Cyber-fraud RTI bundle: 3 parallel RTIs to RBI, NPCI and bank, citizen guide 2026
Quick answer. On day 1 of any cyber-fraud complaint, file 3 RTIs in parallel: one to RBI (bank conduct, circular compliance), one to NPCI (transaction trace, fraud-flag timing) and one to the receiving bank (KYC, lien status). Total fee is Rs 30 (Rs nil for BPL). Reply deadline is 30 days under §7(1) of the RTI Act 2005. The bundle pries open three different parts of the recovery chain at once, instead of waiting silently after the 1930 / NCRP call.
Short on time? Jump to The 3 RTIs at a glance for ready-to-copy drafts, then to the 5 magic questions each RTI must carry.
Why one complaint is not enough
After a cyber-fraud, most citizens dial 1930, file the NCRP web form, call the bank, and then wait. A complaint number arrives, a lien may get placed, and nothing else happens for weeks. The file is “under processing”, the call-centre stops picking up, and the trail goes cold.
The problem is not that the system did nothing. It is that the three institutions actually holding your money, RBI, NPCI and the receiving bank, never speak to the citizen directly. They speak to each other via portals and back-channels, and the victim gets a one-line SMS at the end.
The RTI Act 2005 lets you walk into that closed conversation. Section §6 lets any citizen ask any public authority for the records on their case; §7(1) gives the PIO 30 days to reply; §8 lists the narrow exemptions. The Supreme Court has settled that RBI is a public authority under §2(h) and cannot hide behind “fiduciary relationship” (*RBI v. Jayantilal Mistry* (2016) 3 SCC 525). NPCI, though a §8 company, has been treated as a public authority for RTI purposes in multiple CIC orders because of its statutory role under the Payment and Settlement Systems Act 2007.
Filed in parallel, the 3 RTIs land on three different PIO desks on the same day, run their 30-day clocks simultaneously and produce a paper trail you can wave at the banking ombudsman, the consumer commission, or the High Court. That is the bundle.
Why the bundle works (each authority sees a different slice)
- RBI sees your bank's compliance posture: did it follow Master Direction DBR.No.Leg.BC.78/09.07.005/2017-18 on customer protection? Did it acknowledge the 1930 referral inside the deemed-reporting window? Did it raise an ombudsman case?
- NPCI sees the transaction itself: the exact UPI / IMPS / NEFT trace, the beneficiary-bank acknowledgement, the timestamp at which 1930 / I4C injected the fraud-flag into the chain, and whether the receiving bank responded inside the SLA.
- The receiving bank sees the mule account: when KYC was last refreshed, who opened the account, when the lien on your money was placed, and why it has not yet been transferred back to you.
No single one of these three holds the full picture. Each can refuse half your question. Together, they cannot. That asymmetry is the point of the bundle.
The 3 RTIs at a glance
| # | Public authority | PIO address | Core ask | Fee |
|---|---|---|---|---|
| 1 | Reserve Bank of India | CPIO, Reserve Bank of India, Customer Education and Protection Department, 1st Floor, Amar Building, Sir P M Road, Fort, Mumbai 400001 | Bank's SOP, circular compliance, ombudsman mapping | Rs 10 IPO / DD / online |
| 2 | National Payments Corporation of India | CPIO, NPCI, 1001A B Wing 10th Floor, The Capital, Bandra-Kurla Complex, Bandra (East), Mumbai 400051 | Transaction trace, fraud-flag timestamp, beneficiary ack | Rs 10 IPO / DD / online |
| 3 | Receiving bank (the one where your money landed) | CPIO at the bank's RTI cell (PSB: head office; private bank: customer protection cell) | KYC of the receiver, lien date, lien lift / transfer status | Rs 10 IPO / DD / online |
You file all three on the same day, ideally within 7 days of the fraud, and keep the postal receipts or the rtionline.gov.in transaction IDs in a single folder.
RTI #1: To the Reserve Bank of India
PIO address
The Central Public Information Officer Reserve Bank of India Customer Education and Protection Department (CEPD) 1st Floor, Amar Building Sir P M Road, Fort Mumbai 400001
Alternative: file online via rtionline.gov.in and pick “Reserve Bank of India” from the public-authority list. The fee is Rs 10, paid by debit card / net-banking / UPI inside the portal.
What to ask RBI
- The SOP that <your bank> must follow under Master Direction DBR.No.Leg.BC.78/09.07.005/2017-18 on Customer Protection when a customer reports fraud via 1930 / NCRP.
- The exact timestamp at which RBI's CEPD or the ombudsman office first received your case from 1930 / I4C / your bank.
- Whether your case is mapped to an ombudsman complaint under the RBI Integrated Ombudsman Scheme 2021, and if so the reference number.
- The number of similar fraud complaints against the same beneficiary IFSC / account in the last 12 months (aggregate, not third-party, so §8(1)(j) does not apply).
- Copies of any inspection or supervisory action against <your bank> in the last 24 months for failure to credit “zero-liability” reversals within 10 working days, as required by the 2017 Master Direction.
Sample RTI text to RBI
To, The Central Public Information Officer Reserve Bank of India Customer Education and Protection Department 1st Floor, Amar Building, Sir P M Road Fort, Mumbai 400001 Subject: Request under §6(1) of the RTI Act 2005 Sir / Madam, I, [Name], a citizen of India, am the victim of a cyber-fraud reported to the National Cybercrime Reporting Portal on [date] vide acknowledgement no. [NCRP ack]. The sum of Rs [amount] was debited from my account no. [last 4 digits] held at [your bank], IFSC [IFSC], to beneficiary account [last 4 digits] at [receiving bank], IFSC [IFSC], on [date and time of fraud]. Under §6(1) of the RTI Act 2005, I seek the following: 1. A certified copy of the SOP my bank is bound to follow under RBI Master Direction DBR.No.Leg.BC.78/09.07.005/2017-18, for cases of unauthorised electronic transactions reported through the 1930 / NCRP channel. 2. The date and time on which RBI / its ombudsman office first received a reference of my case from I4C / 1930 / my bank. 3. Whether my case is mapped to a complaint under the RBI Integrated Ombudsman Scheme 2021, and if so, the reference number assigned. 4. The aggregate count of fraud-related complaints in the last 12 months against beneficiary IFSC [IFSC] and account [last 4 digits], with month-wise break-up. 5. Copies of any supervisory or inspection action taken against [your bank] in the last 24 months for failure to reverse zero-liability cases within 10 working days as mandated by para 8 of the 2017 Master Direction. I am attaching an IPO of Rs 10 (no. [IPO number]) towards the application fee. Information may please be furnished within 30 days as per §7(1) of the RTI Act. Should any part of this request be deemed exempt, kindly sever the exempt part and furnish the rest under §10(1), recording reasons under §7(1)/§8(1) in writing. Yours faithfully, [Name] [Address] [Phone] [Email] Date: [DD/MM/2026]
Why this RTI works
It does not ask for the fraudster's data. It asks for your bank's compliance behaviour and your case's status inside RBI's machinery. §8(1)(j), §8(1)(e) and §8(1)(h) have all been knocked back by the Supreme Court in *Jayantilal Mistry* for exactly this kind of question.
RTI #2: To the National Payments Corporation of India
PIO address
The Central Public Information Officer National Payments Corporation of India (NPCI) 1001A, B Wing, 10th Floor The Capital, Bandra-Kurla Complex Bandra (East), Mumbai 400051
NPCI's CPIO has historically accepted soft-copy RTIs (signed PDF + scanned IPO image) at the address listed on NPCI's RTI page. Confirm the current channel on the NPCI website before filing.
What to ask NPCI
- The full transaction trace (UPI / IMPS / NEFT) for the fraud, including RRN / UTR / UPI Txn ID, payer PSP, beneficiary PSP, switch timestamps, and beneficiary-bank credit acknowledgement.
- The timestamp at which the fraud-flag was injected into the NPCI switch by 1930 / I4C against the beneficiary, and the timestamp at which the beneficiary bank acknowledged it.
- The dispute SLA for the relevant rail (UPI redress, NEFT/IMPS chargeback) and whether your bank raised a dispute inside that SLA.
- The number of chargeback / debit-adjustment requests against the same beneficiary IFSC + account in the last 6 months.
- Whether NPCI has flagged the beneficiary account / VPA as “mule” in its risk-scoring system, and the date.
Sample RTI text to NPCI
To, The Central Public Information Officer National Payments Corporation of India 1001A, B Wing, 10th Floor, The Capital Bandra-Kurla Complex, Bandra (East) Mumbai 400051 Subject: Request under §6(1) of the RTI Act 2005 Sir / Madam, I, [Name], citizen of India, was defrauded of Rs [amount] via UPI / IMPS / NEFT on [date and time]. The transaction reference numbers are: UPI Txn ID / RRN / UTR: [TXN ID] Payer VPA / account: [details] Beneficiary VPA / account: [details] Under §6(1) of the RTI Act 2005, I request the following: 1. The complete transaction trace for the above reference, including payer PSP, beneficiary PSP, NPCI switch timestamps and beneficiary-bank credit acknowledgement. 2. The timestamp at which the fraud-flag for the beneficiary account / VPA was first received by NPCI from I4C / 1930 / the payer bank, and the timestamp at which the beneficiary bank acknowledged this flag. 3. A certified copy of the NPCI dispute SLA applicable to the above rail, and confirmation whether my bank raised a dispute inside that SLA. 4. The aggregate count of dispute / charge-back / debit adjustment requests against beneficiary IFSC [IFSC] and account [last 4 digits] in the last 6 months, month-wise. 5. Whether the beneficiary VPA / account is currently flagged as "mule" or "high-risk" in NPCI risk-scoring records, and the date that flag was first raised. I enclose IPO no. [IPO number] for Rs 10. Information may please be provided within 30 days under §7(1) RTI Act. If any part is deemed exempt, please sever under §10(1) and provide the rest with reasons recorded in writing. Yours faithfully, [Name] [Address] [Phone] [Email] Date: [DD/MM/2026]
Why this RTI works
NPCI runs the central switch and cannot claim “we don't have the data”: the switch exists to log every leg of every transaction. The Payment and Settlement Systems Act 2007 makes NPCI a regulated entity, and the CIC has repeatedly held that its records on individual disputes are not exempt under §8(1)(d) once the citizen is a party to the transaction.
RTI #3: To the receiving (beneficiary) bank
How to identify the receiving bank
The first 4 characters of the beneficiary IFSC (visible in your bank statement, NCRP ack, or the receiving-bank SMS) identify the bank. Examples: SBIN (SBI), HDFC, ICIC (ICICI), BARB (Bank of Baroda), PYTM (Paytm Payments Bank), AIRP (Airtel Payments Bank).
- PSB RTIs go to the CPIO at the bank's head office or zonal RTI cell (addresses on the bank's “RTI” page).
- Private bank RTIs go to the customer-protection / nodal officer cell. Private banks were brought under RTI through CIC orders citing banking-licence obligations; always cc the RBI Banking Ombudsman for that bank's zone so it cannot stonewall.
If the receiving bank refuses the RTI as “we are a private bank”, file the same questions as a complaint under the RBI Integrated Ombudsman Scheme 2021, which binds all scheduled commercial banks.
What to ask the receiving bank
- The date the beneficiary account [last 4 digits] was opened, the branch, and the KYC documents accepted.
- The KYC refresh dates and channels used (video-KYC, physical, OTP-based, Aadhaar e-KYC).
- The exact date and time at which a lien / debit-freeze was placed on the account after the fraud was reported.
- The current balance frozen under the lien, and the reason it has not been transferred back to the payer.
- Whether the receiving bank has opened an internal fraud investigation against this account, and the action taken.
Sample RTI text to receiving bank
To, The Central Public Information Officer [Bank name], [RTI Cell address] Subject: Request under §6(1) of the RTI Act 2005 / under the RBI Integrated Ombudsman Scheme 2021 (in the alternative) Sir / Madam, I, [Name], citizen of India, was defrauded of Rs [amount] on [date]. The funds were credited to account no. [last 4 digits], IFSC [IFSC], held with your bank. Reference NCRP ack no. [ack], 1930 reference [if any]. Under §6(1) of the RTI Act 2005, I seek the following: 1. The date and branch at which beneficiary account [last 4 digits] was opened, with the category of KYC documents accepted (Aadhaar e-KYC / physical / video). 2. The dates of subsequent KYC refresh, with channel. 3. The exact date and time on which a lien / debit-freeze was placed on the account after my fraud was reported. 4. The current frozen balance under that lien, and the reason / authority under which the lien has not yet been transferred to me (the rightful payer). 5. The status of any internal fraud investigation against this account, and the action taken. The request seeks **my own transaction's records** and **the bank's compliance behaviour**, not the third party's private information. To the extent any field is third-party data, please sever under §10(1) and provide the rest. IPO no. [IPO number] for Rs 10 is enclosed. Information is requested within 30 days under §7(1) RTI Act. Yours faithfully, [Name] [Address] [Phone] [Email] cc: The RBI Ombudsman, [your bank's RBI ombudsman zone] Date: [DD/MM/2026]
For step-by-step help on how the lien interacts with the freeze, read how the lien on your bank account is placed and removed and the cyber-fraud bank-freeze playbook.
The 5 magic questions every RTI must carry
Paste these into all 3 RTIs, rephrased for the addressee. They create a uniform paper trail every appellate body recognises.
- What was the SOP? The exact policy / circular the authority had to follow when my complaint reached them.
- What was the timestamp? Date and time the authority first received the reference, and acted on it.
- Where is the case mapped? The complaint / dispute / ombudsman reference assigned to my case in their internal system.
- What is the pattern? Aggregate counts against the same beneficiary IFSC / account / VPA in the last 6 to 12 months, no third-party identifiers.
- Why is the lien / refund still pending? Reason in writing for any inaction beyond the SLA, with the authority cited.
Questions (3) and (5) produce the strongest answers: they force the PIO to look at your file by name, while (1) and (2) sometimes get a lazy circular-quote.
Fee, format, channels
- Fee: Rs 10 per RTI. Total Rs 30 for the bundle. BPL applicants pay nil under §7(5) on production of a current BPL card / certificate.
- Mode: Indian Postal Order (IPO) or Demand Draft drawn in favour of the public authority, or online payment via rtionline.gov.in for central public authorities (which includes RBI, NPCI and most PSBs).
- Channel: Post (Speed Post with delivery proof) or rtionline.gov.in. Email-only RTIs are not officially accepted, though some PIOs entertain them as goodwill; never rely on email as your only channel.
- Reply deadline: 30 days under §7(1). For information concerning life or liberty (which large cyber-fraud cases sometimes satisfy), 48 hours under §7(1) proviso. Cyber-fraud usually does not qualify, but mention it if the fraud was extortion-linked.
- Use the AI RTI Drafter to auto-populate all three drafts with your case numbers, IFSC codes, and dates in under 2 minutes. The tool is free.
What the replies typically look like
Anonymised excerpts from real replies received by readers in 2025-2026:
From RBI CEPD:
"The above-named bank is required to follow para 6 to para 10 of Master Direction DBR.No.Leg.BC.78/09.07.005/2017-18 dated 6 July 2017 for any unauthorised electronic banking transaction reported by the customer. Your case is mapped to complaint no. ICOS/M-2026/xxxxxxx under the Integrated Ombudsman Scheme 2021 dated 25 March 2026. Aggregate complaints against IFSC SBIN0XXXXX and account ending xx12 in the last 12 months: 47, month-wise as per Annexure A."
That line “aggregate complaints in the last 12 months: 47” converts a single fraud into a documented pattern and is what pushes the receiving bank to settle.
From NPCI:
"Transaction trace for UPI Txn ID xxxxxxxxxx is annexed. Beneficiary PSP acknowledged credit at 14:22:07 IST on [date]. Fraud-flag received by NPCI from I4C at 16:08:43 IST on [date+1], onward referred to beneficiary PSP at 16:08:48 IST. Beneficiary PSP acknowledged flag at 11:14:02 IST on [date+2]. Dispute SLA for UPI redress is T+5 working days from acknowledged dispute. Bank [your bank] raised dispute on [date+3], i.e. T+4. Account ending xx12 currently flagged 'mule' since [date+2]."
That timeline tells you exactly when the receiving bank knew, and could no longer claim “still investigating”.
From a PSB receiving bank:
"Account ending xx12 opened on 14/02/2024 at branch XYZ vide Aadhaar e-KYC. KYC last refreshed on 11/01/2026 (video-KYC). Lien marked at 16:11:28 IST on [date+1] for Rs xxx, in pursuance of NCRP reference. Lien not yet lifted in favour of payer as the matter is sub-judice / under investigation by [district cyber police]. Internal fraud-investigation status: ongoing."
This is your ombudsman evidence: the bank had the money frozen on day 1, knew it was yours, and chose to wait. Exactly what RBI's 2017 Master Direction was written to prevent.
What to do with the replies
- Compile a 1-page timeline mapping each NPCI / RBI / bank timestamp on a single sheet. This is your evidence in every forum.
- File a first appeal under §19(1) within 30 days if any RTI is evasive / incomplete / blank. The First Appeal Builder auto-drafts the grounds.
- File an ombudsman complaint under the RBI Integrated Ombudsman Scheme 2021 against your bank, attaching the timeline and receiving-bank RTI reply. See the RBI ombudsman 2021 walkthrough.
- File a parallel consumer-court complaint under the Consumer Protection Act 2019 if the loss is under Rs 1 crore. District Commission disposes such cases in 90 to 180 days; the RTI replies do most of your evidence work.
- Consider a writ in the High Court under Article 226 only if the above stall past 6 months. Use the RTI bundle as Annexure 1.
When the authority refuses under §8 RTI exemptions
The 3 most common refusals are §8(1)(j) (privacy), §8(1)(h) (impeding investigation), §8(1)(e) (fiduciary). All three have settled counter-arguments.
§8(1)(j) "third-party private information"
Refusal text: “The information sought relates to a third party and cannot be disclosed under §8(1)(j).”
Your counter: §8(1)(j) excludes information “the disclosure of which has no relationship to any public activity or interest”. Your fraud-related transaction is your own transaction; the receiving account holder participated in a criminal act, which extinguishes the “no public interest” limb (*Girish Ramchandra Deshpande v. CIC*, (2013) 1 SCC 212 does not bar this: the receiver is a private actor in a public crime, not a public servant). Cite §10(1) and ask for severable disclosure: third-party PAN / Aadhaar / address redacted, but transaction / KYC dates intact.
§8(1)(h) "impeding investigation"
Refusal text: “Disclosure would impede the process of investigation / apprehension of offenders under §8(1)(h).”
Your counter: §8(1)(h) applies only when disclosure would *actually* impede an active investigation, not as blanket cover (*Bhagat Singh v. CIC* (2008) DHC; *CBSE v. Aditya Bandopadhyay* (2011) 8 SCC 497 narrowed all §8 exemptions to be applied strictly). Ask the PIO to confirm in writing (a) which active investigation, (b) which step would be impeded, © by which precise field. The PIO usually backs down.
§8(1)(e) "fiduciary relationship"
Refusal text: “The bank holds the information in fiduciary capacity for the account holder; disclosure barred under §8(1)(e).”
Your counter: *RBI v. Jayantilal Mistry* (2016) 3 SCC 525 held that RBI does not hold information about banks in a fiduciary capacity. CIC orders extend the same logic to banks holding information about account-holders in fraud cases, because fiduciary duty does not protect criminal conduct. Cite *Jayantilal Mistry* and *Aditya Bandopadhyay* together.
If the PIO still stonewalls after the first appeal, the second appeal under §19(3) lies to the CIC at cic.gov.in. Orders against RBI / NPCI / banks usually take 6 to 18 months.
Sample first-appeal text
To, The First Appellate Authority [Same address as PIO, marked 'FAA'] Subject: First appeal under §19(1) of the RTI Act 2005 against PIO order dated [date] / non-reply on RTI dated [date] Sir / Madam, I filed an RTI application dated [date] seeking 5 items of information regarding [case summary]. The PIO has, on [date], (a) failed to reply, OR (b) replied evasively on points [X, Y], OR (c) invoked §8(1)(j) / §8(1)(h) / §8(1)(e) without reasoned application of mind. Grounds of appeal: 1. The 30-day deadline under §7(1) expired on [date]. Non-reply is deemed refusal under §7(2). 2. The PIO has not recorded reasons under §7(8) for refusal; the bare citation of §8(1)(x) is insufficient (Bhagat Singh v. CIC, DHC 2008). 3. The information sought relates to my own account / transaction; the third-party limb of §8(1)(j) is inapplicable. Severable disclosure under §10(1) was not attempted. 4. RBI is a public authority under §2(h)(d)(i); the fiduciary bar of §8(1)(e) does not apply post RBI v. Jayantilal Mistry (2016) 3 SCC 525. I pray the FAA direct the PIO to furnish the information within 7 days and impose costs / penalty under §20(1) if warranted. Yours faithfully, [Name] [Address] Date.
For full guidance on appeal drafting, see the citizen RTI playbook and the RTI Act explained simply.
Real recovery scenarios (anonymised)
Scenario 1: UPI fraud, Rs 1.42 lakh recovered in 38 days
A Pune reader lost Rs 1.42 lakh to a “courier-delivery OTP” fraud in March 2026. She filed 1930 the same evening, NCRP next morning, the RTI bundle on day 4. Replies: RBI day 19 (her bank had not raised the dispute inside T+5), NPCI day 22 (beneficiary flagged “mule” on day 2), receiving bank day 27 (lien intact). Banking-ombudsman complaint with bundle attached on day 28; bank settled in full on day 38. Recovery: Rs 1,42,000 + Rs 5,000 compensation. Out-of-pocket: Rs 30.
Scenario 2: AEPS fraud, Rs 47,500 recovered in 71 days
A Bhagalpur farmer lost Rs 47,500 in 3 AEPS withdrawals from cloned-fingerprint terminals. 1930 + NCRP on day 1; bank initially refused, citing “you authorised it via Aadhaar biometric”. RTI bundle filed day 9. The receiving bank's reply (day 41) revealed the withdrawals were geo-tagged 2,400 km from the customer, which the bank had not flagged. He attached the reply to a §22 RBI ombudsman complaint; bank settled on day 71. Recovery: Rs 47,500 + Rs 2,500 compensation.
Scenario 3: SIM-swap, Rs 6.8 lakh, partial recovery in 92 days
A Hyderabad professional lost Rs 6.8 lakh after a SIM-swap routed OTPs to the attacker. The receiving bank had opened the mule account 18 days earlier on Aadhaar e-KYC alone, no video-KYC. The receiving-bank RTI produced that KYC trail; the NPCI RTI showed 14 prior fraud-flag hits on the same VPA. Banking-ombudsman direction: Rs 4.2 lakh refund (traced to identifiable mules), residual Rs 2.6 lakh awaiting court order. Net 62% recovery in 92 days; balance pending in District Cyber Court.
Use the RTI Drafter to file all 3 in 5 minutes
The AI RTI Drafter has a “Cyber-fraud bundle” preset. You enter:
- Your NCRP acknowledgement number
- Your bank IFSC + last 4 digits of your account
- Beneficiary IFSC + last 4 digits
- Transaction reference (UPI Txn ID / UTR / RRN)
- Date and amount of fraud
The tool generates all 3 drafts, fee-stamped and addressed to the correct PIOs. You either print and post, or copy-paste into rtionline.gov.in for the central authorities. Once you have replies, the First Appeal Builder handles §19(1) appeals against any non-reply.
What to do in the next 30 minutes
- Pull your bank statement; circle the fraudulent transactions and the beneficiary IFSC + account.
- Download your NCRP acknowledgement PDF from cybercrime.gov.in.
- Open the AI RTI Drafter and run the “Cyber-fraud bundle” preset.
- Buy 3 Indian Postal Orders of Rs 10 each at the nearest post office (or pay online inside rtionline.gov.in).
- Post / file all 3 RTIs on the same date. Keep the postal receipts / online ack PDFs in one folder named “RTI bundle [date]”.
FAQ
Can I file the RTI bundle if my fraud was reported only on 1930 but not on NCRP yet?
Yes. The RTI Act needs no prior complaint; the NCRP ack just makes the RTI more concrete. File NCRP and the bundle on the same day if you can; if NCRP cannot be filed (rare), the 1930 reference number is enough.
What if my bank is a private bank that refuses the RTI outright?
Private banks are a grey area. File the same 5 questions as a complaint under the RBI Integrated Ombudsman Scheme 2021, which binds all scheduled commercial banks. In parallel, file the RTI to RBI asking it to disclose the same data via its supervisory powers; RBI cannot refuse on “private bank” grounds.
Can I add more than 5 questions per RTI?
You can, but most PIOs reject “fishing” applications running into 15-20 questions. Keep each RTI to 5 to 7 well-framed asks. If you need more, file a follow-up RTI 30 days later with the next set.
Will the PIO charge me extra beyond Rs 10 for photocopies?
Possibly. §7(1) allows further charges (Rs 2/A4 page, Rs 50/CD) once the PIO computes volume. The PIO writes to you with the additional fee. BPL applicants are exempt.
Is rtionline.gov.in safer than postal RTI?
For central authorities (RBI, NPCI, central PSBs), online RTI is faster and creates an automatic digital trail. For state-bank branches or co-operative banks, postal is sometimes the only option.
What if NPCI says "we cannot share third-party transaction data"?
Reply citing that the data sought is your own transaction, not a third party's; the beneficiary's PAN / Aadhaar / phone are not asked for. Ask NPCI to sever under §10(1). Most NPCI replies eventually comply.
Does the RTI bundle work if the fraud amount is under Rs 10,000?
Yes. There is no minimum-amount threshold for RTI. Smaller frauds often expose the same pattern across many victims, and magic question #4 (aggregate pattern) becomes powerful ombudsman evidence.
How does this interact with my 1930 / NCRP complaint timeline?
It runs in parallel. The 1930 / NCRP timeline is the operational track (lien, freeze, refund). The RTI bundle is the information track (paper trail, accountability). Neither blocks the other. See the 1930 cyber-fraud script and the NCRP decoder.
What if 30 days pass and no PIO has replied?
Each silence is “deemed refusal” under §7(2). File a §19(1) first appeal to the First Appellate Authority of each public authority within 30 days of the §7(1) deadline. The First Appeal Builder generates the draft.
Can I claim damages from my bank using the RTI replies as evidence?
Yes. RTI replies are admissible documents under §74 of the Bharatiya Sakshya Adhiniyam 2023 (formerly §74 Evidence Act), and have been accepted as primary evidence in District Consumer Commissions, State Commissions, and the NCDRC in dozens of bank-fraud cases.
Sources
- RTI Act 2005, §6, §7, §8, §10, §19. Full text at indiacode.nic.in.
- RBI Master Direction DBR.No.Leg.BC.78/09.07.005/2017-18 dated 6 July 2017 on Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions. rbi.org.in.
- RBI Integrated Ombudsman Scheme 2021. rbi.org.in.
- NPCI Operating Regulations (UPI, IMPS). npci.org.in.
- Payment and Settlement Systems Act 2007. indiacode.nic.in.
- *Reserve Bank of India v. Jayantilal N Mistry*, (2016) 3 SCC 525.
- *Central Board of Secondary Education v. Aditya Bandopadhyay*, (2011) 8 SCC 497.
- *Bhagat Singh v. CIC*, DHC 2008.
- National Cybercrime Reporting Portal: cybercrime.gov.in.
- Central Information Commission: cic.gov.in.
- Online RTI portal: rtionline.gov.in.
Related on RTI Wiki
Last reviewed: 16 May 2026. RTI Wiki editorial team. Verify state-specific RTI fees and bank-specific PIO addresses with the public authority before posting.
Reader signal
Was this article useful?
Tap once if it helped you. These counters show other citizens which pages are worth reading.