Differences

This shows you the differences between two versions of the page.

@@ Line 1: / Line 1: @@
+{{htmlmetatags>metatag-keywords=(cyber fraud refund, unauthorised bank transaction, RBI zero liability, money debited by fraud, online fraud money recovery)
+metatag-title=(Money Debited by Fraud? Refund in 2026)&metatag-description=(Money debited by fraud can be recovered under RBI rules. Report to 1930 and your bank immediately. Know your zero-liability rights and the 3-day reporting window.)
+metatag-og:image=(https://righttoinformation.wiki/og/cyber-fraud-money-refund.webp)
+metatag-twitter:image=(https://righttoinformation.wiki/og/cyber-fraud-money-refund.webp)}}
+====== Money Debited by Fraud? Get a Refund in 2026 ======
+{{https://righttoinformation.wiki/og/cyber-fraud-money-refund.webp?1200x675|Fraud Money Refund help desk scene}}
+**Reviewed on:** 2026-06-19.
+<WRAP info>**Direct answer.** If money was debited without your authorisation, call 1930 and your bank at once to freeze further loss. If the fraud was a third-party breach and you reported within 3 working days of the bank alerting you, RBI rules give you zero liability and your bank must return the full amount within 10 working days.</WRAP>
+===== What the RBI Rule Actually Says =====
+The Reserve Bank of India circular RBI/2017-18/15 (DBR.No.Leg.BC.78/09.07.005/2017-18, dated 6 July 2017) is the governing document. It applies to all scheduled commercial banks, small finance banks, regional rural banks, and payments banks.
+The circular creates three categories of customer liability:
+**Zero liability (you owe nothing):**
+  * The bank itself was at fault, for example a data breach on its systems, a deficiency in its processes, or fraud by a bank employee.
+  * A third party (someone outside both you and your bank) breached the system AND you reported the unauthorised transaction to your bank within **3 working days of receiving the bank's communication** (SMS or email alert) about that transaction.
+**Limited liability (you bear a capped amount):**
+If you reported between 4 and 7 working days after receiving the bank alert, your maximum personal loss is:
+^ Account type ^ Your maximum liability ^
+| Basic Savings Bank Deposit (BSBD) accounts | Rs 5,000 |
+| Savings accounts, PPIs, MSME accounts, individual current or cash-credit accounts with limit up to Rs 25 lakh, credit cards with limit up to Rs 5 lakh | Rs 10,000 |
+| All other current, cash-credit, overdraft accounts, credit cards above Rs 5 lakh | Rs 25,000 |
+Your bank must compare the capped amount above with the actual transaction value and apply whichever is lower.
+**Your liability determined by bank policy:**
+If you reported after 7 working days, your bank's Board-approved policy decides. This is why speed matters.
+**Important:** If you shared your OTP, PIN, or password with the caller, the RBI circular treats that as your negligence. In that case you bear the full loss until you report it; losses after you notify the bank shift back to the bank. See [[cyber:otp-bank-scam|how OTP scams work]] for how to avoid this trap.
+===== Step 1: Stop the Bleeding First =====
+Time is money, literally. Before filling any form, do these in the first 30 minutes:
+  - **Call 1930**: the national cyber crime financial fraud helpline. Ask the operator to flag the transaction. This creates a time-stamped record that can help freeze mule accounts before money moves further.
+  - **Call your bank's 24x7 helpline**: ask them to block your card/UPI/net banking and raise an internal dispute ticket. Note the ticket number.
+  - **Do not call back** the number that defrauded you. That is a common re-victimisation method.
+  - **Screenshot your bank statement** showing the debit before any reversal entries appear.
+===== Step 2: File on the Cyber Crime Portal =====
+Go to [[https://cybercrime.gov.in|cybercrime.gov.in]] and select "Financial Fraud" under Report a Complaint. Choose "Register and Track" so you get a complaint reference number.
+You will need:
+  * Your mobile number (for OTP verification)
+  * Your bank account or card number
+  * The date, time, and amount of the fraud transaction
+  * Any transaction reference number from your bank alert
+  * Screenshots or call recordings if you have them
+You can also track your complaint later using the [[check-status:cybercrime-complaint-status|cybercrime complaint status tracker]].
+===== Step 3: Give Written Complaint to Your Bank =====
+A phone call is not enough. Email or hand-deliver a written complaint to your branch manager or the bank's nodal officer within the same day. State:
+  * Date and time of the fraudulent transaction
+  * Amount debited
+  * That you did not authorise the transaction
+  * Your request for reversal under the RBI circular dated 6 July 2017
+The bank must acknowledge and credit the amount provisionally (shadow reversal) within **10 working days** of your notification. The full resolution, including determining final liability, must happen within **90 days**.
+Ask for the complaint acknowledgement in writing. Keep it.
+===== Step 4: UPI Transactions - Additional Path =====
+If the fraud happened via UPI, you can also raise a dispute through your UPI app (Google Pay, PhonePe, Paytm, BHIM etc.) using the in-app "Report an issue" or "Raise dispute" option. The dispute flows through the acquiring bank. For more detail on the UPI-specific process, verify the current mechanism on [[https://www.npci.org.in|npci.org.in]], as NPCI updates these procedures periodically. Also see [[cyber:upi-fraud-complaint|how to file a UPI fraud complaint]].
+===== What If the Bank Refuses or Delays? =====
+If your bank does not respond within 30 days, or gives an unsatisfactory response, escalate to the **Reserve Bank - Integrated Ombudsman Scheme**. File at [[https://cms.rbi.org.in|cms.rbi.org.in]]. You do not need a lawyer. The Ombudsman covers banks, NBFCs, and prepaid payment instrument issuers.
+For a detailed walkthrough of filing with the Ombudsman, see [[complaints:banking-ombudsman|how to use the Banking Ombudsman]].
+The Ombudsman can:
+  * Direct the bank to reverse the fraudulent debit
+  * Award compensation for mental agony and harassment (up to limits prescribed in the scheme)
+  * Direct the bank to pay interest for delayed reversal
+===== Frequently Asked Questions =====
+==== I shared my OTP with the fraudster. Can I still get a refund? ====
+This is treated as customer negligence under the RBI circular, so you bear the full loss that occurred before you reported it to your bank. Once you notify your bank, the bank covers any further losses. That said, file with your bank and on 1930 anyway. Some banks may still offer partial relief as a goodwill gesture, and the police record matters for an FIR if you choose to escalate.
+==== The bank says the fraud was my fault. What do I do? ====
+The RBI circular places the **burden of proof** on the bank, not on you. The bank must prove you were negligent. If you believe their decision is wrong, escalate to the RBI Integrated Ombudsman at cms.rbi.org.in within 30 days of the bank's final response.
+==== The fraudster called pretending to be from my bank. Is that a third-party breach? ====
+The answer depends on whether you shared credentials. If the caller extracted your OTP or PIN and used it, courts and banks generally treat that as the customer's contributory negligence because the credentials passed through you. If the fraud happened entirely without you providing anything (for example a SIM-swap attack or a card-skimming breach), that is more likely a third-party breach. Report to 1930 and let the bank's investigation run, but also file an FIR with your local police.
+==== How long does it take to get the money back? ====
+Your bank must do a provisional (shadow) credit within 10 working days. The final determination of who bears the loss must happen within 90 days. If you escalate to the Ombudsman, the typical resolution timeframe is longer; verify current timelines on the RBI website.
+==== The 1930 helpline is not connecting. What else can I do? ====
+File directly on [[https://cybercrime.gov.in|cybercrime.gov.in]] online. Also file an FIR at your nearest police station under sections of the Bharatiya Nyaya Sanhita dealing with cheating and fraud. Lodge the written complaint with your bank simultaneously. See [[cyber:report-cyber-fraud-1930|reporting cyber fraud via 1930]] for alternatives.
+==== I got a message saying my refund is being processed. Is it real? ====
+Be very careful. Fraudsters often call or message victims saying "we are processing your refund, share an OTP to receive it." No legitimate bank or government agency will ever ask you for an OTP to credit money. If you receive such a message, it is a second fraud attempt.
+==== Does this apply to credit card fraud too? ====
+Yes. The RBI circular covers credit cards as well. The same zero-liability and limited-liability rules apply, with the cap depending on whether your credit limit is above or below Rs 5 lakh.
+===== File an RTI to: //the Reserve Bank of India (RBI)// =====
+If you want official data or internal records about fraud complaint processing, ask RBI under the RTI Act 2005.
+  * How many unauthorised electronic transaction complaints were received in the last financial year and how many were resolved within 90 days?
+  * What action has RBI taken against banks that failed to make shadow reversals within 10 working days under circular DBR.No.Leg.BC.78/09.07.005/2017-18?
+  * What is the total amount involved in unauthorised electronic transaction complaints resolved under the Integrated Ombudsman Scheme in the last financial year?
+  * What inspections or audits has RBI conducted to verify bank compliance with mandatory SMS/email alert requirements for electronic transactions?
+  * How many banks have been penalised for non-compliance with the zero-liability / limited-liability customer protection framework?
+→ **[[https://righttoinformation.wiki/tools/ai-rti-draft-app.html|Use our free AI RTI Drafter]]** to generate a complete Section 6(1) application.
+===== Sources =====
+  * [[https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11040&Mode=0|RBI Circular RBI/2017-18/15 dated 6 July 2017: Customer Protection - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions]]
+  * [[https://cybercrime.gov.in|National Cyber Crime Reporting Portal - cybercrime.gov.in]]
+  * [[https://cms.rbi.org.in|Reserve Bank - Integrated Ombudsman Scheme complaint portal]]
+  * [[https://www.rbi.org.in/Scripts/Complaints.aspx|RBI Complaints and Ombudsman information page]]
+  * [[https://www.npci.org.in|National Payments Corporation of India - npci.org.in]]
+//By Dr. Shrawan Kumar Pathak//
+===== Cyber fraud money refund: How to get money back (2026) =====
+  - **Step 1: How to get refund after cyber fraud?** (a) Cyber fraud: (i) online fraud — UPI, card, net banking, (ii) money debited — fraudulently, (iii) 2026: RBI guidelines — bank must refund within 10 days, (b) key rules: (i) RBI Circular 2017: zero liability — if reported within 3 days, (ii) RBI Circular 2017: limited liability — 4-7 days, (iii) beyond 7 days: bank discretion, (c) common scenarios: (i) UPI fraud — money sent to wrong person, (ii) card fraud — unauthorised transaction, (iii) phishing — bank details stolen, (iv) OTP fraud — OTP shared, (v) investment fraud — fake app/website, (d) rights: (i) customer has right to zero liability — if reported within 3 days, (ii) right to bank refund — within 10 days, (iii) right to Banking Ombudsman — if bank doesn't act, (e) authority: Bank + RBI + Cyber Police + 1930, (f) law: RBI Guidelines + IT Act 2000 + Consumer Protection Act 2019.
+  - **Step 2: Comparison table — fraud scenarios.** (a) UPI: (i) issue: UPI fraud — money sent to wrong person, (ii) remedy: bank + 1930 + complaint, (iii) timeline: 10 days (if reported 3 days), (iv) example: reported; refunded, (b) Card: (i) issue: card fraud — unauthorised transaction, (ii) remedy: bank + dispute + 1930, (iii) timeline: 10 days, (iv) example: disputed; refunded, (c) Phishing: (i) issue: phishing — bank details stolen, (ii) remedy: bank + freeze + 1930, (iii) timeline: 10 days, (iv) example: frozen; refunded, (d) OTP: (i) issue: OTP fraud — OTP shared, (ii) remedy: bank + 1930 (limited liability), (iii) timeline: 10-90 days, (iv) example: reported; partial refund, (e) Investment: (i) issue: investment fraud — fake app/website, (ii) remedy: 1930 + cyber police, (iii) timeline: 30-180 days, (iv) example: reported; investigation. (Note: Report within 3 days for zero liability. 1930 helpline. Bank must refund in 10 days.)
+  - **Step 3: How to get refund.** (a) Step 1: Call 1930 — immediately, (b) Step 2: Bank complaint — in writing, (c) Step 3: Cyber police complaint — cybercrime.gov.in, (d) Step 4: Banking Ombudsman — if bank doesn't refund, (e) Step 5: Keep evidence — screenshots + transaction ID, (f) Step 6: Follow up — with bank + police.
+  - **Step 4: E-E-A-T signals.** (a) Sources: rbi.gov.in, cybercrime.gov.in, pib.gov.in, (b) Last reviewed: July 2026, (c) Author: RTI Wiki Editorial Team.
+  - **Step 5: Practical tips.** (a) report within 3 days — zero liability, (b) 1930 helpline — immediate, (c) bank must refund in 10 days — RBI, (d) Banking Ombudsman — if bank doesn't act, (e) Example: A victim lost Rs 50,000 via UPI fraud; called 1930 within 1 hour; refunded in 7 days.
+  - **Step 6: Key provisions.** (a) RBI Circular 2017, (b) Zero liability — 3 days, (c) Limited liability — 4-7 days, (d) 1930 helpline, (e) cybercrime.gov.in.
+See [[https://righttoinformation.wiki/cyber/fraud-money-refund|Cyber Fraud Refund]] and [[https://righttoinformation.wiki/cyber/report-cyber-fraud-1930|Report Cyber Fraud]] and [[https://righttoinformation.wiki/how-to-file-rti-india|How to File RTI]].
+{{tag>cyber fraud 2026 india refund money bank 1930 rbi zero liability upi 2026}}