Your Rights Against Unauthorized Bank Account Deductions

You check your bank app before bed and everything looks fine. You check it again at breakfast and ₹8,000 is gone, sent to an account you've never heard of. Or maybe it's smaller and quieter than that: an auto-debit for a subscription you cancelled months ago, or a "processing fee" nobody told you about.

Either way, the sinking feeling is the same. And the first question most people ask is the wrong one. It isn't "will I get my money back?" It's "how fast do I move, and who do I call?" Speed decides almost everything here, and Indian banking rules are more on your side than most people realise.

What actually counts as an "unauthorised" deduction

Not every debit you dislike is unauthorised. A loan EMI you signed up for, a cheque bounce charge, an ATM fee you forgot about — these are real, even if they sting. The law is specific about what it protects you from. An unauthorised transaction is one you never approved, in any form: not by clicking, not by sharing an OTP, not by consenting verbally.

In practice, this covers a fairly wide range of situations:

• A UPI payment or net-banking transfer you never initiated, often the result of a phishing link, a fake customer-care call, or a SIM-swap.

• A card swipe or online purchase made with a cloned or stolen card.

• An auto-debit that goes through without the mandatory advance notice, or for an amount you never agreed to.

• A bank's own error — a duplicate EMI deduction, a wrongly applied penalty, a charge that was never disclosed to you when you opened the account.

The rules that follow apply differently depending on which of these you're dealing with, so it helps to know which bucket your case falls into before you start writing complaints.

The rule that actually protects you: RBI's liability framework

Reserve Bank of India's July 2017 circular on customer protection changed the default assumption in Indian banking. Before this, banks often treated a disputed transaction as the customer's problem until proven otherwise. Since 2017, the burden shifted, and how much you lose depends almost entirely on how quickly you speak up.

There are three tiers.

Zero liability. You pay nothing if the fraud happened because of the bank's own negligence or system failure, no matter when you report it. You also pay nothing if a third party is responsible — a breach somewhere in the payment chain that has nothing to do with you or the bank — provided you report it within 3 working days of getting the bank's alert about the transaction.

Limited liability. If the fault lies elsewhere in the system (not with you, not with the bank) and you report between 4 and 7 working days, your loss is capped rather than open-ended. The cap depends on your account type: ₹5,000 for a basic savings (zero-balance) account, ₹10,000 for regular savings accounts, prepaid instruments, and credit cards with a limit up to ₹5 lakh, and ₹25,000 for higher current accounts and credit cards above that limit.

Reporting after 7 working days. Here the protection weakens. Your liability now depends on your bank's own board-approved customer-protection policy, which could mean bearing the full loss.

There's one big exception that trips people up: if the loss happened because you shared your OTP, PIN, or password, or clicked through a phishing link yourself, none of this tiered protection applies in the way it would for a pure third-party breach. Banks and courts have drawn a firm line between genuine unauthorised access and a customer who was, however innocently, tricked into authorising the transaction themselves.

Once your complaint is accepted under the zero or limited liability rules, the bank is required to credit the disputed amount back to your account within 10 working days of your reporting it, and it can't make you wait for its internal investigation to finish or for an insurance claim to settle first.

What to do the moment you notice it

Every hour matters, especially with UPI and card fraud where money moves through mule accounts fast.

Call your bank's helpline immediately and ask them to block the card, UPI ID, or net-banking access. Get a complaint or reference number before you hang up — this is your proof of when you reported it, which decides which liability tier you fall under. Follow up the call with a written complaint by email or through the bank's app, so there's a paper trail beyond a phone log.

Separately, and just as urgently, call 1930, the national cyber fraud helpline, or file a complaint at cybercrime.gov.in. This isn't a duplicate of your bank complaint. The 1930 system can trigger a hold on the beneficiary account before the fraudster withdraws the money, and it works best within the first few hours, sometimes called the "golden hour." Save every screenshot, SMS alert, and transaction ID before you do anything else — you'll need them for both complaints.

If your card was physically lost or stolen, report that too, since a lost card and a compromised card trigger slightly different bank procedures.

Auto-debits you never quite agreed to

A lot of "unauthorised deduction" complaints aren't fraud at all. They're subscriptions, insurance premiums, and SIP instalments that get deducted in a way that feels sneaky, even when a mandate technically exists somewhere in your inbox.

RBI's e-mandate rules exist for exactly this friction point. Any recurring auto-debit set up on your card, UPI, or account needs your explicit approval at registration through an additional authentication step. After that, most routine debits up to ₹15,000 can go through without a fresh OTP each time — but you must get a notification at least 24 hours before the money is deducted, spelling out the merchant, the amount, and the date. That notice has to come with a working option to opt out of that specific debit. Insurance premiums, mutual fund SIPs, and credit card bill payments get a higher no-OTP ceiling of ₹1 lakh, precisely because missing one of these can have bigger consequences than missing a streaming subscription.

If a recurring debit goes through without that 24-hour notice, or for an amount above the applicable threshold without your authentication, or after you've formally cancelled the mandate, that's a rules violation you can raise with the bank directly — and the same zero-liability protection that covers fraud now extends explicitly to these e-mandate debits too.

If your bank drags its feet

Most disputes get resolved at the bank level once you've reported them in writing. If yours doesn't — no response, a flat refusal, or a resolution you think is wrong — you don't need a lawyer to push further.

Since July 2026, complaints against banks, NBFCs, and payment companies fall under the Reserve Bank – Integrated Ombudsman Scheme, 2026. The process is meant to be usable without legal help: you first raise the complaint with your bank and give it 30 days to respond. If it doesn't respond, or you're unhappy with what it says, you can take the complaint to the RBI Ombudsman within 90 days of that 30-day window closing. There's no fee, and no requirement to hire anyone.

You can file online at cms.rbi.org.in, by email to crpc@rbi.org.in, or by post to the Centralised Receipt and Processing Centre in Chandigarh. There's also a toll-free number, 14448, working from 9:30 am to 5:15 pm in Hindi, English, and several regional languages, mainly to help you file the complaint or check its status. If the Ombudsman finds in your favour, it can award compensation of up to ₹30 lakh for your actual financial loss, plus up to ₹3 lakh separately for harassment, mental agony, or time and expenses you incurred chasing the complaint.

Other doors you can knock on

The Ombudsman route covers most cases, but it isn't the only option, and sometimes it isn't even the right one.

For a straightforward deficiency in banking service — wrongly levied charges, a bank error that caused you financial loss — you can also approach a Consumer Disputes Redressal Commission under the Consumer Protection Act, 2019. Most everyday banking disputes stay well within the District Commission's jurisdiction, which currently handles claims up to ₹50 lakh; state commissions take cases between ₹50 lakh and ₹2 crore, and the National Commission handles anything above that.

If your case involves genuine cybercrime — identity theft, phishing, someone impersonating your bank to extract your OTP — that's a criminal matter too, separate from getting your money back. It typically falls under Sections 66C and 66D of the IT Act, 2000 (identity theft, and cheating by personation through a computer), often read together with Section 318 of the Bharatiya Nyaya Sanhita, 2023, which is the cheating provision that replaced the old IPC Section 420. The IT Act also has its own civil compensation route: an Adjudicating Officer under Sections 43 and 46 can award damages, in theory up to ₹5 crore, for loss caused by unauthorised access to your computer resource or account. This is separate from, and can run alongside, your bank complaint and your Ombudsman complaint.

Where the protection has limits

None of this is unconditional. If you genuinely shared your card details or OTP, even by mistake, banks and the Ombudsman will weigh that against you. If you sat on a fraud alert for weeks before reporting it, the delay itself works against your claim, tier by tier, as the liability caps show. And a transaction you actually authorised — even one you now regret, like an impulsive online purchase — isn't "unauthorised" just because you wish you hadn't made it.

The practical upshot is that your rights are real and reasonably generous, but they lean heavily on how you behave in the first few hours and days. Keep your bank's fraud helpline saved somewhere other than your phone (in case that's the compromised device), turn on transaction alerts for every account and card you hold, and treat any unexpected debit — however small — as worth a phone call rather than a shrug.