Allocating Loss on a Cloned-Card ATM Withdrawal
A savings-account holder reports that ₹18,000 was withdrawn from his account in three ATM transactions at 11:40 p.m. using a cloned card. The card was in his possession throughout, he never shared his PIN with anyone, and no OTP was involved because the withdrawals were card-and-PIN transactions at a machine. He saw the alert the next morning but assumed it was a system error, and he filed a written complaint at the branch on the sixth working day after the alert. The branch has not credited anything and has not issued a complaint reference number; the CCTV request to the ATM-hosting bank is still pending.
The customer demands a full refund of ₹18,000 on the ground that he did not make the withdrawals. The branch's position is that it owes nothing because the complaint came 'too late'. You have to decide the correct liability position and what the branch must now do.
1. Allocate the ₹18,000 between the customer and the bank, with reasoning.
Read the worked answer
Neither party's position is correct.
Under RBI's framework for limiting customer liability in unauthorised electronic banking transactions, a customer who is not at fault and reports within three working days bears zero liability. Where the report comes after three but within seven working days, the customer's liability is capped rather than extinguished - the cap depends on the account type, and for a savings account it is ₹10,000 (₹5,000 for basic/BSBD accounts and ₹25,000 for current accounts and credit cards).
Here the reporting is on the sixth working day, so the zero-liability window has closed but the limited-liability window is still open. The customer was not at fault on the facts given: the card was in his possession, the PIN was not shared and the transaction was a cloned-card ATM withdrawal. Allocating the full loss to him because the complaint was 'late' is wrong, and equally the full-refund demand is wrong.
Allocation: customer bears ₹10,000; the bank bears ₹8,000. The branch should say plainly which rule it is applying and on what date the clock started - the date of the bank's alert to the customer, not the date the customer chose to visit the branch.
2. How would the answer change if the complaint had been filed on the second working day, or on the ninth working day?
Read the worked answer
Both alternatives move the outcome, in opposite directions.
Second working day: reporting falls inside the three-working-day window, and since the customer is not at fault, liability is zero. The bank absorbs the entire ₹18,000. Prompt reporting is not a courtesy in this framework; it is the switch that moves the customer from a capped share to no share at all.
Ninth working day: the complaint is outside the seven-working-day window altogether. At that point liability is governed by the bank's board-approved policy for such cases, not by the fixed caps, and the branch must apply that policy to this customer and record why. What the branch may not do is treat the late report as automatically extinguishing the customer's claim: the policy still applies, and the bank would need to establish customer negligence - which on these facts (card in possession, PIN uncompromised) it does not have - before shifting any part of the loss. In practice the argued default is that a bank that cannot show negligence has a weak case for retaining the money.
Note the pattern the two limits create: promptness buys a full refund, moderate delay buys a cap, and long delay hands the question to internal policy. The facts about fault do not change across the three scenarios; only the date does.
3. What must the branch do procedurally now, and by when?
Read the worked answer
Four things, in order.
One, acknowledge in writing with a complaint reference. This has not been done and is the branch's clearest failing so far. A customer cannot chase a case that has no number, and the absence of an acknowledgement is itself a service defect independent of who bears the ₹18,000.
Two, take the dispute to a decision within ten working days of the complaint. Under the framework the bank is expected to resolve - meaning credit the disputed amount where the customer's liability is nil or capped - within ten working days of receiving the report. Elapsed time here is already a problem.
Three, do not let the pending CCTV request stall the clock. The internal investigation into the ATM and the hosting bank runs in parallel; it is not a reason to sit on the customer's money beyond the ten-day window. If the investigation later shows customer negligence, the bank recovers through the correct channel rather than by withholding the credit.
Four, tell the customer the escalation route. If the branch does not resolve within the prescribed period, the customer can take the complaint to the RBI's integrated ombudsman. Naming that route in the final letter is both fair and protective of the branch.