After alleged losses of ₹10.24 crore at a Punjab National Bank branch in Greater Noida, here is what RBI rules say about customer liability, reporting deadlines and refunds.
India’s digital banking boom has made unauthorised transfers a growing concern for savers, and a recent case reported from Greater Noida has sharpened public anxiety about whether banks will make customers whole if money disappears without permission. According to reports cited by Indian media, customers at a Punjab National Bank branch alleged that money vanished from accounts and fixed deposits, prompting police action and a wider debate over the safety of deposits and the speed of bank redress. India Today said the Central Bureau of Investigation later registered a case in the matter, with the bank’s preliminary estimate put at about ₹10.24 crore.
The Reserve Bank of India has set out a clear framework for unauthorised electronic transactions, dividing liability between the customer and the bank according to how the fraud occurred and how quickly it was reported. Where the bank is at fault, the customer has no liability. The same protection can apply in some third-party breaches if the customer alerts the bank within three working days of receiving notice of the transaction. If the report is made four to seven working days later, liability may be limited by the type of account and a ceiling set out in the RBI’s rules.
The first priority after spotting an unknown debit is to alert the bank immediately through its customer care line, mobile app, website or branch. The RBI guidance also makes clear that customers should preserve the complaint reference number, transaction alerts, emails, bank statements and screenshots, because these records can become important in the investigation and refund process. If the fraud involves digital payments, the Government of India advises victims to contact the 1930 cyber fraud helpline and file a report on the National Cyber Crime Reporting Portal as quickly as possible.
The central bank’s rules also draw a sharp distinction between a fraud caused by bank error and one made possible by a customer’s own disclosure of credentials. If a customer has shared an OTP, PIN, password or other payment detail, losses may fall on the customer until the bank is informed, although the bank remains responsible for any further unauthorised transactions after that point. In cases where the customer reports the problem promptly and is covered by zero or limited liability, the bank must provide provisional credit within 10 working days and complete its determination within 90 days. The RBI also says customers should not lose interest on affected savings or debit card accounts, and credit card holders should not face extra interest charges because of the disputed transaction.
If a bank does not resolve the complaint, the customer can escalate the matter through the RBI’s complaint management system, and, where eligible, through the Integrated Ombudsman Scheme. The central bank says complaints should normally be taken to the bank first, but customers may approach the Ombudsman if the bank fails to reply within 30 days or if its response is unsatisfactory. The broader message from the RBI’s rules is simple: act fast, document everything and do not assume that a refund is automatic in every fraud case, especially where the facts are still under investigation.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
