Unauthorised UPI Transactions Reported After Five Days
A savings account customer of a cooperative bank reports that Rs 18,000 was debited through three UPI transactions at 11:40 p.m. on 3 April. She says she received no OTP and did not share her PIN. She reports to the branch on 8 April, five days later. The bank's log shows the transactions were authenticated with the customer's UPI PIN on a new device registered on 2 April. The customer says her phone was with her and she does not remember registering a new device. The bank has not credited the amount. The branch manager must decide the customer's liability under the RBI's limited-liability framework for unauthorised electronic banking transactions, what immediate action to take, and whether the bank can reject the claim only because the customer reported after three working days.
1. How should the branch assess the customer's liability? Consider the new-device registration, PIN authentication and the five-day delay.
Read the worked answer
Under the RBI limited-liability framework for unauthorised electronic banking transactions, liability depends on fault and on how quickly the customer reports the fraud:
- Zero liability generally applies where the fraud is due to a third-party breach and the customer is not negligent, provided the customer reports within three working days.
- Limited liability applies where the customer reports after three working days but within a longer period specified in the bank's policy.
- Full liability can apply where the customer shared payment credentials or was negligent.
Here the customer reported on day five, so she cannot automatically claim zero liability. But the bank also cannot jump to full liability merely from the PIN log. The new-device registration on 2 April and PIN authentication create a genuine question: did the customer register the device, did someone else access her phone/SIM, or did the bank's systems fail to apply an additional factor? The branch should treat the claim as disputed, investigate the device-binding and OTP logs, and apply limited liability only if the customer is not found negligent. If the investigation shows she shared the PIN/OTP, full liability may apply; if it shows bank-system negligence, zero liability may apply.
2. What immediate actions should the branch take after receiving the complaint?
Read the worked answer
Immediate actions:
- Block the UPI facility and the registered device; if necessary, freeze the account to prevent further debits.
- Record a formal complaint, give the customer a complaint number and acknowledgement, and note the date and time of reporting.
- Preserve all logs: device registration, IP address, OTP delivery status, UPI transaction IDs and beneficiary details.
- Ask the customer for a written dispute and, where relevant, a police complaint; do not ask her to reveal her PIN or OTP.
- Report the incident through the bank's fraud-monitoring channel and the prescribed cyber-fraud reporting mechanism.
- Complete the investigation within the bank's stated timeline and communicate the outcome in writing.
- If the bank's own delay or system failure caused the loss, credit the amount; if liability is limited, apply the bank's policy consistently and give reasons.
3. Can the bank reject the claim solely because the customer reported after three working days? Explain.
Read the worked answer
No. The three-working-day period is a threshold for zero liability, not a deadline for the customer to be heard or for the bank to reject the claim. A report after three working days may shift the customer from zero liability to limited liability under the bank's policy, but the bank must still investigate the unauthorised transaction and decide liability on evidence.
A blanket rejection would be wrong because:
- The RBI framework requires the bank to resolve the complaint and communicate reasons.
- The bank must examine whether its own systems or the device-registration process were at fault.
- The customer's delay may reduce the protection available, but it does not by itself prove customer negligence.
The correct approach is to investigate, apply the limited-liability policy if the customer is not negligent, and reject only the unprotected portion with a clear written explanation.