Zero-liability protection in India: what banks must cover and what they will not

Zero-liability protection in India: what banks must cover and what they will not

Published: 19 October 2026

Category: how-to-guides | cardbuzz

"Zero liability" is the most powerful — and most misunderstood — consumer protection in Indian banking. It does not mean you can never lose money to fraud. It means that in specific situations, defined by an RBI circular, the bank absorbs the loss, not you. Here is exactly where the protection applies and where it stops.

The source: RBI's 6 July 2017 circular

The framework comes from the RBI circular "Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions" dated 6 July 2017. It sorts every unauthorized transaction into three buckets based on whose fault it was and how fast you reported. Your protection level follows from that sorting.

Bucket 1: The bank's fault — zero liability, always

If the loss stems from contributory fraud, negligence, or deficiency on the bank's part, your liability is zero — whether or not you reported the transaction, and regardless of the amount. Examples: a bank employee misuses your data, the bank's systems are breached, or the bank processes a transaction it should have blocked.

Bucket 2: Third-party breach, nobody's fault — zero liability if you report within 3 working days

This is the most common fraud scenario: a data breach at a merchant, payment aggregator, or elsewhere in the system — neither you nor the bank was negligent, but your card details were compromised. If you notify the bank within 3 working days of receiving the bank's communication about the transaction, your liability is zero, irrespective of the transaction value.

Report on working days 4–7, and liability is capped per transaction at the lower of the transaction value or:

Report after 7 working days, and your liability is decided by the bank's own board-approved policy — the weakest protection tier.

Working days are counted per your home branch's schedule, excluding the day you received the bank's alert. The "bank's communication" means the SMS/email/app alert about the transaction — which is why transaction alerts must be switched on for every transaction.

Bucket 3: Your fault — you bear the loss until you report

If the loss occurred because of your negligence — you shared your OTP, PIN, or password, or you fell for a phishing call and authorized the transaction yourself — you bear the entire loss until you report it. After you report, the bank bears subsequent loss. There is no zero-liability shield for shared credentials, no matter how fast you report.

This is the bucket most fraud victims actually fall into, because most Indian card fraud today is social engineering (fake customer-care calls, KYC-update scams) rather than technical breaches. The protection framework is generous for technical fraud and unforgiving for credential-sharing — which is exactly why the "never share your OTP" rule is not folk wisdom but the legal boundary of your protection.

What banks must do (your enforceable rights)

The circular does not just cap your liability — it imposes duties on banks:

• 24×7 reporting channels. Banks must provide round-the-clock access (IVR, SMS, app, website) for reporting unauthorized transactions.
• Provisional credit within 10 working days of your notification (the "shadow reversal").
• Resolution within 90 days, with the customer's liability — if any — established in that window.
• Burden of proof on the bank. In any dispute about an unauthorized electronic transaction, the bank must prove your liability — you do not have to prove your innocence.

If your bank misses the 10-day provisional credit or the 90-day resolution, cite the circular in writing to the grievance officer. Unresolved after 30 days, escalate to the RBI Integrated Ombudsman at cms.rbi.org.in.

What zero liability does NOT cover

• Transactions you authorized, even if you regret them — a bad purchase is not fraud.
• Losses from shared credentials (Bucket 3 above).
• Disputes with merchants (non-delivery, defective goods) — those go through chargebacks, a separate process with separate rules.
• Cash withdrawals by someone you gave the card and PIN to — authorized by you, even if misused.
• Losses reported after 7 working days in third-party-breach cases — capped only by the bank's internal policy.

How "working days" are actually counted

The 3-day and 7-day windows that determine your liability cap are counted in working days per your home branch's schedule — Saturdays, Sundays, and bank holidays typically do not count, and the day you received the bank's alert is excluded (day 1 is the next working day). In practice this gives you slightly more calendar time than "3 days" sounds like — but do not game it. Report the moment you see the alert; the difference between reporting on day 1 and day 4 is the difference between zero liability and a ₹10,000–₹25,000 cap on a credit card. Same-day reporting also creates the cleanest possible record if the bank later disputes your timeline.

The 3-day rule in practice

The single highest-value habit in this entire article: report within 3 working days, through a recorded channel, and get a complaint number. The difference between day 3 and day 8 on a ₹2,00,000 fraud is the difference between ₹0 and up to ₹10,000–₹25,000 out of your pocket — for the cost of one phone call or app submission. Set up transaction alerts today; the 3-day clock starts when the bank communicates, and you cannot report what you never saw.

Bottom line

Zero liability is real but conditional: bank's fault or prompt-reported third-party breach = you pay nothing; your own negligence = you pay until you report. The 3-working-day reporting window is the hinge everything swings on. Know your bucket before you argue with the bank — and put every report in writing with a reference number.

Sources: RBI circular "Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions," 6 July 2017 (rbi.org.in); RBI Integrated Ombudsman Scheme 2021 (cms.rbi.org.in).