Money Missing From Your Bank Account? Five Important Steps To Take Immediately After Suspected Online Fraud
An unexpected debit from a bank account can signal a serious security problem, particularly when the account holder has not approved the payment. Whether the money disappears through a fraudulent card transaction or an unauthorised digital transfer, the response time matters.
Indian banking customers have certain protections under Reserve Bank of India (RBI) rules. However, the extent of financial liability depends on who was responsible and how quickly the incident was reported.
Contact the bank through its official customer care number, mobile banking application, internet banking portal or branch. Explain that the transaction was not authorised and request that the bank register a formal complaint.
Depending on the circumstances, you may need to take additional steps to secure your account. These could include:
Make sure you receive a complaint or acknowledgement number. This will be important when following up with the bank or escalating the matter.
In India, customers can contact the national cyber financial fraud helpline at 1930. They can also register a complaint through the official National Cyber Crime Reporting Portal.
Official portal: National Cyber Crime Reporting Portal
When reporting the incident, provide as much information as possible. Relevant details include the amount involved, transaction date and time, bank account or payment details, transaction reference number and any communication received about the payment.
Keep the acknowledgement or complaint reference number safely. It can help authorities and the bank track the complaint.
Customers should not assume that reporting the incident through one channel automatically completes the process with the other. Inform the bank separately and retain proof of both complaints.
Speed is particularly important in digital payment fraud cases because early reporting may help the authorities and financial institutions take steps to trace or restrict the movement of the money.
RBI's customer protection framework provides for zero or limited liability in specified situations. It distinguishes between cases involving a bank's negligence, third-party security breaches and the customer's own failure to protect payment credentials.
When customers have zero liability
Customers generally have zero liability in two important situations:
When customers have limited liability
If a third-party breach occurs and neither the bank nor the customer is responsible, reporting the incident within four to seven working days can result in limited customer liability.
The amount payable by the customer is restricted to the transaction value or the prescribed maximum liability applicable to the account category, whichever is lower.
The prescribed limits vary according to the type of account and banking facility involved.
What happens if you share your OTP or PIN?
The situation can be different when a customer contributes to the loss through negligence.
For example, if someone voluntarily shares their ATM PIN, internet banking password or one-time password (OTP), and this information is subsequently misused, the customer may have to bear the loss until the unauthorised transaction is reported to the bank.
However, any additional loss occurring after the customer has informed the bank must be borne by the bank under the applicable RBI rules.
Customers who report fraud after seven working days may have their liability determined according to the bank's board-approved policy.
The reporting period is calculated using the working schedule of the customer's home branch. The day on which the transaction communication is received is excluded from the calculation.
Under RBI's customer protection framework, banks must provide a provisional credit, commonly called a shadow reversal, within 10 working days of receiving notification of an unauthorised transaction in cases covered by the zero- or limited-liability provisions.
The amount is credited with the value date of the original unauthorised transaction. This requirement also applies without waiting for the settlement of an insurance claim, where relevant.
However, provisional credit should not be confused with a final decision on the complaint. The bank must investigate the incident and establish whether the customer bears any liability.
RBI rules require banks to resolve the complaint and determine the customer's liability, if any, within the period specified in their approved policy. This period cannot exceed 90 days from the date of receiving the complaint.
If the bank cannot resolve the matter or establish the customer's liability within 90 days, it must provide compensation in accordance with the applicable rules.
The framework also protects customers against the loss of interest arising from unauthorised debit card or bank account transactions. In the case of credit cards, customers should not face an additional interest burden because of such unauthorised transactions.
Start by changing your internet banking password and other relevant payment credentials. If the same password is used across multiple platforms, update those accounts as well.
Never share sensitive banking information with someone claiming to represent your bank. Genuine bank officials do not need customers to disclose their OTPs, ATM PINs or internet banking passwords to process a fraud complaint.
It is also important to examine recent account activity rather than focusing only on the transaction that triggered the alert. Fraudsters may attempt multiple payments, including smaller deductions that can go unnoticed.
Customers should take the following precautions:
The distinction between bank negligence, third-party breaches and customer negligence is particularly important when determining liability.
For customers affected by digital banking fraud, the most sensible response is to contact the bank immediately, report the incident through the cybercrime helpline where appropriate and preserve all supporting records.
Acting quickly can help limit additional losses and improve the chances of obtaining relief under the applicable customer protection rules.
Disclaimer: This article is intended for informational purposes only and should not be considered legal or financial advice. Customer liability, refund eligibility and complaint resolution depend on the circumstances of each case and the applicable RBI regulations. Customers should contact their bank and the relevant authorities for assistance with suspected financial fraud.
Indian banking customers have certain protections under Reserve Bank of India (RBI) rules. However, the extent of financial liability depends on who was responsible and how quickly the incident was reported.
1. Report The Suspicious Transaction To Your Bank Without Delay
The first priority should be to alert your bank as soon as you notice an unfamiliar debit. Do not wait to see whether the money returns automatically or postpone reporting until the next working day.Contact the bank through its official customer care number, mobile banking application, internet banking portal or branch. Explain that the transaction was not authorised and request that the bank register a formal complaint.
Depending on the circumstances, you may need to take additional steps to secure your account. These could include:
- Blocking the debit card or requesting a temporary card suspension.
- Disabling internet banking or mobile banking access temporarily.
- Restricting certain payment facilities.
- Changing your banking credentials.
- Requesting the bank to investigate and prevent further unauthorised transactions.
Make sure you receive a complaint or acknowledgement number. This will be important when following up with the bank or escalating the matter.
2. Report Online Financial Fraud Through Helpline 1930
Informing the bank is essential, but suspected cyber financial fraud should also be reported through the appropriate government channels.In India, customers can contact the national cyber financial fraud helpline at 1930. They can also register a complaint through the official National Cyber Crime Reporting Portal.
Official portal: National Cyber Crime Reporting Portal
When reporting the incident, provide as much information as possible. Relevant details include the amount involved, transaction date and time, bank account or payment details, transaction reference number and any communication received about the payment.
Keep the acknowledgement or complaint reference number safely. It can help authorities and the bank track the complaint.
Customers should not assume that reporting the incident through one channel automatically completes the process with the other. Inform the bank separately and retain proof of both complaints.
Speed is particularly important in digital payment fraud cases because early reporting may help the authorities and financial institutions take steps to trace or restrict the movement of the money.
3. Will The Bank Refund Money Lost Through Unauthorised Transactions?
Whether a customer receives a full refund depends on the circumstances behind the fraudulent transaction and the time taken to report it.RBI's customer protection framework provides for zero or limited liability in specified situations. It distinguishes between cases involving a bank's negligence, third-party security breaches and the customer's own failure to protect payment credentials.
When customers have zero liability
Customers generally have zero liability in two important situations:
- When an unauthorised transaction occurs because of fraud, negligence or a deficiency on the bank's part.
- When a third-party security breach occurs without any negligence by the customer or the bank, and the customer informs the bank within three working days of receiving the transaction communication.
When customers have limited liability
If a third-party breach occurs and neither the bank nor the customer is responsible, reporting the incident within four to seven working days can result in limited customer liability.
The amount payable by the customer is restricted to the transaction value or the prescribed maximum liability applicable to the account category, whichever is lower.
The prescribed limits vary according to the type of account and banking facility involved.
What happens if you share your OTP or PIN?
The situation can be different when a customer contributes to the loss through negligence.
For example, if someone voluntarily shares their ATM PIN, internet banking password or one-time password (OTP), and this information is subsequently misused, the customer may have to bear the loss until the unauthorised transaction is reported to the bank.
However, any additional loss occurring after the customer has informed the bank must be borne by the bank under the applicable RBI rules.
Customers who report fraud after seven working days may have their liability determined according to the bank's board-approved policy.
The reporting period is calculated using the working schedule of the customer's home branch. The day on which the transaction communication is received is excluded from the calculation.
4. How Quickly Must Banks Return Money After A Fraud Complaint?
Customers do not necessarily have to wait until the entire investigation is completed to receive provisional credit.Under RBI's customer protection framework, banks must provide a provisional credit, commonly called a shadow reversal, within 10 working days of receiving notification of an unauthorised transaction in cases covered by the zero- or limited-liability provisions.
The amount is credited with the value date of the original unauthorised transaction. This requirement also applies without waiting for the settlement of an insurance claim, where relevant.
However, provisional credit should not be confused with a final decision on the complaint. The bank must investigate the incident and establish whether the customer bears any liability.
RBI rules require banks to resolve the complaint and determine the customer's liability, if any, within the period specified in their approved policy. This period cannot exceed 90 days from the date of receiving the complaint.
If the bank cannot resolve the matter or establish the customer's liability within 90 days, it must provide compensation in accordance with the applicable rules.
The framework also protects customers against the loss of interest arising from unauthorised debit card or bank account transactions. In the case of credit cards, customers should not face an additional interest burden because of such unauthorised transactions.
5. Secure Your Bank Account And Prevent Further Losses
Reporting the fraudulent payment is only one part of the response. Customers should also review their banking security to reduce the possibility of further unauthorised activity.Start by changing your internet banking password and other relevant payment credentials. If the same password is used across multiple platforms, update those accounts as well.
Never share sensitive banking information with someone claiming to represent your bank. Genuine bank officials do not need customers to disclose their OTPs, ATM PINs or internet banking passwords to process a fraud complaint.
It is also important to examine recent account activity rather than focusing only on the transaction that triggered the alert. Fraudsters may attempt multiple payments, including smaller deductions that can go unnoticed.
Customers should take the following precautions:
- Review recent transactions: Check your bank statement and payment history for unfamiliar transfers, card payments or withdrawals.
- Change compromised credentials: Update passwords and block cards if their details may have been exposed.
- Avoid suspicious links: Do not click on unknown links received through text messages, emails or messaging applications.
- Never disclose OTPs: Do not share authentication codes, PINs or passwords, even with someone claiming to be a bank representative.
- Keep complaint records: Save transaction details, complaint numbers, emails, messages and other communication with the bank.
- Monitor account activity: Continue checking your account while the investigation is under way and report any further suspicious deductions immediately.
Why Reporting Time Matters In Bank Fraud Cases
An unauthorised transaction does not automatically mean that the account holder must lose the money permanently. RBI's framework provides specific safeguards, but customers must understand that protection depends on the circumstances of the incident.The distinction between bank negligence, third-party breaches and customer negligence is particularly important when determining liability.
For customers affected by digital banking fraud, the most sensible response is to contact the bank immediately, report the incident through the cybercrime helpline where appropriate and preserve all supporting records.
Acting quickly can help limit additional losses and improve the chances of obtaining relief under the applicable customer protection rules.
Disclaimer: This article is intended for informational purposes only and should not be considered legal or financial advice. Customer liability, refund eligibility and complaint resolution depend on the circumstances of each case and the applicable RBI regulations. Customers should contact their bank and the relevant authorities for assistance with suspected financial fraud.
Next Story