ECS or NACH Mandate Created Without Consent: Stop and Reverse It

Reviewed on: 2026-06-12.

An auto-debit is pulling money from your account for a mandate you never signed or approved. This is an unauthorised mandate, and you do not have to absorb the loss. Cancel or stop the mandate from your own bank at once, in the mandates or e-mandate section of net banking. Tell the company that registered it that you never gave consent, and ask it to cancel the mandate and refund every debit taken under it. Report the unauthorised debits to your bank in writing without delay, because the RBI's customer-protection framework limits a customer's liability for unauthorised electronic transactions, and prompt reporting is what protects you. If money has already gone, treat the larger amounts as possible fraud and report on the cybercrime portal too. If the bank or company stalls, escalate to the RBI Ombudsman at cms.rbi.org.in.

Reviewed on: 2026-06-12.

This guide is about a mandate created without your consent. It is different from a mandate that keeps running after a loan closes, and from a debit on an account you have already closed. Those are separate pages, linked below.

A NACH or ECS mandate needs your authorisation, by signature or by an electronic approval such as a debit-card or net-banking confirmation. If a mandate was registered without that, the debits under it are unauthorised. That matters for two reasons. First, you can have the mandate cancelled and the debits reversed. Second, under the RBI rules on limiting customer liability in unauthorised electronic transactions, a customer who reports promptly and is not at fault generally bears little or no loss. Speed of reporting is the single biggest factor, so act the day you notice it.

Sanjay in Bhopal saw a recurring debit of ₹499 each month on his statement, marked for a subscription service he had never bought. He had not signed any mandate. He opened his bank's app, found the e-mandate under “manage mandates”, and cancelled it. He then emailed both the service and his bank that the mandate was unauthorised, asked the service to refund all the ₹499 debits, and reported the unauthorised debits to the bank in writing the same day. Because he reported promptly and had not shared any OTP, the bank treated the debits as unauthorised and the amounts were reversed.

1. Cancel or stop the mandate from your bank now. In net banking or the app, open the mandates or e-mandate section, find the unauthorised mandate and cancel or stop it. If you cannot do it online, send your branch a dated written stop request.
2. Report the unauthorised debits to your bank in writing. State clearly that you never authorised this mandate. Prompt written reporting is what triggers the RBI zero or limited-liability protection.
3. Tell the company that registered the mandate. Email it that you gave no consent, demand cancellation and a refund of every debit, and ask how the mandate was created and on what authorisation.
4. Ask the bank to confirm the cancellation and reversal. Get written confirmation that the mandate is dead and the debits are reversed.
5. For larger amounts, treat it as fraud. Report on cybercrime.gov.in and consider a police complaint, especially if your card or net-banking credentials may have been misused.
6. Escalate if ignored. Use the bank's grievance officer, then the RBI Ombudsman under the Integrated Ombudsman Scheme at cms.rbi.org.in.

• Statement showing the unauthorised debit(s), with date, amount and the biller or mandate reference.
• The mandate reference, if your statement or app shows it.
• Your written report to the bank and the company, with timestamps.
• Confirmation that you did not share any OTP or password, if asked.
• Copies of all replies, dated, for any escalation.

RTI applies only to public authorities. If the debit involves a public-sector bank, you can file an RTI to its Public Information Officer for how and when the mandate was registered, on what authorisation, and the action taken on your unauthorised-transaction report. This can expose a mandate set up without a valid instruction.

RTI does not apply to a private bank or to a private company that registered the mandate. NPCI, which operates NACH, is also not the right address for an individual reversal. For private parties, use the bank's grievance route, the RBI Ombudsman, the cybercrime portal for fraud, and a consumer complaint where there is loss. RTI gives you records from a public-sector bank; it does not order a reversal.

To: The Branch Manager and Grievance Officer, [Bank name]
Subject: Unauthorised ECS/NACH mandate and debits on account [number],
request to cancel and reverse

Dear Sir/Madam,

A debit of Rs. [amount] is being taken from my account [number] on
[date(s)] through an ECS/NACH mandate [reference] for [biller name]. I
never signed or authorised this mandate.

I report these debits as unauthorised and request you to:
1. Cancel/stop the mandate immediately so no further debit is taken.
2. Reverse all amounts debited under this unauthorised mandate.
3. Confirm in writing the cancellation and the reversal.
4. Tell me how and when this mandate was registered, and on what
   authorisation.

I confirm I have not shared any OTP, PIN or password for this. Please
apply the RBI limited-liability protection for unauthorised electronic
transactions, as I am reporting this promptly.

Yours faithfully,
[Your name] | [account number] | Mobile/email: [contact] | [Date]

• Waiting to see if it stops on its own. The sooner you report an unauthorised debit, the stronger your liability protection. Report the day you notice it.
• Only cancelling the mandate, not reporting it. Cancelling stops future debits, but you must also report the past debits as unauthorised to claim a reversal.
• Sharing an OTP after the fact. Never share an OTP or password with anyone claiming to “verify” or “reverse” the debit. That itself is a fraud route.
• Treating a large unauthorised debit as a mere billing error. If credentials may be compromised, report it as cyber fraud as well.
• Letting the company blame the bank, or vice versa. Write to both, and escalate to the RBI Ombudsman if they pass you around.

• RBI Complaint Management System (Ombudsman)
• National Payments Corporation of India (NACH)
• National Cyber Crime Reporting Portal
• File an RTI online (public-sector bank)

• ECS debit continues after loan closure
• ECS debit after you closed the account
• Duplicate bank account opened in your name
• Practical Guides hub
• How to file an RTI online

Cancel or stop the mandate from your own bank's net banking or app in the mandates section, then report the debits to your bank in writing as unauthorised the same day. Prompt written reporting is what triggers the RBI limited-liability protection. Also email the company that registered the mandate to cancel it and refund the debits.

If you reported promptly and did not share any OTP or password, the RBI framework on unauthorised electronic transactions generally limits your liability, often to nil. Report the debits in writing, ask the bank for a reversal, and demand the same from the company. If they delay, escalate to the RBI Ombudsman.

Mandates can be set up by physical signature or by an electronic approval such as a debit-card or net-banking confirmation. If you gave none of these, it is unauthorised. Ask both the bank and the company, in writing, how and when the mandate was registered and on what authorisation.

No. That is a mandate you did authorise, which the lender failed to cancel after the loan closed. This is a mandate you never authorised at all. The remedy here centres on reporting it as unauthorised and claiming the limited-liability protection. See the linked loan-closure guide for the other case.

For larger amounts, or if your card or net-banking credentials may have been misused, yes. Report on cybercrime.gov.in and consider a police complaint, in addition to the bank report. A small recurring subscription debit may be a mis-set mandate, but treat anything that looks like credential misuse as fraud.

Only if the debit is on a public-sector bank account. Then you can RTI it for how the mandate was registered and the action on your report. RTI does not apply to private banks, private companies or NPCI for an individual reversal. Use the grievance route, the RBI Ombudsman and the cybercrime portal for those.

Review the mandates list in your net banking from time to time and cancel any you do not recognise. Be careful approving e-mandates during sign-ups and free trials, and never share an OTP or password. Turn on transaction alerts so an unauthorised debit shows up immediately.

Download the unauthorised-mandate stop-and-reverse checklist (PDF) and report the debit in writing the same day you notice it.