Unauthorized Transaction on Bank Account — What To Do Right Now

If you see a transaction on your bank account that you did not make — money debited, a card payment you didn't authorise, or a transfer you never initiated — act within the next 60 minutes. Speed is everything for recovery.

This guide tells you exactly what to do, step by step, to freeze your account, report the fraud, and maximise your chances of getting the money back.

Important: Under RBI circular, if you report an unauthorized transaction within 3 working days of receiving bank communication, your liability is zero for third-party fraud. Don't wait.

Step 1: Block Your Account Immediately (Do This First)

Block via Bank Customer Care (Fastest)

Say exactly: "I have an unauthorized transaction. Please immediately block my account and debit card."

Block via Mobile Banking App (If Available)

1. Open your bank's app
2. Go to Card Services → Block Card (blocks card transactions immediately)
3. Or: Account Settings → Temporarily Block Account

Block via SMS

• SBI: SMS BLOCK XXXX (last 4 digits of card) to 567676
• HDFC: SMS BLOCK <last 4 digits> to 5676712
• ICICI: SMS BLOCK <last 4 digits> to 9215676766

Step 2: Screenshot Everything

Before doing anything else, screenshot and save:

• The SMS alert showing the transaction (with time, amount, description)
• Your bank statement showing the debit
• Any suspicious emails or messages you received recently
• Your chat/call logs if you spoke to anyone recently

This evidence is critical for the police complaint and bank dispute.

Step 3: File a Cybercrime Complaint (Within 24 Hours)

Online Complaint at cybercrime.gov.in (Fastest)

1. Go to cybercrime.gov.in
2. Click "Report Cyber Crime"
3. Select "Financial Fraud"
4. Fill in: your details, bank details, transaction details, amount, date/time
5. Upload screenshots of the transaction SMS/statement
6. Submit — note the complaint acknowledgment number

This is critical: Cybercrime portal complaints are routed to the bank's fraud department. Banks are required to act on these complaints.

Helpline: 1930 (National Cyber Crime Helpline)

• Call 1930 — 24×7 national cybercrime helpline
• Report the fraud immediately — they can coordinate with banks to freeze the money before it moves

Step 4: File a Formal Dispute with Your Bank

1. Visit your home branch in person (same day if possible)
2. Carry:
   • Aadhaar and PAN (originals)
   • Transaction SMS / statement showing unauthorized debit
   • Cybercrime complaint acknowledgment number
3. Fill the "Fraud/Dispute Form" or "Transaction Dispute Form"
4. Request a written acknowledgment from the bank with date
5. Ask for your Chargeback Reference Number

Via Net Banking / App (Alternative)

Many banks allow online dispute raising:

• SBI: Net Banking → Services → Fraud Reporting
• HDFC: Customer Care → Report Fraud
• ICICI: iMobile → Help → Report Unauthorized Transaction

Step 5: File FIR at Police Station

1. Visit your nearest police station (or file at cybercrime police station in your city)
2. Carry all documentation: screenshots, bank statement, cybercrime complaint number
3. File FIR under Section 420 IPC (Cheating) + IT Act Section 66C/66D
4. Get FIR copy — this is needed for RBI Ombudsman if bank doesn't refund

RBI Zero Liability Rules — Know Your Rights

Under RBI Circular (2017) on limiting customer liability in unauthorized electronic transactions:

Critical: The 3-day clock starts from the date the bank notified you (SMS/email), not from when the transaction happened.

Types of Unauthorized Transactions & Who Is Liable

Most recoverable: ATM skimming, SIM swap, bank system errors. Least recoverable: Voluntary OTP sharing ("you got a call from 'bank officer'" scams).

If Bank Refuses to Refund — Escalate to RBI Ombudsman

If the bank does not resolve within 30 days of complaint:

1. Go to bankingombudsman.rbi.org.in or cms.rbi.org.in
2. File complaint with:
   • Bank complaint reference number
   • Date of complaint to bank
   • FIR copy
   • Bank's response (or proof they didn't respond)
3. RBI Ombudsman handles within 30 days
4. Maximum award: ₹20 lakh for banking ombudsman

This escalation path has very high success rate — banks resolve most cases before RBI Ombudsman formally investigates.

Common Fraud Types in India 2026

1. OTP Fraud ("KYC Update" Call)

Fraudster calls posing as bank official, says KYC is expiring. Asks for OTP. Rule: Bank never asks for OTP. Disconnect immediately.

2. SIM Swap Fraud

Fraudster calls your telecom operator with your details and swaps your SIM. All OTPs go to them. Sign: Your phone suddenly loses network. Call your carrier immediately.

3. UPI Payment Request Fraud

Fraudster sends a UPI collect request (not a payment). When you enter PIN to "accept money", money is debited. Rule: You NEVER need to enter UPI PIN to RECEIVE money. PIN = payment authorisation.

4. Fake Bank SMS/Link

SMS claiming "your account is blocked, click here to unblock". Link steals credentials. Rule: Never click links in SMS. Always type bank URL manually.

5. ATM Card Skimming

Device fitted on ATM reads your card data. Fake transaction from cloned card. Sign: Check ATM card slot before inserting. Cover keypad while entering PIN.

Preventive Measures — After Recovery

1. Change all banking passwords and MPIN immediately
2. Enable transaction alerts via SMS (should already be on, verify)
3. Set transaction limits in your banking app (e.g., max ₹10,000 per transaction)
4. Freeze international transactions if you don't travel abroad
5. Unlink UPI from old/unused apps — check all UPI apps linked to your number
6. Register mobile number for all your bank accounts if not done

Frequently Asked Questions

How long does the bank take to refund an unauthorized transaction? RBI mandates banks to refund within 10 working days of a complaint (if reported within 3 days). Most banks refund within 5–7 working days if liability is clear. Complex cases take 30–45 days.

What if I shared my OTP accidentally — can I still get a refund? Sharing OTP makes recovery harder (partial liability), but not impossible. File the complaint immediately. Banks often settle 50%–100% if it's a first-time incident and you act fast.

Can I get my money back if the fraud was 3 months ago? Very difficult. The 3-day limit is strict for zero liability. After 7 days, recovery depends on bank's discretion and police investigation. File the FIR and try — some cases do get resolved months later.

Is cybercrime.gov.in complaint enough, or do I also need FIR? File both. cybercrime.gov.in complaint triggers bank action. FIR is required for RBI Ombudsman and legal proceedings. Both together give you the strongest case.

The bank says I shared OTP so they won't refund — what can I do? File with RBI Ombudsman. Also file FIR citing the fraudster's number (they often have a trail). In cases of SIM swap or phishing where the customer genuinely didn't knowingly share credentials, RBI Ombudsman often rules in favour of the customer.