Legal information notice: this article provides general information and isn't a substitute for advice from a qualified lawyer.
A call, SMS, or app notification convinced you to share an OTP — maybe someone posed as your bank, a delivery agent, or even a family member in distress — and now money has moved out of your account. The good news: Indian banking rules were specifically designed to protect you in exactly this scenario, provided you act fast. Here’s exactly what to do.
Under the RBI’s guidelines on customer protection for unauthorized electronic transactions, your liability depends heavily on how quickly you report the fraud after noticing it:
This timeline is genuinely the single most important factor in whether you get your money back — treat it with real urgency.
Report the unauthorized transaction and request an immediate block on the affected card/account — do this the moment you realize the transaction was fraudulent, even before filing any other complaint.
Follow up your phone call with a written complaint (email works) to your bank, since this creates a clear, dated record of when you actually reported — critical for establishing you’re within the 3-working-day zero-liability window.
Do this as soon as possible — banks can request an urgent freeze on funds still sitting in the fraudster’s account through the cybercrime portal’s integration with the banking system, but this only works within a narrow window before funds move further down the chain.
Under RBI rules, your bank must credit the disputed amount (provisionally, pending investigation) within 10 working days of your complaint, not wait for the investigation to fully conclude first.
If your bank doesn’t resolve the matter within 10 working days or wrongly denies your zero-liability claim, escalate to the RBI’s Integrated Ombudsman Scheme via cms.rbi.org.in — this is free and carries real regulatory weight.
Banks sometimes push back on zero-liability claims by arguing you must have shared the OTP yourself, treating that alone as sufficient grounds to deny the claim. This isn’t automatically correct as a matter of law — courts have held that a customer’s mere denial of having shared an OTP doesn’t automatically fix liability on the bank either way; the actual facts of how the fraud occurred (a sophisticated phishing call, a compromised system, a genuine security lapse) matter, and you’re entitled to have your specific circumstances properly considered, not dismissed with a blanket assumption.
The “golden hour” concept matters enormously in OTP fraud specifically because the money typically moves through several intermediary accounts within minutes to hours of the fraudulent transaction — the faster you report through cybercrime.gov.in, the better the odds a freeze request reaches the receiving bank before the funds are withdrawn or moved again. Don’t wait until the next business day if the fraud happens outside banking hours — file online immediately regardless of the time.
Be skeptical of any call, message, or app claiming to help you “recover” money lost to fraud in exchange for a fee, another OTP, or remote access to your device — this is an extremely common secondary scam targeting fraud victims specifically, preying on the urgency and distress of the original incident. Legitimate banks and the cybercrime portal never charge a fee to process your complaint.
| Reporting Window | Your Liability |
|---|---|
| Within 3 working days | Zero liability — full refund |
| 4-7 working days | Limited liability (₹5,000-₹25,000, depending on account type) |
| After 7 working days | Governed by your bank's own policy — least favourable |
Report to your bank’s fraud helpline directly first, then cybercrime.gov.in or 1930. If unresolved, escalate to the RBI Ombudsman via cms.rbi.org.in.
Reporting to your bank, the cybercrime portal, and the RBI Ombudsman are all completely free. Never pay anyone claiming to expedite or guarantee your recovery.
Yes — the entire process, including Ombudsman escalation, is designed for direct consumer use. A lawyer becomes useful if your bank flatly refuses a valid zero-liability claim and you need to pursue the matter through the consumer courts.
Need professional legal help with this?
Find a Lawyer on VidyodayIf your bank account itself was compromised more broadly, see our guide on your bank account being hacked. For UPI-specific fraud, our guide on UPI fraud covers that process in detail.
This is still covered under the zero-liability framework if reported within 3 working days — being deceived by a sophisticated fraud doesn’t disqualify you, since the framework specifically exists for exactly this kind of third-party fraud.
You’d fall into the limited-liability category (typically ₹5,000-₹25,000 cap on your liability, meaning you may still recover most of the amount), rather than zero liability — still worth pursuing promptly.
Entering a valid OTP doesn’t automatically mean the transaction was legitimately authorized by you if you were defrauded into providing it — push back and escalate to the Ombudsman if your bank takes this position without properly examining the circumstances.
No — only banks and law enforcement can freeze accounts, which is why filing at cybercrime.gov.in quickly matters, as it’s the mechanism that triggers this request through official channels.
The same zero-liability principles generally apply, though UPI-specific fraud has some additional reporting nuances — see our dedicated UPI fraud guide for those specifics.
This is a different, more fact-specific situation than third-party fraud, and liability considerations can differ — a lawyer’s guidance is useful if you’re dealing with this specific scenario.
Your bank may recommend or require updated security credentials as part of resolving the fraud; follow their specific guidance rather than making changes unilaterally, which could complicate their investigation.
This is itself a scam — cybercrime.gov.in and the police never charge a fee to process or expedite complaints; do not share any payment details or additional OTPs with such callers.
This article is for general information only and does not constitute legal advice. Report suspected OTP fraud to your bank and 1930 immediately — every hour matters. Consult a cyber lawyer if your bank denies a valid claim.
