Unauthorised debit: the 3-day rule from RBI
RBI's circular of July 6, 2017 on customer liability sets this table for third party breaches, where the fault is neither yours nor the bank's:
| You report within | Your liability |
|---|---|
| 3 working days | Zero |
| 4 to 7 working days | Transaction value or the Table 1 cap, whichever is lower |
| Beyond 7 working days | As per the bank's Board approved policy |
Days count from when you receive the bank's message, excluding that date, by your home branch's working schedule.
Then the bank
It must credit the amount (shadow reversal) within 10 working days of your report, and resolve the complaint within 90 days.
Example
Illustrative example only. SMS at 9pm on a Monday: ₹40,000 debited. You report on Tuesday morning. That is within 3 working days. On a savings account, a report on working day 5 could leave you with up to ₹10,000.
⚠️ Note
If you shared your credentials, you bear the loss until you report. Check the bank's current policy, since RBI may issue newer directions.
If it happens
- ☐ Report at once by the bank's 24x7 channel
- ☐ Note the time and complaint number
- ☐ Send the complaint in writing
- ☐ Keep the SMS and statement
Complaint letter to the bank is ready, fill it in →
Source: RBI circular DBR.No.Leg.BC.78/09.07.005/2017-18, July 6, 2017.