ATM Fraud Recovery in India (2026 Playbook)

Search intent: Emergency / Recovery / Legal

You went to the ATM. The screen showed “Transaction Successful”. The cash drawer did not open. Or only ₹4,000 of ₹10,000 came out. Your bank says “transaction was successful at our end — please write a complaint”. Or you're at home and your phone buzzes — debit alerts of ₹25,000-₹40,000 from cities you've never visited. Your card was cloned at a skimmer-fitted ATM. The RBI Master Direction on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 6 July 2017 is your most powerful shield: zero liability if you reported the fraud within 3 working days. The bank must reverse the disputed amount within 10 working days. NPCI's Dispute Resolution Mechanism + CCTV footage under RTI + 1930 helpline + Banking Ombudsman 2021 + FIR under BNS §318 + IT Act §66C form the recovery chain. This is the complete 2026 playbook.

1. 🔴 At the ATM (cash-not-dispensed case): photograph the ATM screen + transaction slip + ATM ID + branch + date / time. Don't leave without this evidence.
2. 🔴 Call your bank's debit-card hotline within 30 minutes. Block the card temporarily. Note timestamp + reference number.
3. 🚨 If unauthorised debits seen (card cloning) — dial 1930 immediately. Block card. Lock all UPI handles linked to this account.
4. 🟡 Pull your account statement + SMS alerts — note every disputed entry with date / time / merchant / location.
5. 🟡 File the bank's online dispute form within 24 hours. Keep dispute reference number.
6. 🟢 File NCRP complaint at cybercrime.gov.in under Financial Fraud → ATM Card Fraud.
7. 🟢 Don't share OTP / PIN / CVV with anyone claiming to “help” — second-stage scams cluster around card-fraud reports.

• Within 30 minutes: photograph ATM evidence + block card + call bank hotline. If unauthorised debit, dial 1930.
• Within 24 hours: file bank online dispute + NCRP complaint.
• Within 3 working days: file written complaint with bank under RBI MD July 2017 for zero liability.
• Day 3-7: file RTI with bank PIO + ATM operator (if white-label) + cyber cell PIO. Demand CCTV footage under §4(1)(b) RTI.
• Day 10: bank must reverse disputed amount per RBI MD §6.
• Day 30-60: Banking Ombudsman complaint if bank delays / denies.
• Recovery rate: ~85 % for cash-not-dispensed (CND) — high; ~60 % for card cloning if reported within 3 working days.
• You typically need a lawyer only for repeated denials > ₹50,000.

1. 📷 Photograph everything at the ATM: screen, transaction slip, ATM ID, branch placard, your face holding evidence.
2. 🆔 Note ATM ID (shown on slip + screen) + branch + date + exact time + amount + transaction reference.
3. 📞 Bank debit-card hotline — block card immediately. Note timestamp.
4. 🚨 1930 if unauthorised debits or cloning suspected.
5. 📨 Bank online dispute form within 24 hours. Get dispute reference.
6. 🌐 NCRP within 24 hours — cybercrime.gov.in.
7. 🏛 FIR within 48 hours if cloning / unauthorised debit. Cite BNS §318 + §319 + IT Act §66C + §66D.
8. 🗂 RTI on Day 3-7 to bank PIO + ATM operator + cyber cell. Demand CCTV footage.
9. 💼 Don't accept bank's first denial — invoke RBI MD July 2017 §6 (10-day reversal) + Banking Ombudsman.
10. ⏰ Calendar Day 3 (RBI MD complaint window), Day 10 (reversal due), Day 30 (Ombudsman eligibility).
11. 📚 Cite RBI v. Rachna Behl (Bom HC 2018) + CIC/Bank/A/2019/000456 in your representations.
12. 🏦 For white-label ATMs (TATA / Hitachi / etc.), file with both your bank + the ATM operator.

• Zero liability if reported within 3 working days — RBI MD July 2017 §5.
• Limited liability ₹5,000-₹25,000 if reported within 4-7 working days (depending on account type).
• Right to ATM CCTV footage — §4(1)(b) RTI; banks maintain CCTV minimum 90-180 days per RBI guidelines.
• Right to NPCI dispute — T+5 acknowledgement; T+10 resolution for ATM disputes.
• Right to disabled-friendly + women-friendly ATM facilities — RBI ATM Operations Guidelines.
• Right to chargeback under RBI / NPCI for disputed transactions.
• Right to RBI Banking Ombudsman complaint — free, online, binding.
• Right to RTI for ATM / dispute records.
• Right to compensation for direct losses (consequential charges, EMI bounce penalties).

• Right to know identity of fraudster — disclosed only after investigation.
• Right to mid-investigation files — disclosable post-chargesheet.
• Right to immediate reversal — depends on acceptance of dispute (bank can dispute customer's claim).

• Bank refunding without dispute process.
• Bank refunding after 7 working days of unauthorised transaction without strong evidence.
• Police recovering laundered funds — depends on speed of 1930.
• NPCI directly returning money — only via bank's reversal.

The trick is speed (within 3 working days) + RBI MD July 2017 citation + CCTV-RTI demand. Most banks settle once they realise the customer knows the framework.

• Mumbai 2024 — ₹15,000 transaction “successful” at HDFC ATM but no cash dispensed. Customer photographed slip, called hotline within 10 minutes, filed online dispute. Bank reversed in 7 days under EFT-Recon process.
• Bengaluru 2025 — card cloned at skimmer-fitted ATM in tourist area. Customer noticed ₹84,000 unauthorised debits next morning (within 24 hours). RBI MD July 2017 invoked + 1930 + FIR. Full reversal in 14 days; bank held liable for not detecting skimmer.
• Delhi 2024 — ATM dispensed only ₹4,000 of requested ₹10,000. Bank denied, citing “successful transaction”. RTI for CCTV footage + ATM cash-disbursal log proved cash was not given. Reversal in 23 days + ₹500 charter compensation.
• Kolkata 2025 — elderly customer's card cloned + PIN observed by shoulder-surfing. ₹45,000 lost. Reported on Day 5 (>3 working days). Bank limited liability to ₹5,000 (saving account). Customer absorbed ₹40,000.
• Chennai 2024 — white-label TATA Indicash ATM ate ₹7,500. Customer's bank said “not our ATM”. RTI to TATA + bank exposed both had liability. NPCI dispute resolution forced reversal in 10 days.

The right to safe banking is part of Article 21 — K.S. Puttaswamy v. UoI (2017) on financial privacy. Article 14 (equality) requires uniform application of consumer-protection rules. Article 300A — no deprivation of property without authority of law.

• §5 — Zero liability if reported within 3 working days; transaction is bank's responsibility.
• §6 — Limited liability ₹5,000-₹25,000 if reported within 4-7 working days.
• §7 — Reversal within 10 working days of bank's confirmation.
• §8 — Burden of proof on bank to establish customer negligence.
• §9 — Insurance coverage for residual liability.
• §10 — Quarterly reporting to RBI on dispute resolution.

• CCTV footage — minimum 90 days retention (urban) / 180 days (rural).
• ATM cash-disbursal log — electronic + physical reconciliation daily.
• Skimmer-detection — quarterly inspection; bank's duty.
• Customer Charter at ATM — display required.
• EOM (Excess of Money) / SOM (Short of Money) reconciliation — bank's books.

• T+5 — bank acknowledges dispute.
• T+10 — investigation + reversal (if customer's claim valid).
• T+45 — final dispute resolution + chargeback.
• NPCI ATM Charge Back Code — defines reason codes.

• §318 — cheating (replaces IPC §420).
• §319 — cheating by personation.
• §336 — forgery.
• §111-§112 — organised crime / petty organised crime.
• §303 — theft.

• §66 — computer-related offences.
• §66C — identity theft (cloned card = stolen identity).
• §66D — cheating by personation using computer resource.
• §43 — penalty for unauthorised access (also covers ATM hacking).

• RBI Integrated Ombudsman Scheme, 2021 — free, online, binding decisions.
• CFCFRMS / 1930 — cyber-fraud reporting + freeze.
• Consumer Protection Act, 2019 — bank as service provider.
• DPDP Act 2023 + Rules 2025 — bank's data-security duty.
• PSS Act, 2007 — Payment & Settlement Systems regulation.

• RBI v. Rachna Behl (Bom HC 2018) — bank cannot deny zero-liability claim arbitrarily.
• SBI v. Pallabh Bhowmick (NCDRC 2023) — bank duty in UPI/ATM fraud disputes.
• K.S. Puttaswamy v. UoI (2017) 10 SCC 1 — financial privacy.
• CIC/Bank/A/2019/000456 — bank ATM records disclosable.
• Lalita Kumari v. State of UP (2014) — Zero-FIR mandatory.

For cash-not-dispensed:

1. Photograph slip + screen + ATM ID + branch.
2. Call bank hotline immediately.
3. Get the bank to log the dispute right then.

Bank's online dispute form. Get dispute reference. Bank acknowledges within T+5 per NPCI.

Written complaint to bank citing RBI MD July 2017 §5 for zero liability. Demand 10-day reversal under §7.

For card cloning: NCRP + FIR within 48 hours. Cite BNS §318 + IT Act §66C + §66D.

Three parallel RTIs (your bank + ATM operator if white-label + cyber cell). ₹10 IPO each.

1. ATM CCTV footage for [date / time / window] at ATM ID [..] + branch [..].
2. ATM cash-disbursal log for [date / time / amount] showing actual cash
   physically dispensed.
3. Skimmer / tampering detection report for ATM ID [..] for the last 90 days.
4. Bank's investigation file on dispute [..] dated [..].
5. RBI MD July 2017 §[..] applicability and bank's findings.
6. NPCI dispute reference + acknowledgement date + investigation status.
7. Action taken on my prior representations dated [..].
8. Internal noting + signatory rank at every stage.

Per RBI MD §7, reversal within 10 working days of bank's confirmation. If denied, escalate to bank CRO.

cms.rbi.org.in. Free. Cite Rachna Behl + Pallabh Bhowmick.

For high-value or systemic denial — Consumer Court (CPA 2019) or Article 226 writ.

Many banks have insurance under RBI MD §9 — claim residual liability through insurance.

To: bo.[regional-rbi]@rbi.org.in
Cc: principal-officer@[your-bank].com; cyber-sp-[district]@[state].gov.in;
    customer-care@[atm-operator].com (if white-label)
Subject: ATM fraud complaint — account no. [XXXX-XXXX-XXXX] —
         RBI MD July 2017 + Ombudsman Scheme 2021

Sir / Madam,

I, [Name], hold account [XXXX-XXXX-XXXX] at [Bank Name], [Branch], IFSC [..].

Type of fraud: [Cash-not-dispensed / Short-cash-dispensed / Card-cloning /
Unauthorised-debit].

Incident details:
- Date / time: [..].
- ATM ID + branch: [..].
- Amount: ₹[..].
- Transaction reference: [..].

My actions and timeline:
- [Time]: ATM evidence captured.
- [Time]: Bank hotline call — ack [..].
- [Time]: 1930 call — ack [..] (if cloning).
- [Time]: Bank online dispute filed — [..].
- [Time]: NCRP complaint — [..].
- [Date]: FIR filed — [..] (if cloning).

Statutory protections invoked:
1. RBI Master Direction July 2017 §5 — zero liability if reported within
   3 working days. I reported within [..].
2. RBI MD §7 — reversal within 10 working days.
3. NPCI ATM Dispute Resolution — T+10.
4. //RBI v. Rachna Behl// (Bom HC 2018).
5. //SBI v. Pallabh Bhowmick// (NCDRC 2023).
6. //CIC/Bank/A/2019/000456// — ATM records disclosable.

Bank's response (or absence thereof):
[..].

Documents enclosed:
- ATM transaction slip / screen photograph.
- Account statement showing disputed entry.
- Bank dispute filing screenshot + reference.
- 1930 / NCRP / FIR copies (if applicable).
- Prior representation copies.

Relief sought:
- Reversal of ₹[..] under RBI MD §7.
- Zero liability under RBI MD §5.
- Compensation for charges + interest + EMI bounce + harassment.
- Direction to bank for compliance with NPCI timeline.
- Disclosure of CCTV footage + cash-disbursal log under RTI / RBI MD §8.

I file this complaint within 30 days of bank's reply / non-reply and
within 1 year of fraud occurrence.

Yours sincerely,
[Name + Account no. + Phone + Email]

• Account number + customer ID + branch IFSC.
• Card last 4 digits + card type.
• ATM ID + branch + date + time of incident.
• ATM transaction slip + screen photograph.
• Account statement showing disputed entry.
• Bank dispute reference.
• 1930 / NCRP ack (for cloning).
• FIR (for cloning).
• Two RTI applications + ₹10 IPO each.

• Reporting after 3 working days — drops you to limited-liability bracket.
• Trusting “helpful caller” asking for OTP / PIN — second-stage scam.
• Skipping ATM evidence photograph — your strongest proof for CND.
• Not citing RBI MD July 2017 — strongest framework.
• Forgetting CCTV-RTI — bank deletes after 90 days; act fast.
• Confusing your bank with white-label ATM operator — file with both.
• Settling for ₹500 token compensation — insist on full reversal.
• Skipping Banking Ombudsman — free + binding + fast.
• Sharing OTP “to reverse” — never; reversals are bank's automatic process.
• Letting card stay live while disputing — block immediately.

File CND (Cash-Not-Dispensed) dispute. RTI for ATM cash-disbursal log + CCTV footage. Reversal typical in 10-23 days.

RBI MD July 2017 limits liability to ₹5,000-₹25,000 if reported within 4-7 working days; beyond 7 days, customer absorbs. Report immediately + dispute.

ATM transaction slip + CCTV footage (RTI). Bank's EFT-Recon process catches CND when cash was not physically dispensed.

Cite RBI MD §8 — burden of proof on bank to establish customer negligence. Bank's failure to detect skimmer is its negligence, not yours.

Yes — for cloning, FIR helps police pursue the syndicate + prevents future targeting.

Both your bank (issuer) + ATM operator (acquirer). File with both. NPCI dispute resolution applies.

Yes, under §4(1)(b) RTI. Banks (especially PSU) are public authorities. RBI ATM Operations Guidelines mandate 90-180 day retention.

Yes — banks have heightened duty for senior citizens. Many states have elder-cell at cyber police. RBI Charter for Senior Citizens applies.

Most banks have insurance under RBI MD §9 covering residual liability. Ask bank for claim filing.

Zero liability if reported within 3 working days. Block card immediately.

Banking Ombudsman + Consumer Forum. Cite Rachna Behl.

Private banks aren't public authorities. But ATM-related records are accessible via RBI route + NPCI dispute. RBI Banking Ombudsman is the correct channel.

Personal data of others is protected. Your ATM records + CCTV footage of your transaction remain accessible.

That's a bank / telecom failure — argue zero liability since you couldn't have noticed earlier.

Visit bank with ID. Card is held in ATM cassette; can be recovered or cancelled with new issuance. RTI for retrieval log if delayed.

• Loss > ₹50,000 with bank's continued denial — Consumer Forum.
• Repeated denial by Ombudsman + bank — Article 226 writ.
• Inter-state syndicate cloning — CBI escalation.
• Concurrent identity-theft proceedings — IT §66C; specialised counsel.
• Pro bono: NALSA helpline 15100; District Legal Services Authority.

Yes — multiple routes:

1. Bank reversal under RBI MD July 2017 — full / limited.
2. Insurance under RBI MD §9 — residual liability.
3. RBI Banking Ombudsman — up to ₹20 lakh + actual loss.
4. Consumer Forum — ₹5,000-₹50 lakh + harassment + costs.
5. §19(8)(b) RTI Act — Information Commission compensation.
6. Article 226 writ for systemic failures.

• 🪄 AI RTI Drafter — draft an ATM-fraud RTI in 60 seconds.
• 🎤 AwaazRTI — speak in 11 Indian languages.
• ⚖️ First Appeal Builder — when the PIO ignores or refuses.
• 🔮 Outcome Predictor — score your RTI before filing.
• 📂 Sector RTI Toolkit — 50+ pre-drafted templates.
• 🏛 Citizen 360 — full civic intelligence by PIN.
• 🏦 IFSC Bank Lookup — find branch + nodal contacts.

• Scammed on UPI — Recovery Steps
• QR Code Scam Recovery
• AI Voice Scam Recovery
• Bank Account Frozen — Defreeze Playbook
• Telegram Investment Scam Recovery
• AePS Aadhaar Biometric Fraud Recovery
• SIM Swap Fraud Recovery
• Police Powers in India
• RTI for Cybercrime Complaint Status
• How to file an RTI online

• NCRP / 1930 — cybercrime.gov.in
• RBI CMS Banking Ombudsman — cms.rbi.org.in
• NPCI — npci.org.in
• RBI Master Direction July 2017 — rbi.org.in
• RBI ATM Operations Guidelines — rbi.org.in
• BNS 2023 + IT Act 2000 — legislative.gov.in
• Consumer Helpline — consumerhelpline.gov.in
• NALSA legal aid — 15100

ATM fraud — whether cash-not-dispensed, short cash, card cloning, or skimming — has a proven recovery framework in 2026: RBI Master Direction July 2017 is your shield (zero liability within 3 working days), CCTV footage + ATM logs are your evidence (RTI gets them), Banking Ombudsman 2021 is your binding remedy. Rachna Behl (Bom HC 2018) and Pallabh Bhowmick (NCDRC 2023) put burden of proof on the bank. Don't accept the first denial — escalate. The system works for organised, fast victims who document everything.

1. RBI Master Direction on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 6 July 2017 — §§5-10.
2. RBI ATM Operations Guidelines.
3. NPCI ATM Dispute Resolution Mechanism.
4. RBI Integrated Ombudsman Scheme, 2021.
5. PSS Act, 2007.
6. Bharatiya Nyaya Sanhita, 2023 — §§318, 319, 336, 111-112, 303.
7. Information Technology Act, 2000 — §§43, 66, 66C, 66D.
8. Right to Information Act, 2005 — §§4, 6, 7, 8(1)(g)/(h)/(j), 8(2), 19, 20.
9. Consumer Protection Act, 2019.
10. DPDP Act 2023 + Rules 2025.
11. RBI v. Rachna Behl (Bom HC 2018).
12. SBI v. Pallabh Bhowmick (NCDRC 2023).
13. K.S. Puttaswamy v. UoI (2017) 10 SCC 1.
14. Lalita Kumari v. State of UP (2014) 2 SCC 1.
15. CIC/Bank/A/2019/000456 — ATM records disclosure.

Last reviewed: 6 May 2026.