Legal information notice: this article provides general information and isn't a substitute for advice from a qualified lawyer.
An IMPS transfer you never made has left your account — instant, irreversible-feeling, and gone before you even got the debit alert. IMPS moves money in real time, 24×7, which is exactly what makes unauthorized IMPS transactions so alarming — but it also means fast reporting genuinely improves your odds of getting the money back. Here’s exactly what to do.
Under the RBI’s framework on unauthorized electronic banking transactions, if the fraud happened due to a third-party breach (not your own negligence, like sharing an OTP knowingly) and you report it to your bank within 3 working days of receiving the transaction alert, your liability is zero — the bank must credit the full amount back. Reporting within 4-7 working days brings limited liability instead; beyond that, liability depends on your bank’s own board-approved policy.
Call the helpline number on the back of your card or your bank’s official app — report the specific unauthorized IMPS transaction with its reference number, and get a complaint/ticket number before you hang up.
Report at cybercrime.gov.in or call the helpline 1930 — reporting within the “golden hour” of the fraud gives law enforcement the best chance of freezing the funds in the recipient’s account before withdrawal.
Follow up your phone report with a written complaint (email or the bank’s formal complaint form) — this creates the documented timeline that matters for the zero/limited liability determination.
The bank assesses whether the transaction resulted from its own security failure, a third-party breach, or your own negligence — this classification directly determines your liability under RBI’s framework.
If the bank rejects your zero/limited liability claim without adequate justification, escalate through the RBI’s Complaint Management System.
IMPS is a genuinely fast-moving payment rail — funds can be withdrawn or moved onward within minutes of an unauthorized transfer completing. This is exactly why the sequence matters: report to your bank AND file on the cybercrime portal essentially simultaneously, rather than doing one and then the other — both trigger different, complementary freeze mechanisms, and neither substitutes for the other.
Banks sometimes push back on liability by arguing the transaction shows characteristics of “customer negligence” — a shared OTP, a screen-sharing app installed, a suspicious link clicked. If you didn’t knowingly share anything and were the victim of a sophisticated scam (fake customer care call, phishing message impersonating your bank), this is worth contesting directly — negligence requires more than simply having been deceived by a convincing scam.
If NPCI’s UPI/IMPS Dispute Redressal mechanism is available for your specific case (this depends on how the transaction was initiated), filing there in parallel with your bank complaint can add another layer of pressure toward resolution, particularly where the receiving bank needs to be brought into the loop.
| When You Report | Your Liability |
|---|---|
| Within 3 working days (third-party breach) | Zero liability — full amount credited back |
| 4 to 7 working days | Limited liability — capped per RBI's framework |
| Beyond 7 working days | Liability as per your bank's board-approved policy |
| Fraud due to bank's own negligence | Zero liability regardless of when you report |
Report to your bank directly, and file a parallel report on cybercrime.gov.in or via 1930. Escalate unresolved liability disputes to the RBI Ombudsman.
All of these channels — bank complaint, cybercrime portal, 1930, and RBI Ombudsman escalation — are completely free.
Most unauthorized IMPS disputes are resolved directly with the bank and, if needed, the RBI Ombudsman, without a lawyer. Legal help becomes useful mainly where the bank wrongly denies a clear-cut zero-liability claim and keeps stonewalling.
Need professional legal help with this?
Find a Lawyer on VidyodayIf the unauthorized transfer happened via NEFT or RTGS instead, our guide on unauthorized NEFT/RTGS transfers covers that channel-specific process. For the broader picture of recovering money lost to any net banking fraud, see our guide on net banking fraud money recovery.
Report the moment you notice — the 3-working-day clock runs from when you received the bank’s transaction alert (SMS/email/app notification), not from when the transaction actually occurred, so check your alert history carefully.
This is considerably harder, though not always impossible — your bank’s zero/limited liability determination still applies to your claim against the bank, separate from whether law enforcement can recover funds from the recipient.
The underlying RBI liability framework applies across electronic banking channels including IMPS, though the specific dispute-filing mechanism can differ slightly by how the transaction was initiated.
Dispute this specifically and ask for the bank’s evidence — an unsupported assertion of OTP-sharing isn’t sufficient grounds to deny a zero-liability claim, and this is exactly the kind of dispute the RBI Ombudsman can review.
The zero-liability principle itself isn’t capped by amount when the breach is third-party and reported within 3 days — the amount matters more for how carefully the bank investigates, not whether the rule applies.
Yes — report regardless of amount, both to protect your right to recovery and because a small unauthorized transaction can be a test transaction preceding a larger one.
Generally yes, unless your account itself has been temporarily restricted as part of the investigation — check with your bank about your account’s current status.
Report all of them together with their individual reference numbers — this pattern (multiple rapid transactions) is itself relevant evidence of a third-party breach rather than an isolated error.
This article is for general information only and does not constitute legal advice. Liability determinations depend on the specific facts of each case — consult a cyber law lawyer for guidance specific to your situation.
