How-To · Banking Fraud · Last verified October 2026
How to Recover Money From a Fraudulent Bank Transaction (2026)
If money left your account in a transaction you never made, a card swipe, a net banking transfer, a mobile or UPI debit, you are not automatically stuck with the loss. A Reserve Bank of India rule can bring your liability to zero, but it turns on one thing above all: how fast you report it to your bank. This guide sets out the limited-liability rule, the reporting deadline that protects you, how the bank must act, and where to escalate if it drags its feet. It is general information, not legal advice. Last verified October 2026.
- Report fast: notify your bank in writing the moment you notice an unauthorised debit, and keep the acknowledgement.
- Zero liability: where the bank is at fault, or a third-party breach is reported within three working days.
- Limited liability: capped under the RBI circular where reported within four to seven working days.
- Burden on the bank: the bank must prove a customer was at fault, and must credit back the amount within the RBI timeline.
- Escalate: the free RBI Integrated Ombudsman Scheme if the bank does not resolve it, usually within 30 days.
01The short answer
Recovering money from a fraudulent bank transaction works like this:
- Report to your bank immediately, in writing, and keep the acknowledgement.
- Your liability can be zero if the fault was the bank, or if a third-party breach is reported within three working days.
- The bank must credit back the amount within the RBI timeline once zero liability is established.
- Escalate to the RBI Ombudsman, free, if the bank does not resolve it, and report the crime on cybercrime.gov.in and 1930.
The deadline is everything. Reporting within three working days is what keeps your liability at zero in a third-party fraud, so do it the moment you notice the debit.
02The RBI limited-liability rule
RBI issued a circular on 6 July 2017 on customer liability for unauthorised electronic banking transactions. It covers debits through cards, net banking, mobile banking and UPI that you did not carry out, and it fixes how much of the loss you must bear based on who was at fault and how fast you reported:
| Situation | Customer liability |
|---|---|
| Bank fault, fraud, negligence or deficiency | Zero, whether or not you report |
| Third-party breach, reported within 3 working days | Zero |
| Third-party breach, reported in 4 to 7 working days | Limited and capped per the circular |
| Your own negligence, for example sharing credentials | Full loss until you report |
The "working days" run from the bank communication to you about the transaction.
The exact caps and timelines are set by the RBI circular and your bank policy; confirm the current figures with your bank.
undefined
03Report to your bank first, and fast
The single most important action is to notify your bank immediately, in writing, through its official channel: phone banking, the branch, or the reporting link in the app or on the website. Record the date and time you reported, because the three working day clock is measured from the bank communication, and your report fixes where you stand on the liability table.
Get an acknowledgement or a complaint reference. If you only called, follow up with an email or written complaint the same day so there is a dated record. This written proof of when you reported is what protects your zero liability.
04When your liability is zero
Your liability is zero in two situations. First, where the loss is due to the bank fault, such as its own fraud, negligence or a deficiency on its part, you owe nothing whether or not you reported. Second, where the loss is due to a third-party breach elsewhere in the system and you reported within three working days, you again owe nothing.
If you reported a little later, within four to seven working days, your liability is limited and capped under the circular. The one case where you bear the full loss, until you report, is where your own negligence caused it, such as sharing your PIN, OTP or password. This is why you must never share credentials and must report the instant you notice a wrong debit.
05How the bank must act
Once you report, the bank must investigate. Where you are entitled to zero or limited liability, the bank is required to credit the amount back to your account within the timeline set by the RBI framework, and the burden to prove that a customer was at fault lies on the bank, not on you.
Insist on a written outcome. If the bank says you are liable, ask it to state the reason and the evidence, because it must justify any liability it places on you. Keep that correspondence, as it is the heart of any later escalation.
06Escalate to the RBI Ombudsman
If the bank does not resolve the complaint or wrongly puts the loss on you, escalate to the RBI Integrated Ombudsman Scheme, 2021. It is free, and you can approach it if the bank does not resolve the complaint in the time allowed, usually 30 days, or rejects it.
The Ombudsman can direct the bank to credit the amount back and can award compensation for the loss and the harassment caused. Lodge the complaint through the RBI complaint management portal, attaching your dated report to the bank and its response.
07Report the crime too
The bank route recovers your money; the crime still needs reporting. File on the National Cyber Crime Reporting Portal at cybercrime.gov.in and call 1930, so the beneficiary account can be flagged for a hold, and lodge an FIR if needed.
For the full reporting walk through, see how to report cyber crime and online fraud, and for a UPI or payment specific fraud, what to do after UPI or payment fraud. If your identity was also stolen, see how to report identity theft.
08Where Claw fits
Claw is an all-in-one legaltech platform for Indian advocates, law firms, and corporate legal teams, combining AI-based case search, an AI legal assistant (Legal GPT), case management, and compliance automation across all Indian courts and tribunals.
Be clear on the limits. The recovery itself runs through your bank, the RBI Ombudsman and the cybercrime portal; Claw is not those filings and does not replace them. Where Claw helps is the dispute and case layer that follows: it tracks banking ombudsman escalations, consumer commission matters and the resulting court cases and appeals, across 9,102 courts, benches and forums, with alerts and monitoring, so a customer or an adviser can follow a recovery matter as it moves. Its Legal GPT researches across 30 crore+ judgments, with Supreme Court decisions from 1950 and High Court decisions from 1990, so an adviser can see how forums have read the limited-liability rule. Results return in under 5 seconds, and Claw does not train its AI models on your documents. To check whether a bank or an entity involved has existing litigation, run a case search across Indian courts by name. A clean result means nothing was found on the forums and date searched, and this is general information, not legal advice.
Related reading: what to do after UPI or payment fraud, how to report identity theft, and how to report cyber crime and online fraud.
09Sources and further reading
- Reserve Bank of India (customer liability circular, Ombudsman scheme): rbi.org.in
- RBI Complaint Management System (Ombudsman complaints): cms.rbi.org.in
- National Cyber Crime Reporting Portal (and helpline 1930): cybercrime.gov.in
- Claw: clawlaw.in
This guide is general information, not legal advice. Report an unauthorised debit to your bank and to 1930 at once.
10Frequently asked questions
Can I get my money back after a fraudulent bank transaction?
Often yes, and your liability can be zero if you act fast. Under the RBI circular of 6 July 2017 on unauthorised electronic banking transactions, you owe nothing where the loss is due to the bank fault, or due to a third-party breach that you report within three working days of the bank communication. Notify your bank in writing immediately, keep the acknowledgement, and ask it to credit the amount back within the RBI timeline.
How fast must I report an unauthorised transaction?
Immediately. The three working day window is what keeps your liability at zero in a third-party fraud, measured from the bank communication to you about the transaction. Reporting within four to seven working days leaves you with a limited, capped liability under the RBI circular. If the loss was caused by your own negligence, such as sharing your PIN or OTP, you bear the full loss until you report, which is another reason to report the instant you notice.
What if the bank refuses to refund the money?
Ask the bank to state in writing why it holds you liable and the evidence for it, because under the RBI rules the burden to prove a customer was at fault lies on the bank, not on you. If the bank does not resolve your complaint in the time allowed, usually 30 days, or rejects it, escalate free of cost to the RBI Integrated Ombudsman Scheme, 2021, which can direct the bank to credit the amount back and award compensation for the loss and harassment.
Does the RBI rule cover UPI and card fraud?
Yes. The RBI limited-liability framework for unauthorised electronic banking transactions covers debits through cards, net banking, mobile banking and UPI that you did not authorise. The same zero, limited and full liability bands apply based on who was at fault and how fast you reported. For a UPI specific fraud you should also raise a dispute in the UPI app and report on the cybercrime portal, in addition to notifying your bank.
Should I report a fraudulent transaction to the police as well as the bank?
Yes. The bank route is how you recover the money under the RBI rules, but the fraud is also a crime. File on the cybercrime portal at cybercrime.gov.in and call 1930 so the beneficiary account can be flagged for a hold, and lodge an FIR if needed. Report to the bank and to the cybercrime portal in parallel, because each serves a different purpose, recovery on one side and investigation on the other.