Bank Fraud? RBI Zero-Liability Rule That Protects Your Money

Under the RBI's July 2017 circular, if money leaves your account through an unauthorized electronic transaction and you were not at fault, your liability is zero when you report it within 3 working days of the bank's alert — and zero even without a time limit if the bank's own systems failed. The bank, not you, must prove you were negligent.

In April 2026, the Bombay High Court ordered HDFC Bank to return ₹38.04 lakh to a Pune businessman who lost the money in a SIM-swap fraud. The bank had refused for years, insisting it had sent OTPs. The court disagreed: when the fault lies with neither the bank nor the customer, the RBI's zero-liability rule applies — and the bank had to pay, with interest. If you bank online in India, this ruling and the rule behind it are the most important consumer protections you have never read.

The ₹38.04 lakh case every account holder should know

The facts, as recorded by the division bench of Justices Bharati Dangre and Manjusha Deshpande in their April 6, 2026 ruling: Subodh Korde, a Pune-based business consultant, held savings and current accounts with HDFC Bank. On July 14, 2021, three unknown beneficiaries were added to his account through net banking and his daily transaction limit was suddenly raised from ₹4 lakh to ₹40 lakh — he received no OTP alerts. The next day, ₹38.04 lakh was siphoned out through eight unauthorised transactions within 41 minutes. The method was SIM swapping: his telecom provider later confirmed his SIM had been fraudulently swapped multiple times between July 12 and 15, so the bank's OTPs went to the fraudsters' cloned SIM. When Korde saw the debits, he asked the bank to block the account and filed a police complaint. The bank denied liability, arguing it had sent SMS alerts and OTPs as required. The High Court held three things that matter to every customer: (1) The burden is on the bank. It is the bank that must establish the customer was negligent — not the customer who must prove their innocence. HDFC Bank failed to establish any negligence by Korde. (2) The 2017 RBI circular stands independent of any criminal investigation. The bank cannot demand a cyber-cell conclusion before honouring the zero-liability clause. (3) "Deprived of his own money" without fault has a price. The bank was ordered to remit ₹38.04 lakh within eight weeks, with 6% annual interest — rising to 8% if delayed. This was not a one-off act of judicial sympathy. It was the application of a written RBI rule that has existed since 2017.

RBI's liability rule: the three scenarios

The RBI's July 6, 2017 circular on "Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions" divides every fraud into three buckets. Find yours: Scenario 1 — The bank's fault. Contributory fraud or negligence on the bank's part: system breaches, technology failures, staff involvement. Your liability: zero, regardless of when you report it. Scenario 2 — Third-party breach, nobody's fault. Hacking, SIM swapping, malware — where the fault lies neither with the bank nor with you. Your liability: zero if you report within 3 working days of receiving the bank's communication (SMS/email alert) about the transaction. Report between the 4th and 7th working day and your liability is capped at a fixed amount under the circular's framework (₹5,000 to ₹25,000 depending on the account type). Report after 7 working days and your liability follows the bank's board-approved policy — which can be much worse. Scenario 3 — Your negligence. You shared your OTP, PIN or password, or otherwise compromised your credentials. Your liability: the entire loss until you report it. This is the bucket banks most often try to place you in — and, per the Bombay High Court, the bank must prove you were negligent; it cannot simply assert it. One more protection built into the circular: once you notify the bank, it must reverse the unauthorised transaction (a "shadow reversal") within 10 working days. The clock is on the bank, not just on you.

The 3-day clock: what counts and what kills your claim

The single most valuable sentence in the circular is the 3-working-day rule. Practical notes: The clock starts when you receive the bank's communication — the SMS or email alert — not when the fraud happened. Reporting means telling the bank (branch, customer care, official app), not just telling a friend or posting online. Get a complaint or ticket number. SIM-swap victims like Korde may never receive the alert at all — the court treated his prompt action on discovering the fraud as sufficient, and faulted the bank for not proving otherwise. After day 3, you do not lose everything — the 4-to-7-day window caps your loss at the fixed amount. Only beyond 7 days does the bank's own policy decide.

The new ₹25,000 proposal: even OTP-sharing may soon be covered

Here is the newest development, and it is a big one. At the February 6, 2026 monetary policy announcement, RBI Governor Sanjay Malhotra proposed a framework under which victims of small-value digital frauds — reportedly involving amounts below about ₹50,000, which make up roughly 65% of all reported digital fraud cases — would be compensated up to ₹25,000 or 85% of the loss, whichever is lower. The striking part: compensation would apply even where the victim shared their OTP, provided the fraud was not deliberate — a "no questions asked" approach for first-time, small-value victims. Early reports suggested the payout would be shared between the RBI, the banks (around 15%) and the customer (around 15%), with the benefit available once per customer. Important: this is a proposal, not a live scheme. The RBI said it would issue a discussion paper and a detailed framework. Until that framework is notified, the July 2017 circular above is the rule that actually protects you. Do not tell yourself "RBI will cover it" — report fast anyway.

The exact 5-step process when fraud hits your account

Step 1 — Tell your bank immediately. Call customer care or use the in-app fraud-report option. Ask them to block the account/card and the transaction channel. Note the complaint number and the time. Step 2 — Call 1930. This is India's national toll-free helpline for cyber-enabled financial fraud, run under the Home Ministry's Indian Cyber Crime Coordination Centre (I4C). Also file a report on cybercrime.gov.in. Speed matters: the system (CFCFRMS) can flag the money trail across banks before it is withdrawn. Government data says over ₹11,158 crore was saved across 32.8 lakh complaints till June 2026 — but note that "saved" means the money was frozen or held, not automatically refunded; restoration follows a separate process the Home Ministry formalised with new modules in April 2026. Step 3 — File an FIR. Visit your local police station or the cyber cell. Banks and courts take the claim more seriously with a police report on record, and the 2017 circular does not require you to wait for the investigation's conclusion. Step 4 — Demand the shadow reversal. In writing (email works), cite the RBI's July 6, 2017 circular on customer protection in unauthorised electronic banking transactions and ask for reversal within 10 working days. Written demands create a paper trail that verbal calls do not. Step 5 — Escalate if the bank refuses. Under the revamped RBI Integrated Ombudsman Scheme 2026, you can escalate 90 days after complaining to the bank (or sooner on rejection) — free, through cms.rbi.org.in or the toll-free 14448, with compensation up to ₹30 lakh where deficiency is established. Our RBI ombudsman guide walks through that process step by step.

This article is for educational purposes only and is not financial advice. Please consult a SEBI-registered investment adviser for personalized guidance. Investments are subject to market risk.