Nine UPI Debits at Two in the Morning
At 07:05 on 12 August, Rakesh Verma, 58, a retired government teacher in Kanpur, calls the toll-free helpline and then the branch. Nine UPI debits totalling ₹47,500 have hit his savings account (balance before the debits: ₹1,21,480) between 01:18 and 02:06 that morning, each between ₹5,000 and ₹5,400, paid to three different VPAs. He insists he received no call and shared nothing. The bank's SMS logs, however, show nine alerts delivered instantly to his registered number, and his phone's call log, which he shows the branch manager, has a 14-minute incoming call at 01:10 from an unknown number. Under questioning he admits he installed a remote-support app during that call, on the instruction of a man who said his debit card was being blocked, and that he read out a six-digit code that appeared on the screen. He submits a written complaint at 11:30 on 12 August. All three beneficiary accounts are with other banks.
1. Determine who bears the loss, applying RBI's limited liability framework and the reporting timeline.
Read the worked answer
The timeline test is met; the negligence test is not - so the customer bears the loss.
Under RBI's customer protection circular on limiting liability in unauthorised electronic banking transactions (2017, updated 2019), the position is tiered: zero liability where the fraud is due to the bank's negligence; for a third-party breach where the customer is not at fault, zero liability if reported within three working days, limited liability per the bank's Board-approved policy if reported within four to seven working days, and per policy beyond that. Rakesh's transactions occurred on 12 August and his written complaint is dated 12 August, so he is inside three working days.
But the same circular carves out the case where the loss is due to the customer's own negligence. Here the evidence is strong: a 14-minute call immediately before the debits, a remote-support app installed during that call, the customer's own admission that he read out a code, and nine SMS alerts delivered but not acted upon. The burden of proving negligence is on the bank, and on these facts the bank can discharge it. Full liability therefore rests with Rakesh.
The bank's obligation does not end there. It must investigate, give him a written, reasoned reply within 90 days, and tell him about the RBI Ombudsman route. If investigation shows a control failure on the bank's side - no velocity check on nine payouts in 48 minutes to first-time VPAs from a newly bound device - the bank should consider a goodwill contribution rather than hide behind the circular.
2. What must the branch do in the first 24 to 48 hours?
Read the worked answer
Speed matters more than paperwork here, because the money can still be intercepted at the beneficiary end.
Same day:
- Take the written complaint, give a dated acknowledgement with a complaint reference number, and register it in the complaint system - the clock for the 90-day reply starts now.
- Block the channels: hotlist the UPI handle, block the debit card, reset the mobile-banking and UPI credentials, and change the registered device. Do this before any discussion of liability.
- Check the beneficiary VPAs. If any of the three accounts sits within your own bank, mark a lien immediately on the available balance and record the time. All three are stated to be at other banks, so raise a request through the UPI/NPCI help mechanism to the beneficiary banks asking them to hold or lien the funds, quoting the UTRs.
- Guide the customer to report on the National Cyber Crime Reporting Portal and dial 1930, and get a copy of the acknowledgement. The police complaint is his to file; help him with the transaction statement he needs to attach.
- Preserve evidence: the nine UTRs, CBS and UPI switch logs, the SMS delivery logs, the device and IP details, and a written note of the call log he showed. Request the call detail record through the proper channel.
Within 48 hours: escalate to the fraud risk and monitoring department, send the customer an interim letter stating the investigation is on, and do not promise a refund. Freeze further debit on the account only if he asks, and give him a zero-limit or fresh account so his salary and pension credits are not disrupted.
3. The customer argues that a bank should have blocked nine payments of about ₹5,000 each at two in the morning. How far is that argument correct?
Read the worked answer
Partly correct - enough to make this a service-quality issue even though liability sits with him.
There is no RBI rule requiring banks to bar UPI transactions at night, and a bank that imposed one would be vilified by customers. So the "2 a.m." point on its own fails. What the regulator does expect is that the bank's fraud risk management is proportionate to the channel: device binding, a cooling period or lower ceiling for first-time beneficiaries, velocity checks on the number of payouts per hour, and a rule flagging a sudden jump from a customer's normal pattern.
Here the pattern was loud: nine debits in 48 minutes, each just under ₹5,500, to three first-time VPAs, from a device newly bound that night, on an account whose earlier UPI activity was small and regular. A live fraud engine ought to have interrupted at the third or fourth payment and forced a re-authentication. The fact that nothing interrupted suggests either no rules were configured or they were configured far too loosely - a deficiency in service that an Ombudsman or consumer forum would weigh, even while holding that the customer's own act of installing a remote-access app was the proximate cause.
The balanced position for the branch: state in the written reply that liability under the circular rests with the customer because of his negligence, and, separately, record the control gaps found and refer them for correction. A discretionary, part-goodwill settlement is defensible if approved at the proper level and documented; an admission of legal liability is not.