Unauthorised Digital Transaction: Customer Support Evidence Workflow
Reviewed by CA Nikhil Gupta · Last reviewed 13 June 2026
A customer-support workflow for unauthorised transactions covering immediate reporting, acknowledgement, channel block, evidence and liability analysis.
For broader context, see the Data Privacy, DPDP and Cyber Law — Full Compliance Hub.
The first response should stop further loss and timestamp the complaint—not ask the customer to wait while transactions continue.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
RBI requires banks to provide reporting channels and advises customers to report unauthorised transactions immediately.
Customer liability depends on cause and reporting delay; it should not be decided by a generic statement that an OTP was used.
The burden of proving customer liability lies on the bank under the RBI circular for banks.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- RBI requires banks to provide reporting channels and advises customers to report unauthorised transactions immediately.
- Customer liability depends on cause and reporting delay; it should not be decided by a generic statement that an OTP was used.
- The burden of proving customer liability lies on the bank under the RBI circular for banks.
- Acknowledgement, transaction data and steps taken to prevent further loss are critical evidence.
For the connected rule, example or next step, see Grievance Officer Workflow: From User Email to Closure Evidence.
The five-point review
| Check | What to examine |
|---|---|
| Transaction | Amount, channel, time and beneficiary. |
| Notice | When and how reported. |
| Control | Block account/card/device. |
| Cause | Bank deficiency, third-party breach or customer conduct. |
| Resolution | Credit, investigation and decision. |
For the connected rule, example or next step, see Defective Return Notice: Evidence Pack and Response Workflow.
Practical example
A customer reports fraud at 10 a.m.; support asks for an email form and two more transfers occur. The workflow should timestamp the complaint and block the channel before collecting the full narrative.
How to apply the framework
Train support to avoid blame. OTP use is a fact to investigate, not a complete liability conclusion.
Preserve calls, app logs, authentication data, beneficiary details and internal actions.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review transaction, notice and control together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Action checklist
- Provide immediate reporting.
- Acknowledge complaint.
- Block further transactions.
- Preserve evidence.
- Apply RBI framework.
- Escalate unresolved cases.
Evidence to keep
- Complaint timestamp
- Transaction record
- Authentication logs
- Block actions
- Final decision
Warning signs
- Customer sent between teams
- No acknowledgement
- Account remains active
- OTP treated as automatic liability
- Rejection without evidence
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.
Frequently Asked Questions
Source and review trail
Use the current official instrument, portal or regulator publication before acting. This panel separates the category authority from page-specific references.
- Primary category
- Data Protection, Cyber & IT Law
- Official starting point
- www.meity.gov.in