Unauthorised Electronic Banking Transactions: Zero and Limited Liability

A banker's oldest duty is to pay only on the customer's mandate. When the mandate was a signature on a cheque, a forged signature was no mandate at all and the loss stayed with the bank. When the mandate became a password, a one time code or a biometric, that simple rule broke down, because the credentials pass through the customer's own hands and the customer's own device. The Reserve Bank's answer, in a circular of 6 July 2017, was to stop asking who authorised the transaction and to ask instead where the failure lay and how quickly it was reported. That framework, now carried into the Reserve Bank's consolidated directions on responsible business conduct, decides almost every dispute about money that has left an account electronically, and a revised framework will take over for transactions from 1 January 2027.

1. The question the framework answers

An unauthorised electronic banking transaction is one where money is debited to a customer's account through an electronic channel without the authority of the customer. The channels covered include internet banking, mobile banking, cards at automated teller machines and at points of sale, card not present transactions, prepaid payment instruments, unified payments interface transactions and transactions through the Aadhaar enabled payment system.

The framework does not try to decide who typed the password. It allocates the loss by two questions, asked in order.

1. Where did the failure lie? In the bank, in a third party, or in the customer's own conduct.
2. How quickly did the customer report it? The clock runs from the receipt of the bank's communication about the transaction, not from the transaction itself.

Figure 1: Four situations, two of which put the whole loss on the bank

2. Zero liability of the customer

The customer bears nothing in two situations.

• Contributory fraud, negligence or deficiency on the part of the bank. This applies whether or not the customer reports the transaction. The bank's own failure cannot be cured by the customer's delay.
• A third party breach where the deficiency lies neither with the bank nor with the customer but somewhere else in the system, and the customer notifies the bank within three working days of receiving the communication from the bank about the transaction.

Figure 2: Three working days, seven working days, and after

3. Limited liability of the customer

The customer bears a loss in two situations, and in the second the loss is capped.

• The customer's own negligence, such as sharing the payment credentials. The customer bears the entire loss until the moment of reporting, and the bank bears every loss after reporting. The bank may, if it chooses, waive even this liability, and the circular says so expressly.
• A third party breach reported between the fourth and the seventh working day. The customer's liability is the transaction value or the amount in the table below, whichever is lower.

Where the delay in reporting is beyond seven working days, the customer's liability is determined by the bank's board approved policy. The bank must disclose that policy to the customer at the time of opening the account and must display it publicly, so that the customer knows the consequence of delay before the delay happens.

4. What the bank must do, and by when

1. Provide the means to report. The bank must offer a channel available at all hours for reporting unauthorised transactions, through more than one route, with a direct link on the home page of its website, and must send an automatic acknowledgment bearing a complaint number. A bank that has not given the customer a workable means of reporting will find it very difficult to blame the customer for delay.
2. Register the customer for alerts. Registration for transaction alerts by short message service is mandatory, and alerts by electronic mail are to be sent where registered, because the whole scheme of time limits runs from the bank's communication.
3. Reverse the amount within ten working days. On being notified, the bank must credit the disputed amount to the customer's account within ten working days of the notification, value dated to the date of the unauthorised transaction. This is a shadow reversal made without waiting for the outcome of the investigation and without waiting for any insurance claim.
4. Resolve within ninety days. The complaint must be resolved, and the customer's liability if any established, within the time fixed by the bank's board approved policy, and in any case not exceeding ninety days from the receipt of the complaint. If the bank is unable to establish the customer's liability within that period, it must pay the compensation as if there were no liability.
5. Prove the customer's liability. The burden of proving customer liability in a case of an unauthorised electronic banking transaction lies on the bank. The customer does not have to prove that he did not authorise the transaction.

5. Failed transactions are a different problem

A transaction that was authorised but did not complete is not an unauthorised transaction. It is a failed transaction, and it is governed by the Reserve Bank's circular of 20 September 2019 on the harmonisation of turn around time, which took effect from 15 October 2019. A failed transaction is one that has not been fully completed for reasons that are not attributable to the customer, such as a failure of the communication link, the absence of cash in the machine or a session time out, and it includes a credit that could not reach the beneficiary.

The circular fixes an outer limit for the automatic reversal in each channel, and provides compensation of one hundred rupees for each day of delay beyond that limit, to be credited to the customer's account without any claim being made. The transaction day is denoted by the letter T.

The timelines below are outer limits, not targets. A bank that reverses sooner is doing no more than its contract requires, and the compensation becomes payable only once the limit has passed. The letter T denotes the day of the transaction, so a limit of T plus one means the reversal must be complete by the end of the day after the transaction.

Where the prepaid instrument transaction rides on another system, such as a card network, the immediate payment service or the unified payments interface, the timelines of that underlying system apply. A customer who does not get relief within these limits may complain under the Reserve Bank Integrated Ombudsman Scheme, 2021.

6. The statutory overlay

The circulars are issued under Section 35A of the Banking Regulation Act, 1949 and under the Payment and Settlement Systems Act, 2007, and they sit on top of a statutory framework that gives electronic banking its legal foundation.

• Sections 4 and 5 of the Information Technology Act, 2000 give legal recognition to electronic records and to electronic signatures, which is what makes an electronic mandate a mandate at all.
• Section 43 provides compensation for unauthorised access to, or damage to, a computer resource, adjudicated by an adjudicating officer where the claim does not exceed five crore rupees and by the civil court beyond that.
• Section 43A provides compensation where a body corporate holding sensitive personal data fails to maintain reasonable security practices. The Digital Personal Data Protection Act, 2023 omits this provision, and the omission takes effect as the Act's own machinery is brought into force in phases.
• Section 66C punishes identity theft and Section 66D punishes cheating by personation using a computer resource, each with imprisonment up to three years and fine. These are the provisions under which most phishing and vishing cases are charged.
• Section 72A punishes disclosure of information obtained under a lawful contract, without consent and with intent to cause wrongful loss or gain, which reaches the employee or the vendor who leaks customer data.
• Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 governs the admissibility of electronic records, and the certificate it requires is what makes the bank's system logs and audit trails usable in evidence.

7. Where the customer still loses

The framework is generous, but it is not unconditional. Three situations continue to leave the loss with the customer.

1. Sharing the credentials. A customer who parts with a password, a one time code or a card and its personal identification number bears the whole loss up to the moment of reporting. The one time code is the critical point, because its disclosure is almost always the act that completes the fraud, and the alert message that carries it invariably warns against sharing it.
2. Delay beyond seven working days. Beyond that point the bank's board approved policy governs, and such a policy may lawfully place the loss on the customer. This is why the duty to disclose the policy at account opening matters.
3. Transactions that are authorised but regretted. A customer who has been persuaded to make a payment himself has made an authorised transaction. The remedy there lies in the criminal law and in the banking channels for freezing the beneficiary account, not in this framework.

8. The revised framework from 1 January 2027

By a circular of 24 June 2026, the Reserve Bank amended its responsible business conduct directions, into which the 2017 instructions had been consolidated, and replaced the provisions on limiting customer liability with a wider customer protection framework for fraudulent electronic banking transactions. The new provisions govern transactions undertaken on or after 1 January 2027. Transactions before that date remain governed by the framework described above.

• The directions define negligence on the part of the bank and of the customer, and the onus of proving customer liability remains on the bank.
• Zero liability applies where the fraud results from the bank's negligence or deficiency, or from a third party breach reported within five calendar days.
• A one time compensation is introduced for an individual victim of a small value fraud: where the loss is up to fifty thousand rupees and the fraud is reported to the bank and to the national cybercrime reporting portal or helpline within five calendar days, the victim receives eighty five per cent of the net loss, subject to a cap of twenty five thousand rupees, once in a lifetime.
• The cost of that compensation is shared between the Reserve Bank, the customer's bank and, where applicable, the beneficiary bank.

9. Quick Revision

1. The two questions are where the failure lay and how quickly it was reported.
2. The bank's own deficiency means zero liability regardless of any delay.
3. A third party breach reported within three working days means zero liability.
4. Customer negligence means the whole loss until reporting and nothing after.
5. The working days are counted on the home branch's schedule and exclude the day of receipt of the bank's message.
6. Registration for short message service alerts is mandatory, because the clock runs from the bank's communication.
7. The shadow reversal is unconditional, made within ten working days and without waiting for the investigation or for insurance.
8. A failed transaction is governed by the turn around time circular, not by the liability circular.
9. The Integrated Ombudsman Scheme, 2021 is the escalation route if the bank does not perform.

10. Frequently Asked Questions

From when do the three working days run?

From the receipt of the bank's communication about the transaction, and not from the transaction itself. This is the most frequently misstated part of the framework and it usually decides the case. If the bank never sent an alert, or sent it to a number that it had failed to update, the clock never started, and the bank cannot complain of delay. That is also why the circular makes registration for short message service alerts mandatory and requires the bank to keep a reporting channel open at all hours.

Does the bank have to return the money before it finishes its investigation?

Yes. The credit within ten working days of notification is not an admission and is not conditional on the outcome. It is a shadow reversal, value dated to the date of the unauthorised transaction so that no interest is lost, and it must be made without waiting for any insurance claim to be settled. The bank then has up to ninety days from the receipt of the complaint to establish the customer's liability, and if it cannot do so within that period it must compensate the customer as though no liability existed.

Who has to prove that the customer was negligent?

The bank. The circular places the burden of proving customer liability on the bank, which reverses the position that obtained before 2017, when a customer disputing a debit effectively had to show that the bank had been deficient. In practice the bank discharges the burden with its system logs, the device fingerprints, the internet protocol addresses and the delivery records of the one time code. Where those records are incomplete or cannot be certified for use in evidence, the burden is not discharged and the loss stays with the bank.

What if the customer himself made the payment after being deceived on a telephone call?

That is an authorised transaction, and the 2017 framework does not apply to it, because the mandate was in fact given. The remedies lie elsewhere: a complaint to the police and through the national cybercrime reporting portal, a request to the bank to trace and seek the freezing of the beneficiary account, and the criminal provisions on cheating by personation. Banks are expected to act quickly on such requests, because the money ordinarily moves through several accounts within hours, but the loss is not allocated by the liability circular. For transactions from 1 January 2027, a victim of a small value fraud should also consider the one time compensation under the revised framework, which depends on reporting to the bank and to the cybercrime portal within five calendar days.

Can a bank's board approved policy override the circular?

No. The policy operates only in the space the circular leaves to it, which is the case of a delay beyond seven working days. Within the three day and the seven day windows the outcome is fixed by the circular, and a policy that purported to put a loss on the customer in those windows, or to dilute the shadow reversal or the burden of proof, would be contrary to a direction issued under Section 35A of the Banking Regulation Act, 1949 and would be unenforceable to that extent.

What if the customer could not report because he was away or unwell?

Within the three working day window nothing turns on the reason, because the customer bears no liability in any event. Beyond the seventh working day the question is governed by the bank's board approved policy, and a policy framed in absolute terms would be difficult to defend before the Ombudsman or a consumer commission where the delay was genuinely beyond the customer's control. The circular also leaves the bank free to waive liability even in cases of customer negligence, and says so expressly. The practical advice is that the customer should document why the alert could not be acted on, since the bank's discretion is real and its exercise is reviewable on the ordinary standard of reasonableness.

Who decides a disputed electronic transaction claim, and how fast?

The bank decides in the first instance, within 90 days of the complaint, and the burden of proving customer liability lies on the bank. Where the customer is not satisfied, the Reserve Bank's Integrated Ombudsman Scheme covers deficiencies in carrying out these instructions, and the consumer forums remain open for deficiency of service. While the claim is under examination the bank must give shadow credit within 10 working days of the report for the disputed amount in zero liability cases, so the customer is not kept out of funds while the investigation runs. The value dated credit must restore interest and charges as if the debit had never happened.

11. Related Topics and Provisions

• The paying banker: payment in due course and statutory protection
• Cyber security, outsourcing and operational risk in banks
• Banking frauds: classification, reporting and the Master Directions, 2024
• The banker's duty of care and the duties of the customer
• Payment and settlement systems and the regulation of payment banks
• The Reserve Bank Integrated Ombudsman Scheme and customer grievance redressal