Research Agent Verification
Checked against RBI customer-liability guidance, RBI card-direction amendments, and the March 2026 PIB note on RBI's reviewed unauthorised electronic-banking framework.
The most important consumer habit is speed: report suspicious card activity immediately through the issuer's official channel, preserve alerts and complaint references, and avoid sharing OTP, PIN, CVV, expiry, or remote-access permissions.
The reporting clock matters
RBI's customer-protection guidance distinguishes cases where the deficiency lies with the bank, cases of third-party breach, and cases involving customer negligence. For third-party breaches, faster reporting gives the customer stronger protection.
The older RBI framework says customers have zero liability when they report a third-party breach within three working days of receiving the transaction communication. Reporting after that can create limited or policy-based liability.
What cardholders should do first
Block the card from the bank app or official helpline, report the transaction, record the complaint number, and follow up in writing. If credentials were shared, report anyway; liability can change after the bank is notified.
Do not rely on search ads, random phone numbers, or social-media replies for support. Use the bank's official app, statement, card back, or website.
Why the rules are evolving
The Press Information Bureau noted in March 2026 that RBI reviewed its unauthorised electronic-banking transaction instructions because of rapid technology adoption in banking and payment systems.
That direction of travel is good for cardholders, but it does not remove the need for careful behaviour: instant alerts, official reporting channels, and clean evidence still matter.
Key Takeaways
Report fraudulent transactions immediately; do not wait for the statement cycle.
Keep SMS and email transaction alerts active for every card.
Never share OTP, PIN, CVV, full card details, or remote-screen access with anyone claiming to be bank support.