If you notice a bank debit that you did not authorise, act immediately. Speed matters because reporting can help the bank investigate and may affect how customer liability is assessed under the applicable rules. Do not wait for a stranger who calls claiming to be from the bank, and do not share an OTP or PIN to “reverse” the transaction.
Step 1: Contact the bank through an official channel
Use the bank’s official mobile app, website, card helpline or branch to report the transaction. Ask the bank to block or secure the affected payment instrument or digital access if needed. Record the complaint number, date and time. If you suspect your credentials have been exposed, change them using a trusted device and follow the bank’s security instructions.
Step 2: Preserve evidence
Keep the SMS alert, bank statement, transaction reference, amount, date and time. Save relevant screenshots and messages without clicking suspicious links. Do not delete evidence that could help the bank or investigators. If a phone call or message was involved, note the number and the claims made, but do not engage further with the suspected fraudster.
Step 3: Report cybercrime
In India, suspected financial cybercrime can be reported through the national cybercrime reporting portal at https://cybercrime.gov.in/. The national cybercrime helpline 1930 is also used for reporting financial cyber fraud. Report promptly and follow the instructions given by the authorities. A report does not guarantee recovery, but quick reporting may help the response.
What does RBI say about liability?
RBI’s framework on unauthorised electronic banking transactions distinguishes different circumstances, including whether the bank is at fault, whether a third-party breach occurred, and whether the customer shared credentials or delayed reporting. The applicable framework and amendments must be checked for the relevant bank and transaction. Do not assume every unauthorised debit automatically results in a full refund, and do not assume the customer always bears the loss.
Escalating an unresolved complaint
First use the bank’s complaint process and keep all references. If the bank rejects the complaint or does not respond within the applicable period, check eligibility for escalation under the RBI Integrated Ombudsman Scheme. Read the current eligibility and filing process on RBI’s official website.
Remember: A legitimate bank will not ask for your PIN or OTP to refund money. Act quickly, document every step and use official reporting channels. This article is informational; the outcome depends on the facts, timing and applicable rules.
Secure your accounts after reporting
Review recent transactions and check whether other accounts or cards may have been affected. Sign out of unfamiliar sessions, change compromised passwords and remove suspicious apps only after preserving relevant evidence. If you installed a remote-access application at a caller’s request, tell your bank and consider using a separate trusted device for account recovery. Inform family members who may be targeted by the same scam. Continue checking the complaint status and respond to official requests for information. Do not pay an intermediary who guarantees recovery; no private agent can promise that a disputed transfer will be returned.
Watch for follow-up scams
After a fraud report, a scammer may contact you pretending to be an investigator or bank official and claim that a refund is ready. Do not install remote-access software, share a screen, reveal a PIN or pay a processing fee. Contact the bank again using its official number if you receive an unexpected call about the complaint. Keep the original report number and provide updates through a trusted channel. If a device may be compromised, secure your email and mobile accounts as well as the bank account. Prompt, documented reporting is more useful than promises made by unofficial recovery agents.
