Can a Bank Refuse to Refund an Online Fraud Transaction? RBI Liability Rules Explained
Introduction
A person checks their bank account and discovers that ₹80,000 has disappeared.
They did not make the payment.
They did not recognise the beneficiary.
They immediately call the bank and report fraud.
The bank responds:
“The transaction was authenticated. We cannot refund the amount.”
Is that the end of the matter?
Not necessarily.
The Reserve Bank of India has a specific customer-protection framework governing unauthorised electronic banking transactions.
Depending on how the transaction occurred, whether the customer was negligent and how quickly the fraud was reported, the customer’s liability may be:
- zero;
- limited to a prescribed amount;
- or greater where the customer was negligent.
Most importantly, under RBI’s framework, the burden of proving customer liability lies on the bank.
This means a bank cannot automatically escape responsibility merely by saying:
“Your account was used.”
or
“The correct credentials were entered.”
The bank must assess the transaction according to the applicable RBI rules and its Board-approved customer-protection policy.
Recent court decisions have reinforced these protections. In April 2026, the Bombay High Court reiterated that where a transaction resulted from a third-party breach, neither the bank nor the customer was at fault, and the customer reported it promptly, zero liability under the RBI framework could entitle the customer to reimbursement.
However, not every online scam automatically creates a right to refund.
A crucial distinction exists between:
an unauthorised transaction
and
a transaction personally authorised by the customer after being deceived by a fraudster.
Understanding that distinction is the key to understanding bank liability.
What Is an Unauthorised Electronic Banking Transaction?
An unauthorised electronic banking transaction is broadly a transaction carried out without the customer’s approval or authority.
Examples may include:
- internet-banking account takeover;
- fraudulent card transaction;
- UPI transaction not initiated by the customer;
- compromised banking credentials;
- SIM-related fraud;
- malware-based account access;
- unauthorised mobile-banking transfer;
- or another electronic debit that the customer did not approve.
RBI’s customer-liability rules specifically address such transactions.
The framework covers various electronic banking channels including remote or online transactions such as mobile banking, internet banking and card-not-present transactions, as well as proximity transactions such as ATM, POS and QR-code transactions.
Can a Bank Legally Refuse a Refund?
Yes, in some circumstances.
But it cannot refuse arbitrarily.
The legal answer depends on:
- whether the transaction was actually unauthorised;
- who was responsible for the breach;
- whether the customer was negligent;
- when the customer reported the transaction;
- what evidence the bank has; and
- whether the bank complied with RBI requirements.
The RBI framework creates different categories of customer liability.
When Does the Customer Have Zero Liability?
RBI provides for zero liability in two important situations.
Bank fraud, negligence or deficiency
Where the unauthorised transaction occurs because of fraud, negligence or deficiency on the part of the bank, the customer bears zero liability.
This applies irrespective of whether the customer immediately reported the transaction.
For example, if a bank’s own security failure allows an attacker to access a customer’s account and transfer money without authorisation, the bank cannot normally shift that loss to the customer merely because the transaction passed through its systems.
Third-party breach with prompt reporting
The customer also has zero liability where:
- the breach occurred elsewhere in the system;
- neither the bank nor the customer was responsible; and
- the customer reported the unauthorised transaction within three working days of receiving communication from the bank about it.
This is one of the most important protections available to digital-banking customers.
Example: Zero Liability
Suppose ₹1 lakh is transferred from a customer’s account at 2:00 a.m.
The customer:
- was asleep;
- never approved the payment;
- never shared the OTP or PIN;
- receives an SMS in the morning; and
- reports the transaction to the bank immediately.
If investigation shows that the fraud resulted from a third-party breach and the customer was not negligent, the customer may fall within RBI’s zero-liability framework.
What Happens if the Customer Reports After Three Working Days?
Where neither the bank nor the customer is at fault but the customer takes four to seven working days to report the unauthorised transaction, limited liability applies.
The customer is liable for the lower of:
- the value of the transaction; or
- the monetary cap specified by RBI for the relevant account category.
The liability ceilings differ depending on the type of account.
Therefore, even delayed reporting does not automatically mean the customer must bear the entire loss.
What If the Customer Reports After Seven Working Days?
Where the delay exceeds seven working days, customer liability is determined according to the bank’s Board-approved policy.
Banks are required to formulate such customer-protection policies and make them available to customers.
This makes it important to ask the bank for a copy of its applicable unauthorised-transaction policy if a refund claim is rejected.
What Counts as Customer Negligence?
RBI specifically recognises that customer negligence may increase liability.
A classic example is where the customer shares payment credentials.
This may include:
- OTP;
- internet-banking password;
- card PIN;
- UPI PIN;
- CVV;
- login credentials;
- or other confidential authentication information.
Where the loss occurs because of customer negligence, the customer generally bears the loss until the unauthorised transaction is reported to the bank.
Any unauthorised loss occurring after reporting should be borne by the bank.
Does Clicking a Fraudulent Link Count as Negligence?
It can, depending on the facts.
Banks may argue customer negligence where a person:
- clicks an unknown phishing link;
- downloads a remote-access application;
- shares credentials;
- enters information on a fake website;
- or discloses authentication data.
However, merely asserting “customer negligence” is not enough.
The bank must be able to establish facts supporting that conclusion.
Under RBI rules, the burden of proving customer liability lies on the bank.
Can the Bank Say “OTP Was Used, Therefore You Are Liable”?
Not automatically.
The use of an OTP, PIN or password is highly relevant evidence.
But it does not necessarily answer every question.
A customer may dispute:
- receiving the OTP;
- entering it;
- controlling the device;
- authorising the transaction;
- or knowingly approving the payment.
A proper inquiry may require examination of:
- device logs;
- IP records;
- login history;
- OTP-delivery records;
- SIM information;
- geolocation data where available;
- transaction logs;
- fraud-monitoring alerts;
- and cybercrime reports.
In April 2026, the Bombay High Court emphasised that RBI’s framework is intended to protect customers from unauthorised electronic transactions and that the bank bears the burden of establishing the customer’s fault where it seeks to impose liability.
Bombay High Court’s 2026 Decision
A significant recent decision is Subodh C. Korde v. Union of India, decided by the Bombay High Court in April 2026.
The Court examined RBI’s 2017 customer-liability framework in detail.
It reiterated that where:
- there is a third-party breach;
- neither the bank nor the customer is at fault;
- and the customer reports the unauthorised transaction promptly,
the customer may have zero liability.
The Court also emphasised that the burden to establish customer liability rests upon the bank.
The Court directed reimbursement of approximately ₹76.9 lakh, together with interest, in the circumstances before it.
The significance of the judgment extends beyond the amount involved.
It reinforces the principle that RBI’s customer-protection circular creates substantive protections that banks must actually implement.
PNP Polytex Case
In another Bombay High Court decision from April 2026, PNP Polytex Private Limited v. Reserve Bank of India, the Court again discussed the RBI circular.
It observed that the RBI directions were created specifically to protect customers suffering financial losses through unauthorised electronic banking transactions.
The Court reiterated that prompt reporting and the absence of customer fault are central to determining liability.
These decisions demonstrate that RBI’s customer-liability framework is not merely advisory.
Banks must take it seriously when assessing fraud claims.
Does the Bank Have to Credit the Money Before Finishing the Investigation?
Where the zero- or limited-liability framework applies, RBI requires a shadow reversal.
On being notified of an unauthorised transaction, the bank must credit the amount involved to the customer’s account within 10 working days of the notification, without waiting for settlement of any insurance claim.
The credit must be value-dated to the date of the unauthorised transaction.
This means the customer should not suffer financial loss merely because the bank’s investigation takes months.
What Is a Shadow Reversal?
A shadow reversal is a provisional credit made to the customer’s account while the bank investigates the disputed transaction.
It is designed to restore access to the disputed amount while liability is being determined.
It does not necessarily mean the bank has finally admitted responsibility.
But RBI’s rules require timely provisional restoration where the framework applies.
How Long Can the Bank Take to Decide the Complaint?
Under RBI’s framework, the bank’s Board-approved policy must provide for complaint resolution and determination of customer liability within a period that cannot exceed 90 days from receipt of the complaint.
If the bank cannot resolve the complaint or determine liability within that period, the prescribed compensation must still be given to the customer.
The customer should also not suffer:
- loss of interest on a bank-account debit; or
- additional interest burden on a credit-card transaction
because of the unauthorised transaction.
Why Reporting Speed Matters So Much
The RBI rules deliberately link customer liability with reporting time.
The principle is straightforward.
Once the customer becomes aware of an unauthorised transaction, quick reporting allows the bank to:
- block further transfers;
- secure credentials;
- stop cards;
- disable digital banking;
- alert beneficiary banks;
- and reduce additional loss.
A person who waits several weeks after receiving alerts may therefore be treated differently from someone who reports within minutes.
How Is the Three-Day Period Calculated?
RBI specifies that the working days are calculated according to the working schedule of the customer’s home branch, excluding the date on which the customer received communication about the transaction.
This means consumers should preserve:
- SMS timestamps;
- email alerts;
- bank notifications;
- and complaint acknowledgements.
These can become critical in proving the reporting timeline.
Bank Must Provide Easy Fraud-Reporting Channels
RBI requires banks offering electronic banking services to provide customers with 24×7 access through multiple channels for reporting unauthorised transactions.
These may include:
- phone banking;
- website;
- SMS;
- email;
- IVR;
- toll-free helpline;
- and branch reporting.
Banks must also provide prompt acknowledgement and a complaint number, and their systems must record when alerts were sent and when the customer’s response was received.
These timestamps can directly affect customer liability.
What Should You Do Immediately After Discovering Fraud?
Do not wait for the fraudster to return the money.
Take action immediately.
Contact the bank
Report the transaction as fraudulent or unauthorised.
Ask the bank to:
- block further digital transactions;
- secure the account;
- register a formal complaint;
- issue a complaint number;
- and begin the unauthorised-transaction review.
Call 1930
For financial cyber fraud, immediately use the national cyber-fraud reporting helpline.
File an NCRP complaint
Report the matter through the National Cyber Crime Reporting Portal.
Preserve evidence
Keep:
- transaction ID;
- SMS;
- email alerts;
- screenshots;
- call logs;
- WhatsApp chats;
- fraudster’s number;
- beneficiary details;
- bank statement;
- and complaint acknowledgements.
Approach police/cyber cell
For serious fraud, lodge the appropriate criminal complaint.
The bank-liability process and criminal investigation can proceed separately.
Bank Refund and Cybercrime Recovery Are Different
This distinction is extremely important.
There are two potential ways a victim may recover money.
Bank liability
The bank reimburses the customer because RBI rules place the loss on the bank.
Cybercrime recovery
Police or banks trace and freeze the fraud proceeds in beneficiary or mule accounts and eventually restore them to the victim.
A person may qualify for one route, both routes or neither, depending on the facts.
What If the Victim Personally Approved the Transaction?
This is the most difficult category.
Suppose a fraudster pretending to be a police officer says:
“Transfer ₹2 lakh to this safe account or you will be arrested.”
The victim becomes frightened, opens their banking app and personally approves the transfer.
From a criminal-law perspective, the victim has clearly been cheated.
But from the banking-system perspective, the payment instruction may have been authenticated and intentionally initiated by the account holder.
RBI’s existing customer-liability framework specifically focuses on unauthorised electronic banking transactions.
Therefore, automatic zero-liability protection may be harder to establish in an induced-transfer case.
This does not mean the bank can never be liable.
Possible issues may still include:
- system deficiency;
- failure of fraud monitoring;
- violation of bank policies;
- suspicious transaction controls;
- or other service deficiencies.
But refund entitlement is much less automatic.
Digital Arrest Scams
Digital-arrest scams illustrate this distinction particularly well.
Fraudsters impersonate:
- police;
- CBI;
- ED;
- customs;
- RBI;
- telecom authorities;
- or judges.
Victims are told to transfer money into a so-called:
- safe account;
- government verification account;
- security account;
- or investigation account.
The victim may personally authenticate the transfer.
The transaction is fraudulent, but may not fit neatly into the RBI category of an unauthorised debit.
Immediate reporting to:
bank + 1930 + NCRP + police
is therefore especially important.
Fake Investment Fraud
The same problem arises where a person voluntarily sends money to what they believe is a legitimate investment platform.
If they knowingly initiate each transfer, they may find it difficult to argue that the bank executed an “unauthorised” transaction.
The primary remedy may instead involve:
- criminal investigation;
- account freezing;
- fund tracing;
- recovery proceedings;
- and regulatory action.
QR-Code Scam
Suppose a fraudster tells a person:
“Scan this QR code and enter your UPI PIN to receive your refund.”
The customer scans it and enters the PIN.
Money leaves the account.
The customer was deceived, but technically approved the debit.
This may make RBI’s automatic unauthorised-transaction protection more difficult to invoke.
That is why consumers should remember:
You generally do not enter a UPI PIN merely to receive money.
Remote-Access Scam
A fraudster persuades the victim to install a screen-sharing application.
The fraudster then obtains control over the phone and executes transfers.
The legal analysis becomes highly fact-specific.
Questions may include:
- Who actually entered the credentials?
- Did the customer reveal them?
- Was the device remotely controlled?
- Did the customer approve the transfers?
- Was the transaction alert received?
- Did the bank’s fraud systems detect abnormal activity?
The bank should not simply classify every remote-access scam in the same way without examining the evidence.
What If the Customer Shared OTP?
Where the customer voluntarily shares an OTP or payment credential, the bank may argue customer negligence.
RBI expressly gives sharing payment credentials as an example of negligence.
In such cases, the customer generally bears losses up to the point at which the bank is notified.
Any later unauthorised transactions should ordinarily fall on the bank.
What If the Customer Was Tricked Into Sharing the OTP?
The fact that the customer was tricked is relevant to criminal fraud.
But under RBI liability rules, the bank may still classify voluntary disclosure of confidential credentials as customer negligence.
The exact outcome depends on:
- the facts;
- bank policy;
- authentication records;
- and whether any bank-side deficiency also existed.
Can a Bank Waive Customer Liability Even if the Customer Was Negligent?
Yes.
RBI expressly allows banks, at their discretion, to waive customer liability even where customer negligence contributed to the unauthorised transaction.
This means the RBI framework sets a protective baseline but does not prevent banks from adopting more customer-friendly outcomes.
Burden of Proof Lies on the Bank
One of the strongest protections in the framework is that:
the burden of proving customer liability lies on the bank.
If a customer says:
“I never made this payment.”
the bank should not treat that statement as automatically false merely because its system records successful authentication.
The bank must examine the relevant evidence before assigning legal responsibility.
What Evidence Should You Ask the Bank For?
If the bank rejects your refund claim, request a reasoned written response.
You may ask for information concerning:
- transaction date and time;
- authentication method;
- device registration;
- OTP generation/delivery;
- IP or session information where available;
- beneficiary details;
- fraud alerts;
- UPI or internet-banking logs;
- and the basis for concluding that you were negligent.
You should also ask for the relevant Board-approved customer-liability policy.
Can the Bank Reject a Claim With a One-Line Email?
A bare statement such as:
“Transaction was authenticated and therefore customer is liable”
may not adequately address a genuinely disputed unauthorised transaction.
Where RBI’s protection framework applies, the bank should determine liability based on:
- responsibility for the breach;
- customer conduct;
- reporting time;
- and its customer-protection policy.
The bank’s final decision should be capable of being reviewed through its grievance mechanism and, where appropriate, by the RBI Ombudsman.
Escalate Within the Bank
If frontline customer support rejects the claim, escalate it.
Depending on the institution, escalation may include:
- branch manager;
- grievance officer;
- nodal officer;
- principal nodal officer;
- or designated digital-fraud grievance channel.
Keep every complaint number.
Avoid relying only on telephone conversations.
RBI Ombudsman Remedy
If the bank does not satisfactorily resolve the complaint, the customer may be able to approach the Reserve Bank Ombudsman.
The Reserve Bank – Integrated Ombudsman Scheme, 2026 came into force on 1 July 2026 and replaced the earlier 2021 scheme for new complaints.
It provides a cost-free and non-adversarial grievance-redress mechanism for complaints involving deficiency in service by covered RBI-regulated entities.
The customer must ordinarily first complain to the bank or other regulated entity and satisfy the maintainability requirements under the Scheme.
What Can the Ombudsman Examine?
Depending on the case, the Ombudsman may examine allegations that the bank:
- wrongly imposed customer liability;
- failed to follow RBI directions;
- did not process an unauthorised-transaction complaint properly;
- failed to reverse the amount within the applicable framework;
- delayed grievance handling;
- or provided deficient service.
The Ombudsman does not replace the police.
Criminal investigation of the fraud can proceed separately.
Is the RBI Ombudsman Free?
Yes.
The 2026 Scheme is designed as a cost-free grievance mechanism.
Consumers should therefore not pay private middlemen merely to file an Ombudsman complaint.
Can You Approach a Consumer Commission?
Potentially, yes.
Banking is a service for consumer-law purposes in appropriate cases.
A consumer complaint may be considered where the bank allegedly committed:
- deficiency in service;
- negligence;
- wrongful refusal to reimburse;
- failure to follow RBI directions;
- or deficient grievance handling.
The strength of the case will depend on the facts and evidence.
Can You Approach the High Court?
Sometimes.
High Courts have intervened in significant unauthorised-transaction disputes where RBI directions and customer rights were clearly involved.
The Bombay High Court’s April 2026 decisions demonstrate that writ jurisdiction may be invoked in appropriate circumstances.
However, writ proceedings are not always suitable where the central dispute requires extensive fact-finding.
For example, in Ashok Kumar Sharma v. State of Rajasthan, the Rajasthan High Court noted that questions such as whether transactions were truly unauthorised, whether OTPs were used and whether the customer or bank was negligent may require detailed evidence and technical examination not suited to summary writ adjudication.
The correct forum therefore depends on the nature of the dispute.
Does a Police Cybercrime Report Decide Bank Liability?
Not necessarily.
A criminal investigation and RBI customer-liability assessment serve different purposes.
The Bombay High Court in 2026 observed that RBI’s customer-protection framework operates independently of whether a criminal investigation has conclusively established cybercrime.
The bank cannot necessarily postpone every refund decision until the fraudster has been arrested or convicted.
Does the Bank Need to Wait for Insurance?
No.
RBI expressly provides that the bank should not wait for settlement of its insurance claim before providing the applicable shadow reversal to the customer.
The bank’s insurance arrangement is separate from the customer’s rights.
What If the Fraudster Has Already Withdrawn the Money?
That affects cybercrime recovery but does not necessarily decide bank liability.
If RBI’s zero-liability rules place the loss on the bank, the fact that the fraudster has disappeared with the money does not automatically transfer that loss to the customer.
Conversely, where the customer personally authorised the transfer and the bank bears no liability, recovery may depend heavily on tracing the fraud proceeds.
What If the Money Was Recovered From a Mule Account?
Then it may potentially be restored through the cybercrime recovery process, subject to applicable police, banking and judicial procedures.
This is separate from a claim asking the bank to reimburse an unauthorised transaction.
Practical Example 1: Bank-System Failure
A security flaw within a bank permits unauthorised transfers from a customer’s account.
The customer had done nothing wrong.
Under RBI rules, the customer should have zero liability where the loss arises from bank fraud, negligence or deficiency.
Practical Example 2: Third-Party Hack
A customer’s credentials are compromised without their negligence.
The customer reports the unauthorised transfer within one working day.
If responsibility lies neither with the customer nor bank but elsewhere in the system, the customer’s liability may be zero.
Practical Example 3: Report After Five Days
The customer was not negligent, but reports the transaction five working days after receiving notice.
The case falls into the four-to-seven-day category.
Limited liability may apply according to RBI’s prescribed ceiling.
Practical Example 4: Customer Shares Password
The customer tells a fraudster the internet-banking password and OTP.
₹1 lakh is transferred.
The customer notices the fraud and contacts the bank only after several transactions.
RBI’s rules may place the losses occurring before reporting on the customer because the customer shared payment credentials.
Practical Example 5: Customer Personally Sends Money to Fraudster
A person sees a fake investment advertisement and knowingly transfers ₹2 lakh to the provided bank account.
The investment website disappears.
This is fraud.
But the transfer was personally authorised.
The ordinary zero-liability rules for unauthorised transactions may therefore not automatically require the bank to refund the amount.
The focus should immediately shift to:
- 1930;
- NCRP;
- police;
- beneficiary-account freezing;
- and fund tracing.
Common Myths
Myth 1: “Banks never refund online fraud.”
Incorrect.
RBI rules expressly provide zero and limited customer liability in qualifying unauthorised transactions.
Myth 2: “The bank must refund every scam.”
Incorrect.
A transaction personally authorised by the customer after deception may not receive the same treatment as an unauthorised debit.
Myth 3: “Using an OTP automatically proves customer negligence.”
Not necessarily.
Authentication evidence is important, but the bank still bears the burden of proving customer liability in an unauthorised-transaction dispute.
Myth 4: “If the police have not caught the fraudster, the bank can refuse the claim.”
Not necessarily.
RBI customer-protection rules operate independently from final criminal prosecution in qualifying cases.
Myth 5: “The bank can wait months before crediting the amount.”
Incorrect where the RBI shadow-reversal requirement applies.
The relevant amount must be credited within 10 working days of notification under the framework.
Myth 6: “The bank’s insurance must pay first.”
Incorrect.
RBI expressly says the bank should not wait for settlement of its insurance claim before giving the required credit.
Practical Checklist After an Online Fraud Transaction
If you discover a suspicious debit:
- Report it to your bank immediately.
- Ask for the complaint/reference number.
- Block affected cards or digital channels where necessary.
- Call 1930 for cyber-financial fraud.
- File an NCRP complaint.
- Preserve SMS/email transaction alerts.
- Preserve screenshots and fraudster communications.
- Record exactly when you first learned of the transaction.
- Ask the bank whether it is treating the transaction as authorised or unauthorised.
- Request the bank’s customer-liability policy.
- Ask for a written reason if refund is refused.
- Ask whether shadow reversal has been processed.
- Escalate to the bank’s nodal grievance mechanism.
- Approach the RBI Ombudsman where applicable.
- Consider consumer or judicial remedies for unresolved substantial disputes.
Questions to Ask When the Bank Refuses Refund
Do not simply accept:
“Claim rejected.”
Ask:
Was the transaction classified as unauthorised?
What evidence proves I authorised it?
What specific act of negligence is alleged against me?
When does the bank say I received notice of the transaction?
When does the bank say I first reported it?
Which provision of the RBI customer-liability framework is being applied?
What is the bank’s Board-approved policy?
Why was zero or limited liability denied?
Was the 10-working-day shadow reversal considered?
A clear written answer makes further legal review much easier.
RBI’s 2026 Review of the Framework
In March 2026, RBI initiated a review of the older customer-liability framework and issued revised proposals for public consultation, including proposals concerning compensation for certain fraudulent electronic transactions and enhanced fraud safeguards.
As of the material publicly cited here, those March proposals were issued for consultation rather than replacing the existing operative framework discussed above.
Accordingly, consumers and lawyers should distinguish between:
existing binding customer-liability rules
and
new proposals undergoing regulatory review.
Frequently Asked Questions
Can a bank refuse to refund an online fraud transaction?
Yes, if the customer is legally liable or if the transaction does not fall within the unauthorised-transaction protection framework.
But the bank cannot reject a qualifying claim arbitrarily.
What is zero liability?
It means the customer bears none of the unauthorised transaction loss where the RBI conditions are satisfied.
How quickly must I report fraud?
Immediately.
For a third-party breach where neither the bank nor customer is responsible, reporting within three working days can result in zero liability.
What happens if I report in four to seven working days?
Your liability may be limited to the lower of the transaction value or the applicable RBI ceiling.
What happens after seven working days?
Liability is determined according to the bank’s Board-approved policy.
Who has to prove I was negligent?
The bank bears the burden of proving customer liability in an unauthorised electronic banking transaction.
Must the bank give a provisional refund?
Where RBI’s zero- or limited-liability framework applies, the bank must provide the applicable shadow reversal within 10 working days.
How long does the bank have to resolve the complaint?
The bank’s policy must provide for resolution within a period not exceeding 90 days.
Can I complain to RBI?
Yes, where the dispute involves deficiency in service by a covered regulated entity and the requirements of the Reserve Bank – Integrated Ombudsman Scheme, 2026 are satisfied.
Is the Ombudsman complaint free?
Yes.
What if I personally transferred money to a scammer?
You may still be a victim of fraud, but automatic reimbursement under the unauthorised-transaction framework can be harder because you authorised the payment instruction.
Can a cybercrime complaint help recover the money?
Yes, particularly if beneficiary accounts can be identified and frozen quickly.
The Most Important Question: Who Authorised the Payment?
In most online-fraud disputes, the legal analysis becomes much clearer once this question is answered.
Situation A
The customer never authorised the debit.
Then RBI’s unauthorised-transaction framework becomes central.
Situation B
The customer shared confidential credentials and someone else used them.
The transaction may still be unauthorised, but customer negligence becomes important.
Situation C
The customer personally entered the amount, beneficiary and PIN because a fraudster deceived them.
The victim has unquestionably been cheated.
But the bank may argue that the payment itself was authorised.
That distinction explains why two cyber-fraud victims who lose the same amount may receive very different refund decisions.
Conclusion
Can a bank refuse to refund an online fraud transaction?
Yes—but not merely because the bank says so.
Where an electronic transaction was genuinely unauthorised, RBI’s customer-protection rules determine how the loss should be allocated.
A customer may have zero liability where:
- the transaction resulted from fraud, negligence or deficiency on the part of the bank; or
- a third-party breach occurred without fault of the bank or customer and the customer reported the transaction within three working days.
Where reporting occurs within four to seven working days, limited liability may apply.
Where customer negligence—such as sharing payment credentials—caused the loss, the customer may bear the loss until the bank was notified.
But even then, losses occurring after notification generally shift to the bank.
Three additional protections are especially important.
First, the burden of proving customer liability lies on the bank.
Second, where the RBI liability framework applies, the bank must ordinarily provide the required shadow reversal within 10 working days rather than waiting indefinitely for the fraud investigation or an insurance claim.
Third, banks must resolve the complaint and determine liability within the period prescribed in their Board-approved policy, which cannot exceed 90 days under the framework.
Recent 2026 Bombay High Court decisions have reinforced that these protections are meaningful legal safeguards rather than optional banking practices.
At the same time, consumers must understand the limits.
A person who personally sends money to a fake investment platform, digital-arrest fraudster or fake merchant may still be a genuine victim of crime, but that transaction may not qualify in exactly the same way as a debit they never authorised.
In such cases, immediate cybercrime action becomes critical.
The practical response should therefore be:
report to the bank immediately, call 1930, lodge the cybercrime complaint, preserve all evidence and demand a reasoned written decision on liability.
If the bank rejects the claim, ask:
Why am I legally liable under RBI’s rules?
That is ultimately the question the bank should be able to answer with evidence.
This article reflects the RBI customer-liability framework and publicly available judicial and regulatory developments up to September 2026. RBI commenced a review of the framework in March 2026, and future final directions may modify the applicable rules. Refund entitlement remains fact-specific and depends particularly on authorisation, negligence and reporting time. This article is intended for general legal information and academic discussion and does not constitute legal advice.
