March 27, 2026
Banking Fraud: What to Do, RBI Rules and Customer Liability Explained
Over the past few years, most major banks in India have accelerated fraud-prevention campaigns. They send SMS alerts, in-app warnings, customer awareness advertisements, and RBI-mandated advisories urging customers not to share OTPs or click unknown links.
Yet fraud cases continue to rise.
According to data shared by the Ministry of Finance in Parliament, 10.64 lakh UPI-related fraud cases involving over ₹805 crore were reported in FY-2024–25. Industry experts believe actual incidents may be higher as many cases go unreported. (Source: Ministry of Finance, Government of India – FY-25 digital payment fraud data)
This means fraud attempts targeting students, salaried professionals, business owners, and senior citizens are much common.
Most of us have received at least one suspicious call, citing,
- A fake bank officer asking to confirm an OTP
- A UPI collect request you didn’t initiate
- A message claiming your KYC has expired
- A refund link that looks legitimate
- A WhatsApp phone call featuring a police officer's profile picture
- SMS with alluring prize moneys
In most of these cases, recovery is difficult because there is no theft and the victim himself has shared OTPs, bank account details and card numbers and CVVs
Let’s look at the RBI-mandated liability framework, reporting window, compensation rules, and a structured action timeline to follow if you become a victim.
Response Timeline
Time is critical. The earlier you report, the lower your liability.
First Line of Action - Contain the Damage
- Block compromised instruments immediately
- Debit/credit card via banking app
- Disable UPI ID
- Freeze net banking if required
- Change credentials
- ATM PIN
- UPI PIN
- Net banking password
- Email password (if linked)
- Contact your bank’s official fraud helpline
- Use the number from the bank’s official website/app
- Obtain a complaint reference number
- Note date and time of reporting
- Preserve evidence
- Screenshots of SMS alerts
- Call logs
- Fraudulent links
- Transaction ID
Early reporting significantly improves reversal chances.
Then File Formal Reports
Call the National Cybercrime Helpline at 1930
The 1930 helpline connects you to India’s cybercrime response system. Quick reporting allows authorities to attempt freezing the beneficiary account before funds are withdrawn.
You should also register a complaint at
https://cybercrime.gov.in
https://cybercrime.gov.in
This creates a legal record and aids investigation.
Within 24 Hours - Critical RBI Liability Window
As per the Reserve Bank of India circular on “Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions” (RBI Notification, July 2017),
Zero Liability Rule
You have zero liability if the fraud was due to a bank/system breach, or if you report the unauthorised transaction within 3 working days of receiving the alert. You must not have proven negligence like sharing OTP, PIN, CVV or password knowingly.
This is one of the most important consumer protections in Indian banking law.
Beyond 3 Working Days - Limited Liability Window
If you report the unauthorised transaction after 3 working days, your financial liability may increase in line with your bank’s Board-approved policy.
While the Reserve Bank of India provides the regulatory framework, individual banks publish their specific liability caps and conditions within those guidelines**.**
Types of Banking Fraud
Understanding the nature of fraud helps determine the resolution path.
1. Card Fraud (Debit/Credit Card Misuse)
- Often involves online purchases or POS misuse.
- You must file a dispute/chargeback request.
- Most banks reverse unauthorised card transactions after investigation.
2. UPI Fraud
- Common via fake collect requests or OTP scams.
- Immediate disabling of UPI is essential.
- Banks can attempt real-time freeze through 1930 reporting.
3. Phishing and Fake Websites
- Fraudsters mimic bank portals.
- If credentials were entered, change passwords immediately.
- Report phishing URL to bank and cybercrime portal.
4. SIM Swap Fraud
- Fraudster gets a duplicate SIM.
- Your phone loses its network suddenly.
- Contact the telecom provider immediately and block the SIM.
Each category follows different internal banking protocols.
How Transaction Reversal Works
When reported promptly,
- Bank logs fraud complaint.
- Internal risk team reviews transaction trail.
- The beneficiary bank may freeze funds (if still available).
- Chargeback or reversal initiated.
- Customer informed within the investigation timeline.
Banks usually acknowledge complaints within 48–72 hours.
Final resolution timelines may vary but generally fall within 7–30 working days, depending on complexity.
Final resolution timelines may vary but generally fall within 7–30 working days, depending on complexity.
Compensation and Escalation Framework
If your bank does not respond satisfactorily,
1) Escalate to Nodal Officer
Every bank has a designated grievance redressal officer.
2) Approach Banking Ombudsman
Under the RBI’s Integrated Ombudsman Scheme, customers can file complaints if:
- Bank fails to resolve the issue within 30 days.
- Response is unsatisfactory.
The Ombudsman mechanism is free of charge and binding on banks.
Banking Fraud Checklist (Practical Copy Guide)
Block cards and UPI immediately
Change all credentials
Call the bank’s fraud helpline
Note the complaint reference number
Call 1930
File complaint on cybercrime.gov.in
Submit written complaint to bank
Preserve screenshots and evidence
Monitor account for next 30 days
Escalate if unresolved after 30 days
Change all credentials
Call the bank’s fraud helpline
Note the complaint reference number
Call 1930
File complaint on cybercrime.gov.in
Submit written complaint to bank
Preserve screenshots and evidence
Monitor account for next 30 days
Escalate if unresolved after 30 days
Why Fraud Reporting Speed Matters
According to RBI’s consumer protection framework,
- Reporting within 24 hours means strongest protection
- Reporting within 3 days means limited liability
- Reporting after 3 days increased customer responsibility possible
Delays weaken reversal chances because funds may be withdrawn from the fraudulent account quickly.
Frequently Asked Questions
What are RBI rules on fraud reporting?
RBI’s customer protection circular states customers must report unauthorised electronic transactions immediately. Reporting within 24 hours qualifies for zero liability in eligible cases.
What is the time limit to report bank fraud?
Ideally within 24 hours. Reporting within 3 working days still limits liability. Beyond that, customer liability may increase depending on bank policy.
Can I get my money back after UPI fraud?
Yes, if reported quickly. The bank and cybercrime authorities attempt to freeze the beneficiary account. Early reporting improves recovery chances.
What happens if I shared my OTP?
If you voluntarily shared credentials, zero liability may not apply. However, immediate reporting can still limit losses.
Is filing a cybercrime complaint mandatory?
While not legally mandatory, filing through 1930 or cybercrime.gov.in strengthens your case and helps freeze funds.
How long does a bank take to resolve fraud complaints?
Acknowledgement usually occurs within 48–72 hours. Full investigation may take between 7–30 working days.
Final Thoughts - Respond, Don’t Panic
Banking fraud is no longer rare. They are more structured, organised and evolving.
However, regulatory frameworks especially RBI’s zero-liability rules, are designed to protect customers.
You no longer need to feel helpless if fraud occurs. You need to act quickly, document everything and follow the structured reporting path.
Remember, in banking fraud cases, speed is protection.
Never miss a trading opportunity with Margin Trading Facility
Enjoy 2X leverage on over 900+ stocks
