You wake up, check your phone, and your stomach drops. Six SMS alerts in the night. Each one says debit. Twenty thousand, fifty thousand, one lakh — by the time you finish reading, almost everything in the savings account is gone. You did not transfer this money. You did not share an OTP. You were asleep. Your phone was on the side table. And yet the money has left your account.
By the time you call the bank, the helpline is busy. By the time someone answers, they tell you to come to the branch with ID proof. The branch staff says it must be your fault — you must have shared your password somewhere. They will "investigate". They will "raise a complaint". Nobody, in those first hours, says the one word you most need to hear — refund. This article is about when the law says the bank must give you that refund, how the time you take to report decides everything, and what you can do from today itself.
What the Law Actually Calls a Bank's "Deficiency"
The Consumer Protection Act, 2019 — which replaced the older 1986 Act — gives every Indian consumer a right to complain when a service provider does a bad job. Banking is one of the services it covers. The Act's Section 2(11) defines "deficiency" as any fault, imperfection, shortcoming or inadequacy in the quality, nature or manner of performance of a service. In plain words: if the bank promised to keep your money safe and the money still vanished from a banking channel they themselves built, that is a deficiency.
The Supreme Court and the National Consumer Disputes Redressal Commission (NCDRC) have applied this idea many times to net banking. In one reported case, an Apex Court direction held a bank liable for compensating a school after the principal's account was wrongly linked with the school account and money was misappropriated through the bank's own system. The bank was told to compensate from the moment the misappropriation was first detected. The point is simple — when the bank's internal system is the channel through which the loss happens, the bank carries the consequences.
This does not mean every loss leads to a refund automatically. The NCDRC has equally said that if the customer cannot show any defect in the bank's internet banking system, and instead the loss happened because the customer's own passwords were given away or guessed, the bank is not automatically liable. Two reported decisions of the National Commission make this point — one where the complainant could not place any evidence of a flaw in the bank's system, and another where the bank "had been able to give a convincing explanation that their internet banking system was not hacked in any manner." So the question is never just "money is gone"; the question is always "where did the breach happen — bank side or customer side — and how fast did the customer tell the bank?"
Zero, Limited or Full: The Three Buckets of Customer Liability
To stop banks and customers from fighting over this for years, the Reserve Bank of India issued a customer-protection framework for unauthorised electronic banking transactions. Every scheduled commercial bank is bound by it. The framework breaks every fraud loss into three buckets based on who caused the breach and how fast you reported it.
Bucket 1 — Zero liability of the customer. If the unauthorised transaction happened because of the bank's own negligence or a deficiency on the bank's side — for example, a flaw in their system, an internal staff fraud, or because they did not send you the transaction SMS at all — the customer's loss is zero. The same rule applies if a third-party breach is involved (a phisher, a hacker, an unknown fraudster) and you notify the bank within three working days of receiving the SMS or email alert. The bank credits the disputed amount back, usually within the timeline laid down in the circular.
Bucket 2 — Limited liability of the customer. If a third-party breach was involved and you reported between four and seven working days of receiving the alert, your liability is capped at a fixed rupee amount that depends on the type of account (savings, current, credit card). The cap is what the circular itself prescribes. Anything beyond the cap is the bank's loss.
Bucket 3 — Full liability of the customer. If your own negligence — sharing the OTP, writing the password on the card, handing over the card to a stranger — caused the loss, you bear the loss up to the date of reporting. The instant you tell the bank, the meter stops; any further loss after that report becomes the bank's responsibility.
The simple lesson from these three buckets: speed of reporting is everything. The clock starts the moment the bank sends you the SMS or email alert. Every hour you delay, you may be sliding from one bucket to the next.
Who Decides Whether It Was "Your Negligence"?
This is the part where most fights happen at the bank counter. The branch officer will often write on the dispute form, "Customer shared OTP, hence customer liability." That single line is the bank's escape route. Two things are important here.
First, the burden is not entirely on you. The RBI framework places a positive duty on the bank to set up a system where customers can report unauthorised transactions 24x7 — by phone, SMS, app or email. The bank must also send transaction alerts that allow you to spot the fraud quickly. If the bank failed at that step — for example, no alert was sent, the call centre did not pick up, the app did not let you block the card — the bank's hands are not clean. The NCDRC in one matter held an SBI branch liable where a bank failed to send an SMS of a withdrawal that caused loss to a pensioner. Compensation was awarded by the District Forum and upheld in revision.
Second, the bank cannot pre-decide negligence. If the bank refuses your refund, it must give you reasons in writing. You can then put those reasons through three levels of challenge: (a) the bank's Internal Ombudsman, (b) the RBI Banking Ombudsman through cms.rbi.org.in, and (c) the District Consumer Disputes Redressal Commission under the Consumer Protection Act, 2019. At each level, the bank has to actually prove that you shared the credentials. Mere assertion is not enough.
The National Commission has also clarified that the consumer forums have jurisdiction even when fraud, forgery or cheating is alleged alongside deficiency in service. In a reported case where 65 lakh was withdrawn after forging 25 cheques, the Commission held that "complaint was within jurisdiction of Fora" — the criminal angle does not throw you out of the consumer route. Your banking-related consumer rights remain intact even while the police are still investigating.
Phishing, Vishing and the OTP Trap
Modern internet banking frauds rarely involve a hacker sitting at a laptop "hacking" the bank. They involve a phone call. A polite voice claims to be calling from the bank, the RBI, KYC team, the courier company, the electricity board, or "Customer Care". You are walked through a story that ends with you reading out an OTP, clicking a link, installing an app, or scanning a QR code. By the time you realise the OTP was used to authorise a transaction, the money is gone.
Two things to understand. One, sharing an OTP under deception is not the same as sharing it freely. Indian criminal law treats this as cheating by personation through computer resource, and the bank's own customer-protection framework recognises a "third-party breach" — the third party here being the fraudster who tricked you. Two, a third-party breach with prompt reporting (within 3 working days) gives you zero customer liability under the framework, even if you "shared" the OTP. The bank cannot use your moment of confusion against you if you immediately raised the alarm.
This connects directly with new-age cyber-fraud scams — APK file scams, courier-parcel fraud, fake electricity disconnection messages, fake "your CIBIL is down" calls. The forensic record of how the OTP came out of you matters, and that is why you should save every screenshot, every call log, every SMS — they all become evidence both for the bank dispute and for the FIR.
The First 24 Hours: What the Bank Must Do
From the moment you report the unauthorised transaction, the bank is on the clock. The RBI framework expects the bank to:
- Acknowledge the complaint in writing or by SMS, with date and time;
- Block the card or net-banking access so no further loss happens;
- Provisionally credit the disputed amount to your account within the prescribed working days where the loss is in the zero-liability bucket;
- Investigate, and if the customer is found not at fault, make the credit final;
- Inform you within the time limit prescribed by the circular if it is being denied — with reasons in writing.
If the bank misses these timelines, the loss after the report-date shifts to the bank under the RBI framework — irrespective of which bucket you fell in originally. So even if you delayed reporting and were initially in the "limited" or "full" liability bucket, every rupee debited after your complaint is the bank's loss. Keep written acknowledgements of the date and time of complaint. They become the most important piece of paper in the entire dispute.
When Fraud Pushes You Into Criminal-Case Territory
The bank dispute and the criminal case run on different tracks. The bank dispute is about getting your money back. The criminal case is about catching the fraudster and freezing the mule accounts where your money was transferred. You should do both.
The first criminal step is to call 1930 — the national cybercrime helpline. The faster you call, the more likely it is that the money still sitting in the beneficiary account can be frozen before it gets withdrawn or moved further. The next step is to file a complaint at cybercrime.gov.in, then to convert it into a formal FIR at the cyber police station. The standard package of sections used in internet-banking-fraud FIRs is Section 66C of the Information Technology Act, 2000 (identity theft / fraudulent use of unique identification features such as your password and OTP), Section 66D IT Act (cheating by personation by using a computer resource), and Section 420 of the Indian Penal Code (cheating). Where forged documents — fake KYC, fake bank screenshots, fake merchant pages — are involved, Sections 463, 464, 467, 468 and 471 IPC are added for the forgery layer.
An FIR copy and a 1930 acknowledgement strengthen your bank dispute too. Many banks ask for one of these before releasing a provisional credit. Some formal legal notices sent to the bank — especially if the dispute crosses the bank's prescribed working-day deadline — also serve as evidence for the consumer commission later. Keep a clean paper trail.
When to Take the Bank to the Consumer Commission
If the bank rejects your dispute, refuses to refund, or simply does not respond within the timelines set by the RBI framework and its own grievance policy, your remedy is the consumer commission. Under the Consumer Protection Act, 2019, an account holder is a "consumer" under Section 2(7) — you have hired a banking service for consideration (account-maintenance charges, locker rent, the bank's float on your deposits) and you are not using it for resale. The bank is a "service provider". A wrongful debit through internet banking — combined with a refusal to refund — is "deficiency in service" under Section 2(11).
The District Consumer Commission can entertain claims up to ₹50 lakh (the current pecuniary limit as per the rules). Above that, the State Commission. The complaint must be filed within two years of the cause of action — which, in a bank dispute, usually means within two years of the bank's final refusal letter, not the date of the fraud. Keep the basics of consumer protection in mind — there is no court fee for low-value complaints, you can plead in your own language, and you can appear in person.
What can you ask for? Refund of the disputed amount, interest from the date of debit, compensation for mental harassment, compensation for loss of credit standing (especially where the bank bounced your EMI cheque or reported you to CIBIL because of the depleted balance), and litigation costs. Where the bank's conduct is contumacious, the commission can also impose punitive damages.
What Should I Actually Do Now?
- Block first. Open the bank app or call the 24x7 hotline and block the debit card, the credit card and net-banking access. Get a written acknowledgement of date and time of block.
- Tell the bank in writing. Either via the app's dispute form or by email to the branch and the bank's grievance cell. Use the words "unauthorised electronic banking transaction" and ask for treatment under the RBI customer-protection framework on customer liability.
- Call 1930. Tell them the bank name, your account number, transaction reference numbers, the beneficiary account if visible in the SMS, and the time of each debit. Get the complaint reference.
- File at cybercrime.gov.in. Upload bank statement, all SMS screenshots, any phishing call recording or message, and your bank dispute form. Save the acknowledgement.
- Go to the cyber police station for an FIR. Insist on registration under Sections 66C, 66D IT Act and Section 420 IPC. Add 467, 468 and 471 IPC if any forged documents or screenshots are involved. If they refuse, learn how to push back on FIR refusal and use the magistrate route.
- Keep one folder with everything. Bank statements, SMS screenshots, app screenshots, dispute form, bank responses, 1930 acknowledgement, cybercrime complaint number, FIR copy, every email reply. Date-stamp each.
- Push the timelines. If the bank misses its prescribed days for provisional credit, send a polite written reminder citing the RBI customer-liability framework. If it still does not act, escalate to the bank's Nodal Officer, then Internal Ombudsman.
- Escalate to RBI Banking Ombudsman. File at cms.rbi.org.in once the bank's stipulated grievance period (or 30 days from first complaint) is over.
- Send a legal notice. A short, dated legal notice from a lawyer often unlocks a refund that bank emails could not. It also becomes the cause of action for a consumer complaint.
- File a complaint before the District Consumer Commission. If the refund still does not come, this is where you ask for the principal, interest from the date of debit, compensation and costs.
How Pinaka Legal Helps Account-Holders in This Situation
Internet-banking-fraud cases are won on paper-discipline more than on dramatic arguments. At Pinaka Legal we typically begin by mapping which RBI customer-liability bucket your case falls into based on the actual time of alert and time of report — because the bucket decides the outcome. We then draft the formal dispute letter to the bank citing the RBI framework, the Banking Ombudsman complaint when the bank stalls, and the consumer complaint with prayer for refund, interest, mental-harassment compensation and costs. We also run the criminal angle in parallel — the 1930 escalation, the cybercrime portal complaint, and the FIR — because freezing the beneficiary account often recovers money the bank dispute alone would not.
The Money Can Come Back
Net banking fraud feels like a wall the first night. By the third morning, with the right paper-discipline, it starts to feel like a procedure. The RBI customer-protection framework is one of the few Indian regulatory frameworks where time is genuinely on the customer's side — if you move fast. Report within three working days of the alert, and you may be entitled to zero loss, even when an OTP was used under deception. Document everything, push every timeline in writing, and use both the bank-dispute route and the criminal route at the same time. If the bank still refuses, the District Consumer Commission has, time and again, ordered banks to refund every rupee with interest, plus compensation. The law is not against you on this. The clock is the only thing you must respect.
Written by the Pinaka Legal Editorial Team. For queries on bank-fraud refund, RBI customer-liability complaints or consumer-commission cases, call +91 8595704798 or email info@pinakalegal.com.
Frequently Asked Questions
How quickly must I report an unauthorised internet banking transaction to get a full refund?
Within three working days of receiving the SMS or email alert. Under the RBI customer-protection framework on customer liability for unauthorised electronic banking transactions, a third-party breach reported within three working days places the customer in the zero-liability bucket. Reporting between four and seven working days places you in the limited-liability bucket with a per-transaction cap. Beyond that, the customer may carry the full loss up to the date of reporting. The clock starts the moment the bank sends the alert, so block first and report immediately.
Can the bank refuse refund just because the OTP was used?
It can refuse, but the refusal is not the final word. Where the OTP was extracted through deception — a phishing call, a fake KYC message, a fraudster pretending to be the bank or a courier — the case still qualifies as a third-party breach under the RBI framework, not customer negligence. The bank must give reasons for the refusal in writing. You can challenge those reasons before the Internal Ombudsman, the RBI Banking Ombudsman through cms.rbi.org.in, and the District Consumer Commission. Many such refusals have been overturned with full refund and interest.
Is internet banking fraud a "deficiency in service" under the Consumer Protection Act, 2019?
Yes, where the bank's own channel was the route of loss and there is no clear evidence of customer negligence, it is deficiency in service under Section 2(11) of the Consumer Protection Act, 2019. The National Consumer Disputes Redressal Commission has repeatedly held that consumer forums have jurisdiction over banking complaints, even when criminal allegations of fraud or forgery are also involved. The account holder is a "consumer" under Section 2(7) and the bank is a service provider — that combination puts the complaint squarely within the commission's jurisdiction.
What is the difference between calling 1930 and filing a consumer complaint?
1930 is the national cybercrime helpline — the fastest route to freeze the beneficiary account where your money was sent. Filing at cybercrime.gov.in and then converting it into an FIR is the criminal track that goes after the fraudster. A consumer complaint, on the other hand, is filed before the District Consumer Commission and goes after the bank — for refund, interest, mental-harassment compensation and costs. Both tracks should be run in parallel because they answer different questions: 1930 asks "where is the money?" while the consumer commission asks "why didn't the bank refund?".
What if the bank does not send me an SMS alert at all and the money is debited?
That is a strong fact in your favour. The RBI framework expects the bank to send transaction alerts so the customer can spot fraud quickly. If no alert was sent, the bank cannot start the customer-liability clock against you. The NCDRC has awarded compensation in cases where the bank failed to send an SMS of a withdrawal, holding it as deficiency in service. Save the call records or app screenshots that show the alert never came, and quote this when you raise the dispute in writing — it puts the case in the zero-liability bucket.
How long do I have to file a consumer complaint over an internet banking fraud?
Two years from the date of the cause of action. In bank-fraud disputes, the cause of action usually arises on the date the bank finally refuses to refund — not on the date of the fraud itself. So keep every refusal letter or email. The District Consumer Commission entertains complaints up to ₹50 lakh, and the State Commission above that. There is no court fee for very low-value claims, and the procedure is meant to be informal — you can plead in your own language and appear in person if you wish.
Can I claim compensation beyond the disputed amount?
Yes. Before the District Consumer Commission you can ask for the principal refund, interest from the date of the wrong debit, compensation for mental harassment, compensation for loss of credit standing (especially if your EMI bounced or your CIBIL score was hurt because of the depleted account), and litigation costs. Where the bank's conduct is particularly stubborn or careless, the commission can also award punitive damages. Document the downstream harm carefully — a higher compensation usually follows a clearer record of the harm caused.
Does it matter if the fraud happened through net banking, UPI, mobile banking or a debit card?
The principle is the same — all of these are "electronic banking transactions" under the RBI customer-protection framework. The three buckets of zero, limited or full liability apply across net banking, UPI, mobile banking, debit-card and credit-card transactions. The reporting clock, the bank's duty to provisionally credit, and the right to escalate to the Banking Ombudsman and consumer commission are also the same. So even if you are not sure which channel was misused, file the dispute first and let the bank prove the channel — and your alleged negligence — later.
What if the beneficiary account where my money went is in a different bank?
It does not matter for the customer-liability framework. Your dispute lies with your own bank — the bank where your account is held. Your bank is bound to investigate, to provisionally credit and to recover from the beneficiary bank through the inter-bank settlement process. From the consumer commission's perspective, your bank is the service provider that failed you. The criminal investigation will pull in the beneficiary-account holder and the beneficiary bank as separate respondents in the FIR, but for the refund route, focus your energy on your own bank.
Can I also send the bank a legal notice before going to the consumer commission?
Yes, and it is a good idea. A formal legal notice from a lawyer setting out the unauthorised transactions, the RBI framework, the bank's missed deadlines and the refund demanded — with a 15- or 30-day window to comply — often unlocks a refund that emails alone could not. It also crystallises the cause of action: if the bank does not respond, the very next step is the consumer complaint, with the unanswered notice as evidence. Keep the postal acknowledgement, the courier proof and the email read-receipt for the file.
Will the bank report me to CIBIL if my balance becomes negative after fraud-related EMI bounces?
It might, but you can fight it. The moment you raise the unauthorised-transaction dispute, write to the bank's grievance cell and CIBIL marking the account as "under dispute — unauthorised electronic transaction". Quote the RBI framework on customer liability and request a hold on credit-bureau reporting until the dispute is resolved. If the bank still reports negatively, that itself becomes a separate head of compensation before the District Consumer Commission — a wrongful CIBIL hit damages your credit standing and is independently compensable.
Should I freeze the account fully or just block net banking and cards?
Block the channels of loss first — debit card, credit card, net banking, mobile banking, UPI — and ask for written acknowledgement of date and time of each block. A full account freeze is rarely needed and can lock up your salary credit, EMIs and standing instructions. The objective is to cut off the fraudster, not to paralyse your own banking. Once the disputed transactions are credited back and the channels are reset (new card, new passwords, fresh MPIN), the account can be used normally again.
For more articles on Indian law, visit the Pinaka Legal Blog.