RBI's zero liability framework can fully protect you from an unauthorised credit card transaction, but only if you report it within a specific window, understanding this reporting timeline matters just as much as knowing the protection exists in the first place.
The Three-Tier Liability Structure
Under current RBI guidelines, your liability for an unauthorised transaction depends primarily on how quickly you report it after being notified. Reporting within 3 working days of receiving the bank's communication about the transaction generally results in zero liability for you, provided the fraud wasn't due to your own negligence.
What Happens If You Report a Bit Later
Reporting within 4-7 working days shifts you into a limited liability tier, with capped liability amounts that vary by account type, for credit cards with limits above ₹5 lakh, this cap is commonly around ₹25,000, notably higher than the caps applied to savings accounts and prepaid instruments. Reporting after 7 working days moves the liability determination to the specific bank's own internal policy, without the regulatory cap that applies to faster reporting.
Why This Timeline Makes Prompt Action Genuinely Important
The financial difference between reporting within 3 days versus waiting a week or more can be substantial, this is precisely why setting up transaction alerts (SMS or app notifications for every transaction) and actually reviewing them promptly, rather than only checking your statement once a month, meaningfully protects your ability to claim zero liability if fraud does occur.
When Zero Liability Does Not Apply Regardless of Reporting Speed
If the fraud results from your own negligence, sharing your card details, PIN, or OTP with someone, for instance, zero liability protection doesn't apply even if you report promptly. This distinction matters considerably, the protection is designed for fraud you had no reasonable way to prevent, not for situations where your own actions directly enabled the unauthorised transaction.
How Banks Are Required to Handle a Reported Claim
Once you've reported an unauthorised transaction, the bank is required to credit the disputed amount back to your account within 10 working days from the date of reporting, without waiting for any related insurance claim to be settled first, this protects you from having funds tied up indefinitely while a broader investigation proceeds.
A Significant Regulatory Update on the Horizon
The RBI issued a further amendment in mid-2026, revising the broader framework governing fraudulent electronic banking transactions, this updated regime is set to apply to transactions from January 1, 2027 onward, and importantly extends zero liability protection to cases where fraud occurs due to the bank's own negligence, even without the customer having reported it, worth staying aware of this development as it takes effect.
Practical Steps to Take Immediately If You Suspect Fraud
- Block your card immediately through your bank's app, net banking, or customer care helpline, this stops any further unauthorised use right away
- Report the specific unauthorised transaction to your bank formally, through their designated fraud reporting channel, as soon as possible, ideally within the 3-day zero-liability window
- Follow up in writing (email or the bank's formal complaint channel) to have a documented record of your report and its timing
- Monitor your account and credit report, as discussed in our CIBIL dispute guide, for any further irregular activity following the incident
Why Setting Up Transaction Alerts Is Genuinely Your Best Defence
Given that your liability protection is directly tied to how quickly you report an issue, ensuring you actually receive and check transaction alerts for every single transaction, rather than relying solely on a monthly statement review, is the single most practical habit for protecting your full zero-liability entitlement.
Frequently Asked Questions
Does zero liability protection apply to transactions made using a lost or stolen physical card?
Yes, provided you report the loss and any resulting unauthorised transactions within the qualifying window, as discussed in our lost or stolen card guide, this scenario is specifically covered by the same zero liability framework.
What if I do not notice the fraudulent transaction until after my next statement arrives?
The reporting clock generally starts from when the bank's specific communication about that transaction reaches you, not from your statement date, this is precisely why active transaction alerts matter more than relying on periodic statement review alone.
Does the zero liability rule cover fraud committed through a compromised UPI or net banking channel as well, not just card transactions?
Yes, the broader RBI framework for unauthorised electronic transactions covers various channels, including UPI, net banking, and card transactions, following broadly similar reporting-timeline principles across these different methods.
Is there a maximum amount that zero liability protection covers?
Zero liability, when it applies, generally covers the full unauthorised transaction amount without a specific upper cap, it's the limited liability tier (for slightly delayed reporting) that carries specific capped amounts, worth understanding this distinction clearly.
