ExplainerEconomyGS3Prelims

Customer liability in unauthorised electronic banking: RBI's zero-liability rules

By CAShorts DeskPublished 20 October 2026, 9:37 am ISTSources: RBI circulars and Directions; RBI Integrated Ombudsman Scheme; PIB; LiveLaw; ETV Bharat; Hello Banker

Why in news: In an order reported on 19 October 2026, the Kerala High Court held an SBI customer who promptly reported an OTP fraud had zero liability.

Customer liability in unauthorised electronic banking: RBI's zero-liability rules — Illustration (AI-generated)

Under the Reserve Bank of India's 6 July 2017 circular, a customer bears no loss from an unauthorised electronic transaction caused by the bank's fault, or by a third-party breach reported within three working days. In an order reported on 19 October 2026, the Kerala High Court applied the 2017 rule against State Bank of India.

Syllabus: GS3 · Indian Economy & Growth; Prelims · Current Affairs & IR; GS2 · Statutory & Regulatory Bodies

Why this matters for UPSC

GS3 Indian economy and cyber security: Prelims can ask the RBI's 2017 liability limits, the Integrated Ombudsman Scheme, 2021 and the 2026 Directions; Mains, how far banks should bear digital fraud losses.

In short

Customer liability rules decide who bears the loss from an unauthorised electronic transaction; the RBI ties it to fault and reporting speed, and makes the bank prove customer liability.

Zero liability works only if banks prove negligence before refusing refunds; clear definitions and quick reversals must keep pace with digital fraud.

Why it matters

A pensioner who answers a fake "card blocked" call and reads out an OTP can lose a lifetime's savings in minutes. Whether that money comes back depends on these rules: if the bank cannot show the customer was careless, and the fraud was reported quickly, the bank must refund it. That is why a same-day complaint matters so much. The rules also make banks invest in alerts, round-the-clock reporting and fraud detection, because a weak system leaves them paying for losses. As more people pay by phone, the question of how to share the cost of fraud between customers, banks and the regulator touches almost every household with a bank account.

Prelims pointers

Table 1 (2017), 4-7 day delay caps: Rs 5,000 for BSBD accounts; Rs 10,000 for other savings accounts; Rs 25,000 for remaining current, cash credit and overdraft accounts.
Credit cards (2017 Table 1): limit up to Rs 5 lakh carries a Rs 10,000 cap; above Rs 5 lakh, Rs 25,000.
Working days under the 2017 circular are counted by the home branch's schedule, excluding the day the bank's communication is received.
Non-bank PPI circular, 2019: issued under Section 10(2) read with Section 18 of the Payment and Settlement Systems Act, 2007.
Integrated Ombudsman Scheme, 2021: Appellate Authority is the Executive Director in charge of RBI's Consumer Education and Protection Department; appeal within 30 days.
Ombudsman's award: compensation for consequential loss up to Rs 20 lakh, plus up to Rs 1 lakh for time, expenses and harassment.
2026 Directions: instant SMS alerts mandatory above Rs 500; resolution within 45 calendar days (domestic) or 60 (cross-border); credit-card shadow reversal within five calendar days.
2026 compensation sharing (domestic, 85% case): RBI 65%, customer's bank 10%, beneficiary bank 10%; cross-border: RBI 65%, customer's bank 20%.

Practise a UPSC-style question

With reference to the Reserve Bank of India's 2017 framework on customer liability in unauthorised electronic banking transactions, consider the following statements:

1. A customer has zero liability when the loss arises from the bank's own deficiency, even if the customer never reports it.

2. In a third-party breach, zero liability applies if the customer notifies the bank within seven working days of the bank's communication.

3. The burden of proving customer liability in such transactions lies on the bank.

Which of the statements given above is/are correct?

(a) 1 and 2 only
(b) 2 and 3 only
(c) 1 and 3 only
(d) 1, 2 and 3

Show the answer

Answer: (c) 1 and 3 only

Answer: (c) 1 and 3 only. The zero-liability window for a third-party breach is three working days, not seven.

Statement 1: correct. The 2017 circular gives zero liability for the bank's fraud, negligence or deficiency, whether or not the customer reports it.

Statement 2: incorrect. Zero liability needs notice within three working days; four to seven days brings capped liability.

Statement 3: correct. Paragraph 12 of the 2017 circular places the burden of proving customer liability on the bank.

Eliminate: Judge statement 2 first: seven working days is the outer edge of the capped band, not zero liability. Out: (a), (b), (d).

Trap: Near-miss figure. Seven days is a real number in the same table, moved into the zero-liability slot.

Remember: 2017 rule: 3 working days zero, 4-7 capped, beyond 7 Board policy; burden of proof on the bank.

More Explainers

All Explainers

More Economy current affairs