What do I do if money is stolen from my bank account?
Short answer
Call 1930 immediately — before calling your bank — so the transaction can be flagged across the whole chain of intermediaries. Then call your bank's fraud line, file at cybercrime.gov.in, and confirm to the bank in writing. Reporting within three working days generally gives you zero liability under RBI rules.
Verified · 3 cited sources
The order matters. 1930 raises a ticket that reaches every bank and payment intermediary in the transaction chain at once, allowing funds to be held before they are withdrawn. A single bank's fraud line cannot do that, and the fifteen minutes spent in its IVR queue is usually when the money moves on.
The RBI's limited liability framework is the most valuable protection here and the least known. Where the loss results from a deficiency in the bank's systems, you have zero liability regardless of when you report. Where it results from a third-party breach with no fault on either side, you have zero liability if you report within three working days of the bank's communication about the transaction.
Reporting between four and seven working days limits liability to a prescribed amount; beyond that it is governed by the bank's own board-approved policy. Where the loss results from your own negligence — sharing a PIN, password or OTP — you bear it up to the point of reporting, and the bank bears it after.
The bank must credit the amount within ten working days of notification where its liability is established, without waiting for an investigation to conclude.
Crucially, the burden of proving customer negligence sits with the bank. If told the loss is yours because you shared an OTP, ask for that in writing with reference to the RBI circular.
Confirm everything in writing to the bank, by email, repeating what was reported and when. The written record of the reporting date is what establishes your liability position.
If unresolved after 30 days, escalate free to the RBI Ombudsman at cms.rbi.org.in or on 14448. Its award is binding on the bank.
- Call 1930 first, then the bank, then file at cybercrime.gov.in
- Zero liability if reported within three working days under RBI rules
- Bank must credit within ten working days where its liability is established
- The bank bears the burden of proving your negligence
- RBI Ombudsman after 30 days — free, and binding on the bank
Sources & provenance
Facts verified
- 1.Limiting Liability of Customers in Unauthorised Electronic Banking Transactions RegulatorReserve Bank of IndiaUsed for: Zero liability window, reporting timelines, ten-working-day credit and burden of proof
- 2.National Cyber Crime Reporting Portal OfficialMinistry of Home AffairsUsed for: 1930 helpline and online complaint
- 3.RBI Ombudsman Scheme RegulatorReserve Bank of IndiaUsed for: Escalation after 30 days and binding awards
The liability framework, reporting timelines and ombudsman route come from RBI circulars and the Ministry of Home Affairs as cited. Liability amounts and timelines are set by RBI circulars that are periodically revised — check rbi.org.in for current terms. The recommendation to call 1930 before the bank is our conclusion about sequencing, not an instruction issued by any authority.
Facts on this page are taken from the sources listed above — Government of India ministries and departments, statutory authorities, regulators such as the RBI, SEBI, IRDAI and TRAI, state governments and official statistical releases. Comparisons, judgments and "which option suits whom" conclusions are AI-assisted analysis written over those sources; they are marked in the text and listed as an AI-analysis entry in the sources, not attributed to any authority. Fees, slabs, limits and processing times change, often at the start of a financial year on 1 April; figures are current as of the review date shown and should be confirmed with the responsible department before you rely on them. A great deal of Indian administration is state administration — where a rule differs by state, this site says so.