Online Payment Fraud: Liability for Unauthorised Transactions Under RBI Guidelines
Unauthorised electronic transactions, whether through phishing, card cloning, or compromised UPI credentials, expose consumers to financial loss that Reserve Bank of India guidelines specifically address through a graduated liability framework, allocating responsibility between the customer and the bank based on how promptly the fraud is reported and where the fault for the breach lies.
RBI's Limited Liability Framework
The Reserve Bank of India's circular on customer protection in unauthorised electronic banking transactions establishes that a customer's liability depends on the circumstances of the fraud: zero liability applies where the unauthorised transaction occurs due to contributory fraud, negligence, or deficiency on the part of the bank, or where a third-party breach occurs and the customer reports the unauthorised transaction within three working days of receiving communication regarding it.
Limited Liability for Delayed Reporting
Where the loss occurs due to customer negligence, such as sharing payment credentials, the customer bears the entire loss until the unauthorised transaction is reported to the bank, while for third-party breaches where the deficiency lies neither with the bank nor the customer, a limited liability applies if the transaction is reported between four and seven working days, with the liability amount capped based on the type of account or instrument involved, and full liability generally shifting to the customer for reporting delays beyond seven working days, subject to the bank's board-approved policy.
Obligation to Report Promptly
Given the direct link between reporting timelines and the extent of liability under the RBI framework, customers noticing any unauthorised transaction are strongly advised to report it to the bank immediately through the bank's dedicated helpline, mobile application, or internet banking portal, and to follow up with a written complaint, since the initial reporting timestamp becomes the critical factor determining which liability tier applies to the specific transaction.
UPI-Specific Fraud Considerations
Unified Payments Interface transactions present a distinct challenge since a significant proportion of UPI fraud involves the customer being induced to authorise the transaction themselves, whether through a fraudulent payment request disguised as a refund or a social engineering scam, and such customer-authorised transactions, even when procured through deception, raise more complex liability questions than transactions executed without any customer action, often requiring closer examination of whether the bank's systems provided adequate warnings or safeguards against the specific fraud pattern involved.
Grievance Redressal Timelines
Banks are required to resolve customer complaints regarding unauthorised electronic transactions within a prescribed period from the date of reporting, and to compensate the customer as adjudicated within that framework, with a customer whose grievance is not satisfactorily resolved by the bank entitled to escalate the matter to the Banking Ombudsman, established under the Reserve Bank of India's grievance redressal scheme for banking customers, offering a mechanism outside conventional consumer forums for these specific disputes.
Approaching Consumer Forums for Unresolved Fraud Claims
Where a customer remains dissatisfied following the bank's resolution or the Banking Ombudsman's decision, or where the bank fails to act within the prescribed timelines, a complaint may additionally be pursued before a consumer forum on the ground of deficiency in service, with the RBI's liability framework serving as an important reference point for the forum in determining the appropriate allocation of loss between the bank and the customer.
Frequently Asked Questions
Is a customer liable for an unauthorised transaction reported immediately to the bank?
Zero liability generally applies where the unauthorised transaction results from a third-party breach and the customer reports it within three working days of receiving communication regarding it.
What happens if a customer reports fraud after a week?
Full liability generally shifts to the customer for reporting delays beyond seven working days, subject to the bank's board-approved policy on customer liability.
Who is liable if the customer was tricked into authorising a UPI payment?
Customer-authorised transactions procured through deception raise more complex liability questions and often require examining whether the bank's systems provided adequate warnings against the specific fraud pattern involved.
Where can a customer escalate an unresolved unauthorised transaction complaint?
A customer can escalate to the Banking Ombudsman under the RBI's grievance redressal scheme, and further pursue a deficiency in service complaint before a consumer forum if the matter remains unresolved.
This content is for general informational purposes and does not constitute legal advice. For a specific consumer protection matter, consult a qualified legal professional.
