If money leaves your account or card in an electronic transaction you did not make or approve, contact the bank or card issuer immediately through a verified channel. Ask it to block the affected payment instrument or access, register the transaction as unauthorised, and give you a complaint number. Report the incident as soon as you see it. The applicable RBI directions make the facts, the type of issuer and the time of reporting relevant to liability. They do not guarantee that every disputed debit will be refunded.

This guide is about a payment initiated without your consent. A payment you approved but sent to the wrong person, a payment you made after being deceived, and a debit for a transfer that failed are different situations. Explain exactly what happened to the bank; do not label every mistaken or scam-related payment as an unauthorised transaction.

What to do first

  1. Contact the issuer using a verified channel. Use the number on your card or statement, the official app or website, or a branch. Ask the issuer to block the card, account access or payment channel at risk, stop further unauthorised debits where possible, and record each disputed transaction. RBI directions require covered banks and card issuers to provide channels for reporting unauthorised transactions and to acknowledge complaints. Save the complaint number and the date and time you reported it.
  2. Preserve the evidence. Keep the statement entry, SMS or email alert, transaction reference or UTR, amount, date and time, bank complaint, app messages, call logs and any relevant messages. Note when the bank sent its transaction alert and when you received or saw it. These dates can matter under the RBI reporting rules. Send copies through the issuer’s official complaint channel; keep the originals.
  3. Secure exposed access. From a trusted device, change credentials that may have been exposed, end unfamiliar sessions if the service allows it, and ask the issuer what else to block. Never share an OTP, UPI PIN, card PIN or password with someone who says they can reverse a payment.
  4. Report suspected online financial cyber fraud. You can call the Government of India’s 1930 helpline and file a report through the National Cyber Crime Reporting Portal. Keep the acknowledgement and follow the portal’s current instructions. This report does not replace a complaint to the bank or determine the bank’s liability.

First identify what kind of payment problem occurred

What happenedHow to describe it to the issuer
A debit or card payment was made without you initiating or approving itReport it as an unauthorised transaction and give the transaction reference. Ask the issuer to assess it under the rules for the account, card or payment instrument involved.
You approved a payment but entered the wrong UPI ID, account number or recipientSay that you authorised the transfer but it went to an unintended recipient. Ask your bank and UPI app for the applicable dispute route. Do not assume that the unauthorised-transaction liability rules or failed-payment reversal rules guarantee recovery.
You made a payment after a caller, message or website deceived youReport both the payment and how the deception occurred. Whether a transaction is treated as unauthorised depends on the facts and applicable payment-channel directions. Ask the issuer to state in writing which rule and facts it relied on. Do not assume that every deception claim automatically qualifies for zero liability, or that it can never qualify.
Your account was debited but the intended beneficiary was not credited, or a merchant did not receive confirmationDescribe it as a failed transaction and ask for the applicable reversal and compensation timeline. RBI has a separate framework for failed transactions; it does not cover every payment that reached the wrong recipient.

For a UPI transfer, raise the grievance through the app or participating bank as well as contacting your bank. The NPCI UPI FAQ says a payment cannot be stopped once initiated; that is why the recipient details and transaction status should be reported accurately. A debit without credit to the intended beneficiary is addressed separately by RBI’s failed-transaction framework.

How the RBI unauthorised-transaction rules work

The RBI’s 6 July 2017 directions for scheduled commercial banks (including Regional Rural Banks), Small Finance Banks and Payments Banks distinguish among bank-side fault, customer negligence, and a third-party breach where neither the bank nor the customer was at fault. RBI issued a corresponding direction for Primary Urban Co-operative Banks, State Co-operative Banks and District Central Co-operative Banks on 14 December 2017. Card issuers must also follow the applicable RBI card directions, which refer to the 2017 customer-liability circular. The current RBI PPI directions make a further distinction: bank-issued PPIs follow the applicable bank circular, while authorised non-bank PPI issuers follow a separate PPI liability framework. Identify who issued the card or wallet and ask which direction applies.

For the bank directions, the main outcomes are:

  • Bank-side fraud, negligence or deficiency: the customer has zero liability for an unauthorised transaction caused by the bank’s contributory fraud, negligence or deficiency, whether or not the customer has already reported it.

  • Third-party breach, with neither bank nor customer at fault: the customer has zero liability if they notify the bank within three working days of receiving the bank’s communication about the unauthorised transaction. The counting rule excludes the day the communication was received and follows the working schedule of the customer’s home branch. Report it immediately rather than waiting for the last day.

  • The same third-party breach reported after four to seven working days: the customer’s liability for each transaction is limited to the transaction value or the applicable RBI cap, whichever is lower. The 2017 circular for scheduled commercial, small finance and payments banks lists these caps for the account/card categories under that circular:

    Account or card category under the bank circularMaximum customer liability per transaction
    Basic Savings Bank Deposit account₹5,000
    All other savings accounts; bank-issued prepaid payment instruments and gift cards; current/cash-credit/overdraft accounts of MSMEs; current/cash-credit/overdraft accounts of individuals with annual average balance in the previous 365 days or limit up to ₹25 lakh; credit cards with a limit up to ₹5 lakh₹10,000
    Other current/cash-credit/overdraft accounts; credit cards with a limit above ₹5 lakh₹25,000

    These ceilings are not a general cap for every fraud or every late report. The cooperative-bank direction has its own category table; check that circular and the bank’s policy for a cooperative account.

  • The same third-party breach reported after seven working days: the bank’s Board-approved policy determines customer liability. Ask the bank for the policy and its written calculation.

  • Customer negligence: the 2017 directions give sharing payment credentials as an example. Where the bank determines that customer negligence caused the loss, the customer bears the loss up to the time the unauthorised transaction is reported to the bank; loss after the report is borne by the bank. The bank has the burden of proving customer liability. The facts, including what the customer did and what the issuer’s systems did, matter.

These categories are not a shortcut to deciding an individual claim. If you are unsure whether a payment was authorised, report it promptly and describe the complete sequence, including any impersonation, manipulation, credential exposure or device compromise. Ask the issuer to identify the applicable category, evidence and policy in its decision.

If a non-bank issued the prepaid payment instrument

The RBI’s current Master Directions on Prepaid Payment Instruments, updated 30 September 2026, keep bank-issued PPIs under the applicable bank or cooperative-bank circular and set out separate liability rules for authorised non-bank PPI issuers in paragraph 17. For those non-bank PPIs, the reporting windows use calendar days, not the working-day clock in the bank circular:

  • If the non-bank PPI issuer’s contributory fraud, negligence or deficiency caused the unauthorised transaction, the customer has zero liability, whether or not the customer reported it.
  • For a third-party breach where neither the issuer nor customer was at fault, reporting within three days of receiving the issuer’s transaction communication gives zero liability. Reporting within four to seven days limits liability for each transaction to its value or ₹10,000, whichever is lower. After seven days, the issuer’s Board-approved policy applies. The directions say to exclude the date of receiving the issuer’s communication when counting these days.
  • If customer negligence, such as sharing payment credentials, caused the loss, the customer bears the loss until reporting it to the issuer; the issuer bears losses after the report. The issuer has the burden of proving customer liability.
  • PPIs issued under the Mass Transit System (PPI-MTS) arrangement are outside these non-bank PPI liability paragraphs, except where the PPI-MTS issuer’s own contributory fraud, negligence or deficiency is involved.

After notification, the non-bank PPI issuer must credit a notional or shadow reversal within 10 days, without waiting for insurance settlement. The amount is value-dated to the transaction date, even if the credit exceeds the PPI’s normal maximum balance. The issuer must resolve the complaint and establish any customer liability within the time in its Board-approved policy, capped at 90 days. If it cannot do so within 90 days, it must pay the amount prescribed by the liability rules, whether or not customer negligence is involved. These reversal and resolution periods are stated in days; the 10-day notional reversal is distinct from the bank rule’s 10 working days. The ₹10,000 ceiling is specific to the qualifying four-to-seven-day third-party-breach case for non-bank PPIs; it is not a universal cap for bank accounts, cards, wallets or every fraud claim.

Provisional credit and the bank’s decision

Under the 2017 bank directions, after receiving the customer’s report, the bank must credit the amount involved as a shadow reversal within 10 working days, without waiting for an insurance claim to be settled; the credit is value-dated to the transaction date. This is a provisional credit under the directions, not a promise that every disputed transaction will be finally reimbursed.

The bank must resolve the complaint and establish any customer liability within the period in its Board-approved policy, capped at 90 days from receiving the complaint. If it cannot resolve the complaint or determine liability within 90 days, the directions require the specified compensation to be paid immediately. They also say a customer should not lose interest on a debit-card or bank-account loss or bear additional interest on a credit card. Ask for the applicable policy and a written explanation if the bank does not follow the required steps.

If the issuer does not resolve the complaint

First make a written complaint to the bank or other regulated issuer and keep proof of delivery, the complaint number and every reply. If the response is unsatisfactory, or the issuer does not reply within the applicable period, check whether both the issuer and complaint qualify under the Reserve Bank–Integrated Ombudsman Scheme.

The Reserve Bank–Integrated Ombudsman Scheme, 2026 took effect on 1 July 2026 and replaced the 2021 scheme. Complaints received before that date, related appeals and execution of awards under the earlier scheme continue under the 2021 scheme. The 2026 scheme covers specified regulated entities. For banks, it includes commercial banks, Regional Rural Banks, State Co-operative Banks, Central Co-operative Banks, scheduled Primary (Urban) Co-operative Banks, and non-scheduled Primary (Urban) Co-operative Banks whose deposits were ₹50 crore or more on the date of the audited balance sheet for the previous financial year. The Scheme defines “bank” to exclude a bank in resolution or winding up, or under All-Inclusive Directions. It also covers certain NBFCs, non-bank PPI issuers and Credit Information Companies; it does not cover every RBI-regulated service or entity.

Under clause 10, you generally must first complain to the regulated entity and be able to show proof. You may approach the Ombudsman if the entity has not replied within 30 days after receiving the complaint or the longer applicable period specified by RBI, NPCI or a card network, whichever is later, or if you are dissatisfied with its reply or resolution. The Scheme requires filing within 90 days from the end of the applicable response period or the last communication from the entity, whichever is later. It also requires that your complaint to the entity was made within the limitation period prescribed by the Limitation Act, 1963. Other maintainability conditions and exclusions apply: for example, clause 10 excludes certain matters involving commercial judgment, vendor or inter-entity disputes, actions taken to comply with authority orders, services outside RBI’s regulatory purview, employment matters, and customers of entities not included in the Scheme. Check the full Scheme before filing. Complaints can be lodged through the RBI Complaint Management System; filing under the Scheme is free for covered complaints.

Keep a folder with the bank complaint and response, account or card statement, alert, transaction reference, cybercrime acknowledgement and supporting messages. If the bank denies liability, ask it to explain the facts and RBI provision it relied on. For a substantial loss or a disputed classification, consider getting advice from a qualified Indian lawyer.

Official sources

Sources checked on 29 October 2026. These sources explain general rules; they do not determine the outcome of an individual complaint.

General information only, not legal advice. Issuer scope, reporting rules, and available remedies depend on the transaction and current official directions.

A payment authorised to the wrong recipient follows a different route; see the wrong UPI transfer guide. For other unresolved purchases or services, read the consumer complaint guide. Teams organising supporting records can explore Gotham workflows or contact Gotham about their process.

Questions

What should I do first after an unauthorised bank transaction?

Contact your bank or card issuer immediately through a verified channel, ask it to block affected access where appropriate, report each disputed transaction, and keep the complaint reference and reporting time.

Will the bank always refund an unauthorised transaction?

No automatic refund is guaranteed. RBI directions assign liability based on the facts, issuer type, cause of the transaction, and when it was reported. Ask the issuer for its written assessment under the applicable direction.

Is a payment I made after being deceived always an unauthorised transaction?

Not necessarily. Explain exactly what happened, including whether you initiated or approved the payment and how the deception occurred. The applicable treatment depends on the facts and payment-channel rules.

When can I approach the RBI Ombudsman?

The 2026 Scheme has entity, prior-complaint, timing, limitation, and other maintainability conditions. Check clauses 1 and 10 of the Scheme for your issuer and complaint; eligibility does not guarantee a refund or award.

General information only, not legal or financial advice. The available process and possible outcome depend on the transaction status, payment facts, issuer, and current official directions. Confirm your case through the institution’s verified channels.
How Gotham researches and reviews field guides

Share this guide