lower:

• Basic Savings (BSBD) accounts: 5,000 rupees
• All other savings accounts, prepaid instruments and gift cards, current, cash credit and overdraft accounts of MSMEs, and those of individuals with an average balance or limit up to 25 lakh, plus credit cards with a limit up to 5 lakh: 10,000 rupees
• All other current, cash credit and overdraft accounts, and credit cards with a limit above 5 lakh: 25,000 rupees

After seven working days, what you bear is decided by the bank's own board-approved policy.

The money back. Once you report, the bank must credit the disputed amount to your account, as a shadow reversal, within 10 working days, and settle the complaint within 90 days.

Your own carelessness. If the loss happened because you shared your PIN, password or OTP, you carry the full loss up to the moment you report it.

Transactions from 1 January 2027

A shorter, simpler clock. If the fault lies neither with you nor with the bank, you owe nothing as long as you report within five calendar days of the transaction. Calendar days means weekends and holidays count, and the clock starts on the day of the transaction, so report the same day if you can.

After five days, what you bear is decided by your bank's own policy. The fixed caps of 5,000, 10,000 and 25,000 rupees no longer apply.

Your own carelessness is spelled out. Sharing or failing to protect your PIN, password or OTP, ignoring the bank's specific scam warnings, installing a malicious app, or not keeping your mobile number and email updated all count. In those cases you carry the loss until you report it.

A safety net for small losses. Even when the loss is your own fault, an individual who loses up to 50,000 rupees can get back 85% of the net loss or 25,000 rupees, whichever is lower. You get this once in your lifetime, and only if you report it both to the bank and to the National Cyber Crime Reporting Portal (cybercrime.gov.in) or the 1930 helpline within five calendar days. The bank must pay within five calendar days of receiving your completed application.

Faster answers. The bank must acknowledge your complaint at once with a complaint number and time, and settle it within 45 calendar days, or 60 for a transaction made abroad. On a credit card, the bank must show a shadow reversal of the disputed amount within five calendar days of your complaint, so you pay no interest or charges on it while the complaint is open.

Alerts you can rely on. Banks must send an instant SMS for every electronic transaction above 500 rupees, free of charge, and an email where you have registered one, and must keep a reporting channel open round the clock.

The move

Keep your mobile number and email updated with the bank so alerts reach you. Save the bank's fraud number and the 1930 helpline now, before you need them. The moment anything looks wrong, block the card or the channel, report it to the bank in writing and note the complaint number and time, and report it on cybercrime.gov.in or 1930 the same day. Under both sets of rules, reporting stops your liability growing. Under the new one, it also keeps the small-loss compensation open to you.