One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: You have one year from the date of the bank’s final reply to file a complaint with the RBI Ombudsman. You don’t need a lawyer to draft the email, but in disputed fraud cases like this one, a complaint that’s legally structured and evidence-heavy drastically improves the odds of a refund. And yes, if you acted fast, didn’t share OTPs, and have a transaction trail, there’s a strong chance of relief.
Mid-April 2025, a retired professor in Nagpur—let’s call him Mr. Anil Deshpande—logged into his phone’s UPI app for a routine ₹2,400 payment to a local pharmacy. The screen flickered oddly, then a second and third debit of ₹48,000 each shot out within fifty seconds. No OTP was entered. No password was typed. A piece of malware had been sitting silently on his device, hijacking the UPI session. Mr. Deshpande called his bank’s helpline within four minutes and asked them to debit-freeze the account. Within the hour, he filed a complaint with the Nagpur cyber crime cell. Same day, an official email to the bank’s nodal officer—and a physical letter at the home branch too. The bank’s first reply, an SMS, simply said: case closed—liability is customer-level. The family was exhausted. A retired couple’s savings had vanished. They had done everything right. But the bank’s internal fraud detection had rubber-stamped “customer negligence” without looking at malware logs. That’s when Mr. Deshpande’s son approached the office of Advocate Sudhir Rao. The earlier emails, politely worded, had gone nowhere. Advocate Sudhir Rao’s team reviewed the complete device forensics, mapped the transaction timestamps to prove the hijack was session-based and not user-initiated, and then drafted a RBI Ombudsman complaint that framed the case squarely under the RBI’s own circular on zero-liability for third-party fraud. His domain-specific experience in banking and cyber law helped secure a full refund within eight weeks—without stepping into a courtroom.
Key Facts of the Case
- Two rapid UPI transactions totalling ₹96,000 happened within one minute without the customer entering any OTP, PIN, or password.
- The bank was alerted within minutes by phone call, and a debit-freeze request was made.
- A formal complaint to the cyber crime cell was filed within the hour; a detailed email and physical letter reached the bank the same day.
- The bank’s SMS closure stated “liability is at customer level”—no investigation report was shared despite repeated emails to the nodal officer.
- No OTP or banking credentials were disclosed by the customer at any point; the fraud was a third-party malware session hijack.
- The RBI’s own Master Circular on Customer Protection (July 2023) mandates zero liability when the fraud is due to a third-party breach without customer negligence.
- The client approached the office of Advocate Sudhir Rao only after the bank’s unsatisfactory reply; the RBI Ombudsman complaint crafted by him argued procedural non-compliance and lack of proper investigation.
- Outcome: full amount recovered from the bank through the RBI Ombudsman’s order.
The Direct Legal Answer
What’s the deadline for escalating to the RBI Ombudsman after an unsatisfactory bank response?
The RBI Integrated Ombudsman Scheme, 2021 gives you one year from the date of receipt of the bank’s final reply. So if the bank’s closure SMS came on, say, 22 April 2025, you have until 21 April 2026. The 30-day or 90-day numbers floating around are myths—those apply to the bank’s own turnaround time, not your limitation. But here’s the thing: don’t wait a year. File as soon as you have your evidence lined up, because delay can weaken the forensic trail, and the Ombudsman may ask why you waited if you had all the facts in hand.
Will the RBI Ombudsman help if the bank says “customer liability”?
Absolutely yes—if you can show that the loss arose from a third-party breach and not from your own negligence. Under the RBI’s circular on limiting liability of customers in unauthorised electronic transactions, if the fraud is due to a banking system or third-party hack and you reported it promptly, your liability is zero. The Ombudsman looks at whether the bank followed its own circular before slapping you with the “customer liability” tag. A well-argued complaint with device logs, time-stamps, and the immediate-report evidence often reverses the bank’s decision.
Should I hire a lawyer to draft the complaint to RBI Ombudsman?
You can draft it yourself in plain language. The portal doesn’t demand legal jargon. But in a contested fraud case like this one, a complaint written by an advocate who regularly handles cyber-fraud banking disputes brings a structural advantage. The law points to specific RBI circulars, the burden-of-proof clauses, and the exact standard of “prompt reporting”—things a general DIY complaint often misses. It’s not about formality; it’s about giving the Ombudsman a clear, legally sound map to rule in your favour.
Advice in Such Cases
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
Do not accept the bank’s first SMS or email as final. Escalate internally to the nodal officer and then the principal nodal officer—keep every email. And when you file with the RBI Ombudsman, attach every piece of evidence: the cyber crime acknowledgment, the call log showing you called the bank within minutes, and ideally a screenshot of the malware scan report from your device.
This kind of matter turns on minute procedural facts. An advocate who isn’t deep into electronic banking disputes may miss the zero-liability trigger points buried in RBI circulars. Domain-specific experience makes the difference between a bland complaint and one that compels the bank to reverse its stand.
Applicable Sections of Law
- RBI Integrated Ombudsman Scheme, 2021 (issued under Section 35A of the Banking Regulation Act, 1949).
- RBI Master Circular on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (RBI/2023-24/02, dated 1 July 2023).
- Section 35A, Banking Regulation Act, 1949 – power of RBI to issue directions.
- Section 10A, Information Technology Act, 2000 – attribution of electronic records (relevant for proving transaction time-stamps).
Limitation Period
The clock starts ticking from the date you receive the bank’s final reply. You have exactly one year from that date to file a complaint with the RBI Ombudsman. If the bank never replied, the period is one year from the date of the incident or from when you first complained. This limitation bar is strict—the Ombudsman won’t entertain a complaint even a day late unless you can show extraordinary reasons for the delay. So take that SMS closure date seriously. Don’t let the anniversary slip away while you’re gathering courage.
Interim Reliefs Available
The RBI Ombudsman doesn’t grant interim orders like a court. But it can, and often does, recommend that the bank hold the disputed amount in a lien-free status or reverse a provisional debit during the pendency of the complaint. If you later move into a consumer forum or a civil court, you can seek an interim mandatory injunction under Order 39 Rule 1 and 2 CPC for a direction to the bank to maintain status quo and not debit the account further. In extreme cases, an attachment-before-judgment (Order 38 CPC) might be sought if you suspect the bank is about to frustrate the claim—though that’s rare.
Jurisdiction – Where to File the Case
The RBI Ombudsman complaint must be filed where the bank’s branch is located, or where the complainant resides, or where the cause of action arose. For Mr. Deshpande, Nagpur was both his residence and the branch location, so jurisdiction was clear. If the Ombudsman’s order is unsatisfactory, the next step is the appellate authority under the scheme within 30 days. Beyond that, a writ petition under Article 226 of the Constitution lies before the High Court. Consumer forums (District/State Commission) also have parallel jurisdiction for deficiency of service under the Consumer Protection Act, 2019, and pecuniary limits apply based on the amount involved.
How Courts Typically Approach Such Cases
Consumer forums and High Courts in writ proceedings treat RBI circulars as binding instructions with statutory force. Once the customer proves prompt reporting, no sharing of credentials, and that the fraud was a third-party breach, the burden shifts to the bank to show gross negligence on the customer’s part. Courts have consistently held that a bank’s in-house fraud team’s opinion letter is not gospel—the bank must produce technical evidence. That’s why device forensics and malware scan reports play a decisive role. The jurisprudence leans heavily in favour of the consumer who acted swiftly and transparently.
Timeline of Legal Process
- Internal bank complaint: 30 days to resolve; escalation to nodal officer adds another 15-30 days.
- RBI Ombudsman filing to disposal: 60 to 90 days on average, though complex matters can take up to 120 days.
- If the Ombudsman’s award isn’t complied with within 30 days, you can move an application for enforcement.
- Appeal before the RBI Appellate Authority: 30 days from the Ombudsman’s order.
- If you choose the consumer court route simultaneously: filing to admission takes 1-2 months; evidence and arguments can take 8-10 months; final order, 12-15 months from filing—though recent e-DAKSH dashboards show faster disposal in several states.
Understanding the Costs
The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.
A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.
Can the Matter Be Settled Out of Court?
Absolutely. Banks are increasingly settling these disputes before the Ombudsman hearing or even during mediation called by the Ombudsman. The scheme itself encourages conciliation. If both parties agree, the bank can refund the amount and the complaint is closed. In a consumer forum, a compromise deed under Section 89 CPC read with Order 23 Rule 3 can be filed, and the court will pass a decree in terms of the settlement. Lok Adalats also take up such banking complaints, and the award is final and binding. Settlement early keeps both time and stress low.
Common Mistakes People Make
- They assume the bank’s first SMS closure is the end of the road. It isn’t—escalate inside the bank first, then to the Ombudsman.
- They wait too long before filing the Ombudsman complaint, hoping the cyber cell will do magic. The two run in parallel.
- They format their device or uninstall the malware without preserving a forensic image. That kills crucial evidence.
- They post detailed incident narratives on social media before the bank resolves the case, which can complicate the evidentiary record.
- They engage a general-practice lawyer instead of an advocate with deep experience in RBI circulars and electronic transaction disputes. A non-specialist often misses the precise circular language that shifts the burden onto the bank, and the complaint ends up reading like a grievance note rather than a legal claim.
FAQs People Normally Have
Do I need to keep the fraud amount in my account during the dispute?
No. The Ombudsman doesn’t require you to maintain any balance. Once the amount has been debited fraudulently, it’s gone for now. Your claim is for restoration.
What if the cyber cell recovers some money—does that affect my bank complaint?
It doesn’t. The recovery from the fraudster account is a separate criminal proceeding. You can still claim the full amount from the bank if the liability falls on them under the RBI circular. Any recovery from the fraudster later would have to be adjusted, of course.
Can I file both a consumer case and an RBI Ombudsman complaint?
You can file both, but not for the same cause of action simultaneously if the Ombudsman has already taken it up. It’s better to exhaust the Ombudsman remedy first because it’s cost-free and fast. If dissatisfied, approach the consumer forum next.
Is there any fee for filing with the RBI Ombudsman?
Zero. The complaint portal is free, and you don’t need a stamp paper or court fee. That’s one of the best things about it.
This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.
Advocate Sudhir Rao, Supreme Court of India
Facing a similar matter? Speak to a criminal advocate in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.