I did not make this transaction. Does the bank have to refund me?
RBI has two rule sets, and the date of the transaction picks between them. For a transaction before 1 January 2027, the circular of 6 July 2017 applies, which RBI has carried into its Responsible Business Conduct Directions, 2025. We could not open those 2025 paragraphs, so check the figures against your bank's policy. For a transaction on or after 1 January 2027, the Third Amendment Directions of 24 June 2026 apply to commercial banks.
Before 2027, your liability is zero if the fault is the bank's, whether or not you reported it. It is also zero if someone else got in and you told the bank within three working days. Report between four and seven working days and you carry the lower of the amount taken and a cap of ₹5,000, ₹10,000 or ₹25,000, set by account type. After seven working days the bank's Board policy decides. If you shared an OTP, PIN or password, you carry the loss until you report it and the bank carries it afterwards.
From 2027, the bank carries the whole loss when the fraud comes from its own negligence or deficiency. For a third-party breach your liability is zero if you report within five calendar days of the transaction, and the bank's policy decides after that. If the loss came from your own negligence, such as giving out an OTP or PIN, installing a malicious app or ignoring a clear scam warning from the bank, you carry it until you report. A small-value compensation softens that: an individual or sole proprietor with a gross loss up to ₹50,000 gets 85% of the net loss or ₹25,000, whichever is less, once in a lifetime, if the fraud is reported to the bank and on cybercrime.gov.in or 1930 within five calendar days. It covers frauds up to one year from 1 January 2027.
The bank has to credit the money back, dated as of the transaction. Before 2027 that is within 10 working days of your notice, and the complaint is resolved within the bank's policy time, at most 90 days. From 2027 a credit card is credited back within five calendar days of your notice, the rules state no period for other accounts, and resolution takes at most 45 calendar days (60 for a cross-border transaction). The bank has to prove any customer negligence. The checker takes your transaction date, the day you told the bank, the account type and the cause, and returns your liability and the bank's deadlines.
Common questions
What are the caps for a report after three working days?
₹5,000 for a basic savings bank deposit account. ₹10,000 for other savings accounts, pre-paid instruments and gift cards, MSME current accounts, individual current accounts with an average balance or limit up to ₹25 lakh, and credit cards with a limit up to ₹5 lakh. ₹25,000 for all other current accounts and credit cards.
Is the RBI Ombudsman free, and when does it open?
It is free. You complain to the bank first. You can go to the Ombudsman when 30 days pass with no reply, or the time RBI sets for the complaint if that is longer, or when the reply leaves you unhappy. You then have 90 days to file, counted from the day that period ends or the bank's last reply, whichever is later.
Who has to prove I was careless?
The bank. The burden of proof is on the bank, under the 2017 circular and under the 2026 amendment.
Do these rules cover every bank?
The 2017 circular covers scheduled commercial banks (regional rural banks included), small finance banks and payments banks. Co-operative banks follow their own RBI directions, which we have not read. The 2027 rules are for commercial banks. Small finance banks, payments banks, regional rural banks and local area banks have amendments of their own, which we have not read.
Want this handled for you? Tell us where you stand and we prepare the papers and take you through the filing.