The three-working-day rule is important, but it is not a universal refund promise. Liability depends on how the transaction occurred and whether the customer shared credentials.
Quick View
Block the card immediately.
Card statement and transaction details.
Waiting for the monthly statement.
RBI customer-liability circular
What the Issue Means
RBI’s customer-protection circular provides zero liability for bank fraud or deficiency and for specified third-party breaches reported within three working days of the bank’s communication. Reporting in four to seven working days can create limited liability subject to prescribed caps.
If the loss results from customer negligence, such as sharing payment credentials, the customer bears the loss until reporting; later loss should be borne by the bank. Beyond seven working days, liability follows the bank’s board-approved policy.
The bank must provide 24x7 reporting channels and record the complaint time. The circular also provides for a shadow reversal within ten working days in covered zero- or limited-liability cases, without waiting for insurance settlement.
Action Steps
- Block the card immediately.
- Report through the bank’s official fraud channel.
- Record the complaint number and time.
- Dispute each transaction in writing.
- Preserve alerts, device and merchant evidence.
- Follow up on provisional credit and final decision.
Decision Table
| Situation | Meaning | Response |
|---|---|---|
| Bank fault | Zero liability irrespective of reporting delay under the circular. | Document the deficiency. |
| Third-party breach, up to 3 working days | Zero liability under specified conditions. | Count from bank communication. |
| Third-party breach, 4–7 working days | Limited liability subject to caps. | Account type matters. |
| Customer negligence | Customer bears loss until reporting. | Later losses shift to bank. |
Practical Example
Evidence to Keep
- Card statement and transaction details.
- SMS or email alerts.
- Complaint number and timestamp.
- Merchant dispute or cancellation record.
- Device and location evidence.
- Bank’s board-approved customer-liability policy.
Common Mistakes
- Waiting for the monthly statement.
- Describing an authorised but disputed purchase as fraud.
- Sharing OTP, CVV or remote access.
- Accepting a verbal complaint without a number.
- Paying the disputed amount without recording the objection.
Escalation Route
If the bank rejects the claim, ask for the written reasoning and the policy clause applied. Escalate through the nodal grievance structure.
After first complaining to the bank, eligible deficiency-in-service complaints can be filed under the RBI Integrated Ombudsman Scheme when the conditions are met.
Working Principle
The safest approach is to preserve the original record, use the official channel and explain the facts in chronological order. A portal acknowledgement, complaint number or filing receipt is part of the evidence and should be downloaded rather than assumed to remain available forever.
Rules and procedures can change, and the correct action depends on the exact transaction, policy, notice or account. Where money, limitation, criminal allegations, medical causation or a large tax position is involved, qualified professional advice should be obtained before taking an irreversible step.
Why Timing Matters
Fraud response has two parallel objectives: stop additional loss and preserve the evidence needed to trace the first loss. The immediate step is Block the card immediately. Record the exact time because bank liability, fund tracing, SIM or account containment and police follow-up can all depend on how quickly the incident was reported.
The evidence file should begin with Card statement and transaction details. Add the transaction reference, beneficiary, phone number, link, app name, device state and every complaint acknowledgement. Keep original chats and files untouched; explanatory screenshots can be created as copies, but they should not replace the source material.
Do not continue following the fraudster’s instructions in the hope of recovering money. A frequent error is Waiting for the monthly statement. Use only independently located official numbers and portals. A bank dispute, cybercrime complaint and securities or telecom grievance may all be necessary because each route addresses a different part of the incident.
Common Questions
Does reporting within three days always guarantee zero liability?
No. The transaction must fit the specified third-party-breach conditions and facts.
What if the customer shared an OTP?
The bank may treat this as customer negligence; the full facts still need review.
How are working days counted?
The circular refers to the home branch’s working schedule, excluding the alert date.
Who bears the burden of proving customer liability?
The RBI circular places that burden on the bank.
Source and evidence trail
This panel standardises the official references already cited on this page. It does not record or imply reviewer approval.
- Primary category
- RBI / FEMA / Banking
- Source treatment
- Existing official references preserved; no new factual claims or source links added in Batch 41.
Page source links
Use the latest official page, circular, policy wording or portal instruction before acting. A general guide cannot override the document governing the specific case.