An unauthorised digital payment can happen through phishing, account compromise, social engineering, remote access applications, SIM related attacks or misuse of payment credentials. The legal position varies, but the immediate response should focus on stopping further loss and creating a reliable report.
RBI customer protection directions make the timing and circumstances of reporting relevant in assessing liability for certain unauthorised electronic banking transactions. That is one reason a victim should not wait to collect every possible detail before first notifying the bank or payment provider.
1. Notify the bank or payment provider immediately
Use the official fraud reporting channel of the bank, card issuer, wallet or payment provider. Record the complaint number, time of reporting and any acknowledgement received.
If credentials may be compromised, also use the provider’s security controls to block or restrict further transactions and change affected passwords through a trusted device.
2. Preserve the transaction trail
Keep the transaction ID, UTR/reference number, amount, beneficiary details, timestamps, SMS alerts and account statement. Preserve the full conversation or call record that led to the payment or credential disclosure.
Screenshots are useful, but original emails, message exports, call numbers, URLs and device records can provide stronger context.
3. Customer liability can depend on how the transaction occurred and when it was reported
RBI directions distinguish, among other situations, bank side deficiency, certain third party breaches and cases involving customer negligence. The facts therefore matter; a bank should not assume that every disputed digital transaction creates identical liability.
Where the bank rejects the complaint, ask for the reason, the transaction authentication record and the policy or framework relied upon.
4. Report the cybercrime separately where appropriate
Bank reporting and law enforcement reporting serve different purposes. A cybercrime report can help preserve the criminal/fraud trail, while the bank complaint addresses the payment relationship and account action.
Provide the same transaction chronology consistently and avoid deleting the messages or application data that may identify the route used.
5. Be cautious of “recovery” scams after the fraud
Victims are often targeted again by persons claiming they can reverse the payment for a fee, requiring a QR code scan, screen sharing or a further transfer. Use only official bank, police, cybercrime and regulatory channels.
Never share OTPs, PINs, passwords or remote access control merely because the caller claims to be helping with the earlier fraud.
Evidence checklist
Keep one folder containing the transaction and every escalation step.
- Bank/payment provider complaint and acknowledgement.
- Transaction statement, UTR/reference number and beneficiary details.
- Messages, emails, phone numbers, URLs and screenshots connected with the fraud.
- Cybercrime/police complaint reference where made.
- Subsequent bank responses, provisional credits or rejection reasons.
Reference framework
Legal framework referred to in this article
- Reserve Bank of India customer protection directions on unauthorised electronic banking transactions
- Information Technology Act, 2000
- Bharatiya Nyaya Sanhita, 2023 where fraud/personation offences are alleged
Primary materials
This article summarises the legal and regulatory framework relevant to the topic. Later amendments, factual differences and applicable directions may affect the position.