Customer Liability in Unauthorised Transactions: RBI Rules (IIBF)

One OTP read out over a phone call, one card cloned at a petrol-pump terminal, and an account is emptied before the alert SMS is even opened. Who absorbs that loss is not a matter of negotiation. The rules on customer liability in unauthorised transactions are laid down by the Reserve Bank of India, and they are among the most heavily examined items in the IIBF Prevention of Cyber Crime paper. Learn the reporting clock, the zero-liability triggers and the graded limits, and you can answer almost anything the paper asks on this topic.

This guide follows the order an examiner reads the framework in: scope first, then the three-way classification of fault, then the numbers, then the operational duties the bank cannot escape.

🛡️ Who Is Covered and Which Transactions Qualify

The anchor instruction is the RBI circular of 6 July 2017, Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (DBR.No.Leg.BC.78/09.07.005/2017-18), addressed to all scheduled commercial banks including regional rural banks. A companion circular dated 14 December 2017 extended the same discipline to urban cooperative banks, state cooperative banks and district central cooperative banks. A parallel framework issued in January 2019 by the Department of Payment and Settlement Systems applies to prepaid payment instruments issued by authorised non-bank PPI issuers, so a wallet customer enjoys broadly the same protection as a savings account holder.

The framework bites only on unauthorised electronic transactions — those the customer neither initiated nor authorised, whether remote (internet banking, mobile banking, UPI, card-not-present) or proximity based (ATM, point of sale, contactless card). That distinction is where most candidates slip. If a customer is talked into voluntarily pushing money to a fraudster, as happens in QR code and payment link fraud, the transaction is technically authorised and the liability grid does not automatically award a refund; the customer's remedy runs through the bank's grievance machinery instead.

Every bank must put in place a board-approved policy on customer protection that spells out the rights and obligations of customers, and it must be displayed and communicated in plain language. Understanding how these losses originate helps you apply the rule set faster — revise the chapter on Electronic Card Frauds alongside this article, because card-present skimming and card-not-present abuse fall on opposite sides of the evidence question. Correctly fixing customer liability in unauthorised transactions begins with correctly classifying the transaction itself.

⚖️ The Three-Way Split That Decides Who Bears the Loss

The circular sorts every dispute into one of three buckets, and the entire exam value of this topic sits in telling them apart.

One — contributory fraud, negligence or deficiency on the part of the bank. Here the customer's liability is zero, and crucially it is zero irrespective of whether the customer reported the transaction or not. A failed second-factor authentication, an internal staff fraud, a system that kept authorising after a card was hot-listed: all of it lands on the bank. The words "irrespective of reporting" are the tested phrase, so memorise them exactly.

Two — third-party breach where the deficiency lies neither with the bank nor with the customer but elsewhere in the system. This is the largest bucket in practice: a compromised merchant switch, a cloned SIM, a telecom-side interception. The customer's liability is zero only if the bank is notified within three working days of receiving the bank's communication about the transaction. Beyond that, liability is graded. Losses arising from SIM swap fraud in banking typically sit here, which is exactly why the three-day window matters so much to the customer.

Three — customer negligence, such as sharing payment credentials. The customer bears the entire loss until the transaction is reported to the bank. Any loss occurring after the report is borne by the bank, even in a negligence case. Banks also retain discretion to waive customer liability entirely. Studying the Channels Of Cyber Crimes chapter makes the second and third buckets far easier to separate, because the channel usually reveals where the compromise occurred. Applying customer liability in unauthorised transactions is therefore a fault-location exercise before it is a numbers exercise.

💡 Exam Tip: "Zero liability irrespective of reporting" belongs only to bank fault. "Zero liability if reported within three working days" belongs to third-party breach. Swapping those two phrases is the single most common way candidates lose this mark.

📊 Graded Limits and the Reporting Clock

Where the breach is third-party and the customer takes four to seven working days to report, the loss is capped by account type. Working days are counted as per the working schedule of the customer's home branch, excluding the date on which the bank's communication was received — another detail examiners like to hide inside a scenario question.

For prepaid payment instruments issued by authorised non-banks, the corresponding cap for reporting on the fourth to seventh day is ₹10,000 per transaction, with the same zero-liability rule for reporting within three days. Cooperative banks follow the commercial-bank grid under the December 2017 extension. Note that the caps are ceilings, not automatic deductions: a bank may absorb more, never less. You can cross-check the source text in the RBI notifications archive, which remains the only citation an examiner will accept.

⏱️ Bank Obligations, Burden of Proof and the Escalation Route

The liability grid only works if the customer is told a transaction happened, so the circular loads the bank with hard operational duties. Banks must insist on registration of mobile numbers for SMS alerts and, where available, e-mail identifiers for e-mail alerts. SMS alerts are mandatory for electronic transactions; e-mail alerts go to registered addresses. The alert must be capable of being replied to, so the customer can report a disputed debit without composing a fresh complaint.

Reporting channels must be available round the clock through multiple routes — website, phone banking, SMS, e-mail, IVR, a dedicated toll-free helpline and the home branch. A direct link on the home page of the bank's website, with a specific option for reporting unauthorised electronic transactions, is expressly required. The system must send an immediate response, including an automatic acknowledgement carrying the registered complaint number, and the bank cannot insist that the customer walk into a branch to lodge the complaint.

On being notified, the bank must credit the amount involved — the shadow reversal — to the customer's account within ten working days from the date of notification, with value date as of the date of the unauthorised transaction, and without waiting for settlement of any insurance claim. For credit cards the customer must not end up bearing interest on the disputed amount. The complaint must be resolved and liability established within the period set by the bank's board-approved policy, and in no case beyond ninety days from receipt of the complaint. If the bank cannot resolve it in ninety days, it must still compensate the customer as if it were a third-party breach.

⚠️ Common Mistake: Ten working days for the shadow credit, but ninety calendar days for resolution. Candidates routinely mix the units, and scenario questions are built precisely to catch that.

These duties dovetail with the bank's wider incident response obligations; read the Incident Management chapter and our companion piece on IT security threats in banks to see how a single reported debit escalates into a full incident. In practice, weak alert hygiene is the commonest reason customer liability in unauthorised transactions ends up disputed at all.

One sentence in the circular changes the balance of power completely: the burden of proving customer liability in case of unauthorised electronic banking transactions lies on the bank. The customer does not have to prove innocence. The bank must produce logs, device fingerprints, authentication trails and channel evidence to show negligence. Absent that proof, the customer is treated as blameless.

That said, a customer who preserves evidence resolves the claim far faster. Retain the alert SMS and e-mail exactly as received, note the date and time the bank's communication was actually received because the three-day clock runs from there, keep the automatic acknowledgement carrying the complaint number, save the bank's written replies, take screenshots of the app or netbanking statement, and lodge a complaint on the National Cybercrime Reporting Portal or the 1930 helpline where a criminal element exists. If a card was in the customer's possession throughout, say so in writing — it materially shifts the argument in a card-present dispute, a point developed further in the Computer Fraud Protection chapter.

If the bank does not comply — no shadow credit, no resolution, or a liability finding without proof — the customer may escalate to the Reserve Bank's Integrated Ombudsman once the bank has failed to reply within thirty days or has replied unsatisfactorily, filing online through the RBI's complaint management portal, by post or by e-mail. Frontline staff who follow a written control routine, such as our cyber crime prevention checklist for bankers, rarely reach that stage.

🧠 Practice MCQs: Customer Liability in Unauthorised Transactions

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

🎯 Key Takeaways and Your Next Step

Reduce the whole topic to four moves. Classify the fault — bank, third party, or customer. Count the working days from the date the bank's communication was received. Apply the cap for the account type if the report lands in the four-to-seven day band. Then check the bank's process duties: alerts, a 24x7 reporting channel with a home-page link, an auto-acknowledgement with a complaint number, shadow credit in ten working days, resolution in ninety days, and the burden of proof on the bank throughout.

Questions on customer liability in unauthorised transactions reward precision, not paraphrase, so drill the phrases rather than the gist. Work through more articles in the Prevention of Cyber Crime tag hub, revisit the COMPUTER INSECURITY chapter for the underlying vulnerabilities, and then put yourself under exam conditions with a full-length paper on iibf.store mock tests. If you are also preparing the professional papers, the same customer-protection logic recurs across the CAIIB course syllabus.