Unauthorised ATM withdrawals and card cloning leave customers facing their own bank across the table. The customer's rights are stronger than most realise: the RBI's limited-liability framework, the ombudsman route and the criminal law together provide a structured path. The chamber of Advocate Manish Jha advises on all three.
How These Frauds Occur
Skimming devices fitted on ATM card slots copy the magnetic stripe while a concealed camera or overlay captures the PIN; the data is written onto a cloned card and used for withdrawals, often in another city. Card details are also harvested through phishing and compromised merchant systems.
The RBI Limited-Liability Framework
The Reserve Bank's circular on customer protection in unauthorised electronic banking transactions limits what a customer can be made to bear:
- Where the fraud results from the bank's own negligence or a third-party breach — not the customer's fault — and the customer reports it within three working days of learning of it, the customer bears zero liability.
- Reporting within four to seven working days caps the customer's liability at prescribed amounts depending on the account type.
- Beyond seven working days, liability is governed by the bank's board-approved policy.
The burden of proving that the customer was negligent lies on the bank. Prompt written reporting — not merely a phone call — is therefore the single most important protective step.
Escalation and Criminal Remedies
If the bank rejects the claim or does not resolve it within the prescribed period, the customer may escalate to the RBI Ombudsman under the Integrated Ombudsman Scheme, 2021. In parallel, a criminal complaint should be pursued: cloning and unauthorised use involve identity theft and cheating by personation under Sections 66C and 66D of the Information Technology Act, 2000, and cheating under Section 318 of the Bharatiya Nyaya Sanhita, 2023 (earlier Section 420 IPC). Reporting on cybercrime.gov.in and the 1930 helpline supports both tracks.
See also banking fraud and cheque dishonour and the chamber's cyber law practice.
Frequently Asked Questions
Am I liable for an unauthorised ATM withdrawal?
Under the RBI's limited-liability framework, if the fraud was not due to your negligence and you report it within three working days of learning of it, you bear zero liability and the bank must make good the amount. Later reporting can attract capped liability, so immediate written notice to the bank is critical.
The bank says the PIN was used, so it must be me. Is that an answer?
Not by itself. Cloned cards are used with PINs captured by skimming cameras and overlays, and the RBI framework places the burden of proving customer negligence on the bank. CCTV footage, the location of the withdrawal and your own whereabouts are all relevant, and the claim can be escalated to the RBI Ombudsman.
Should I also file a police complaint?
Yes. A criminal complaint under the IT Act and the Bharatiya Nyaya Sanhita creates an official record, supports your claim against the bank, and can lead to tracing of the offenders. Report on the 1930 helpline and cybercrime.gov.in, then follow up with the cyber police station for FIR registration.