Online banking fraud in India: a woman’s recovery and safety guide
A step-by-step guide to stopping an unauthorised bank or payment transaction, preserving evidence, understanding RBI customer-protection rules and escalating a blocked complaint.
In this guide
The first minutes matter
A fraudulent debit can happen through a card, UPI, internet banking, a fake support call or a phone controlled by someone close to the woman. Safety and a fast bank report come before proving who is to blame.
Contact the bank or payment provider immediately
Use the number in the bank’s official app, card or website, report the unauthorised transaction and ask for the account, card, UPI or wallet to be blocked or secured. Keep the complaint number.
Use a safer device and contact
If a partner, family member or malware may monitor the phone, use a trusted device or staffed bank branch. Do not announce a password change where it could trigger violence.
Preserve the transaction details
Save the amount, date, time, UTR or transaction ID, account, merchant, SMS, email, caller number and screenshots. Do not delete the only evidence.
Report a cyber incident
The National Cyber Crime Reporting Portal is an official route for online fraud and related offences. Follow its current instructions and keep the acknowledgement.
Call emergency help for coercion
If someone has taken the phone, forced a transfer, confined the woman or threatens violence, move to a staffed place and call 112 when safe.
Build a clear fraud record
Banks and investigators need a concise timeline. Keep facts separate from guesses and store a copy where a controlling person cannot edit it.
Write what happened in order
Record the first message or call, the link or app, what was entered or approved, each debit, the time reported and every response from the bank.
List the accounts and credentials at risk
Note the bank, card, UPI ID, wallet, email, SIM, device and any shared access. Never write a live PIN or OTP in the complaint.
Keep bank acknowledgements
Save the complaint number, email, branch receipt, call recording reference, ticket status and the name or ID of the person who responded.
Separate authorised and unauthorised transfers
Mark any payment the woman made herself under pressure, a mistaken transfer, a credential-sharing event and a transaction she did not approve. The remedy can differ.
Name the safest follow-up
Choose a branch, phone, email or supporter the suspected person cannot monitor. Ask for accessible communication and a local-language explanation.
| Transaction or account | What happened and when? | Report, block or escalation reference |
|---|---|---|
| Bank, card or UPI | ||
| First unauthorised debit | ||
| Bank or provider complaint | ||
| Cybercrime or Ombudsman route |
What RBI customer-protection rules say
RBI’s customer-protection directions use different rules for bank deficiency, third-party breach and customer negligence. They reward prompt reporting, but they do not make every disputed transaction automatically refundable.
Report at the earliest
RBI tells banks to provide a way to report unauthorised electronic transactions quickly and to act to prevent further loss. Use the official channel and keep proof.
Understand the three-working-day rule
In a third-party breach where neither the bank nor customer is at fault, reporting within three working days of the bank communication can lead to zero customer liability under the cited directions. Check the current category and facts.
Shared credentials can change liability
If the customer shared payment credentials, the directions treat the loss before reporting differently. Tell the bank exactly what happened and ask for a written decision; do not hide coercion or monitoring.
Ask about shadow reversal
The cited RBI directions describe crediting the amount involved within 10 working days after notification in zero- or limited-liability cases, without waiting for an insurance settlement. Confirm the current process with the bank.
Do not accept a verbal rejection
Ask for the reason, evidence relied on, appeal or nodal officer and the next date. A bank’s internal policy and current RBI directions govern the final outcome.
Escalate a blocked complaint
A bank or payment provider should receive the first complaint. The RBI Integrated Ombudsman route may be available for covered regulated entities when the response is missing or unsatisfactory.
Start with the bank’s grievance channel
Send the timeline, transaction IDs, report time, requested block or reversal and copies of acknowledgements to the official grievance contact.
Use RBI CMS when eligible
If a covered regulated entity does not respond or resolve the complaint within the applicable period, currently 30 days under the cited scheme, check the RBI Complaint Management System and Ombudsman route.
Keep cybercrime and banking tracks together
A cybercrime report does not replace the bank’s fraud report, and a bank complaint does not replace a police or cybercrime route where there is impersonation, extortion or threats.
Seek legal aid for coercion or disputed liability
Legal-services authorities and NALSA can help organise records and identify the current forum. They cannot promise a refund or criminal result.
Review the account after resolution
Change access safely, remove unknown beneficiaries, check mandates and alerts and ask the bank how to prevent repeat debits. Keep monitoring without blaming the woman.
Financial control can sit behind the fraud
A woman may be pressured by a partner, relative, employer or agent to share credentials, open an account, receive funds or take responsibility for someone else’s transaction. A safe response restores control to her.
Ask who initiated the transaction
Write who had the phone, SIM, PIN, OTP, card, app login and physical access. Coercion and unauthorised access should be recorded, not dismissed as a ‘family matter’.
Keep an independent contact and account
Where safe, use a private email, phone and bank contact that another person cannot monitor. A supporter should not replace the woman as the account owner.
Protect essentials before repayment
Food, rent, medicine, transport, children and a safe phone come before a pressured promise to repay. Women Helpline 181 or a One Stop Centre may help connect support.
Do not share evidence publicly
Posting account numbers, intimate messages, address or ID images can create new fraud and stalking risks. Send only the minimum to an official channel.
Use a calm supporter script
A supporter can help call the bank, write the timeline and accompany a branch visit while leaving passwords, decisions and original documents with the woman.
Questions people ask
What should I do after an unauthorised debit?
Contact the bank or payment provider immediately, request blocking or securing the account, preserve transaction details and use the official cybercrime route where relevant.
Will the bank always refund the money?
No automatic result applies to every dispute. RBI rules distinguish bank fault, third-party breach and customer negligence; report promptly and ask for a written decision.
What if my partner forced me to share the OTP?
Tell the bank and support service what happened, choose a safer device and record the coercion. A family relationship does not make forced access voluntary; seek legal or emergency help if danger continues.
When can I approach the RBI Ombudsman?
Usually after first complaining to the covered regulated entity and waiting for the applicable period, currently 30 days in the cited scheme. Check the current coverage and CMS instructions.
What can a supporter say?
‘We will report quickly, keep the transaction and complaint numbers safe, protect your account from further access and choose the bank, cybercrime or legal route without blaming you.’
Related practical guides
Related issue guides
Sources and publication record
Draft prepared 16 September 2026; project-team editorial review pending · Sources checked .
- RBI customer protection for unauthorised electronic banking transactionsReserve Bank of India
- Reserve Bank Integrated Ombudsman Scheme, 2021Reserve Bank of India
- National Cyber Crime Reporting PortalIndian Cybercrime Coordination Centre, Ministry of Home Affairs
- Digital Personal Data Protection Act, 2023India Code, Legislative Department
- Information Technology Act, 2000India Code, Legislative Department
- Bharatiya Nyaya Sanhita, 2023India Code, Legislative Department
- Protection of Women from Domestic Violence Act, 2005India Code, Legislative Department
- The Constitution of India (official 2024 edition)Legislative Department, Ministry of Law and Justice
- Legal Services Authorities Act, 1987India Code, Legislative Department
- Free legal services and National Legal Aid Helpline 15100National Legal Services Authority
- Emergency Response Support System 112Ministry of Home Affairs
- Women Helpline 181Ministry of Women and Child Development
- One Stop Centre schemeMinistry of Women and Child Development
- Justice K.S. Puttaswamy (Retd.) v. Union of India, Supreme Court judgment (24 August 2017)Supreme Court of India