Report an unauthorised ACH transaction to your bank immediately and take steps to prevent further unauthorised debits. RBI directions state that customers should notify their bank as soon as possible, as delays in reporting an unauthorised transaction can increase the customer's exposure to loss.
Follow these steps:
- Contact your bank immediately: Use the bank's official customer service, branch or digital reporting channel to report the transaction
- Request transaction protection: Ask the bank to take appropriate steps to prevent further unauthorised transactions
- Record the complaint: Keep the complaint or acknowledgement reference number for future follow-up
- Preserve evidence: Save transaction details, statements, alerts, screenshots and suspicious messages
- Report financial cyber fraud: If the transaction resulted from cyber fraud, report it through the National Cyber Crime Reporting Portal or call 1930, the national cybercrime helpline
- Review connected mandates: Check whether an unfamiliar mandate or recurring instruction is linked to the transaction and raise the issue with the relevant bank or institution
NPCI states that complaints relating to fraudulent, unidentified or unauthorised transactions should be raised with the respective bank for redressal.
If the unauthorised transaction affected your EMI payment specifically, check your loan account afterwards to confirm your EMI was correctly processed and your account isn't showing as overdue as a result of the fraud, and raise a service request with Bajaj Finance if it is.
What are the customer liability rules for ACH fraud?
Customer liability for an unauthorised electronic transaction depends on the circumstances of the fraud and how quickly it is reported. Under RBI's customer protection framework for unauthorised electronic banking transactions, liability may be zero, limited or determined under the bank's applicable policy depending on the circumstances.
The broad framework includes:
- Bank negligence or deficiency: A customer can have zero liability where the unauthorised transaction results from the bank's negligence, fraud or deficiency, subject to the applicable RBI framework
- Third-party breach: Where neither the bank nor the customer is responsible for the breach, reporting the transaction within three working days of receiving the transaction communication can result in zero liability
- Delayed reporting: Reporting after three working days may result in limited liability for certain third-party breaches, subject to the applicable conditions
- Customer negligence: If the loss results from sharing payment credentials, the customer bears the loss until the transaction is reported to the bank. Transactions occurring after reporting are treated differently under the RBI framework
The bank is responsible for establishing customer liability where applicable. RBI also provides for crediting the amount involved in an unauthorised electronic transaction to the customer's account within 10 working days from notification in cases covered by the zero or limited liability framework.
What legal action is possible in an ACH fraud case?
Legal action for ACH fraud depends on the nature of the fraudulent activity, the evidence available and the circumstances of the transaction. In India, the Information Technology Act, 2000 includes provisions relating to computer-related offences, identity theft and cheating by personation using a computer resource. Depending on how the fraud occurred, Sections 66, 66C, and 66D may apply. An affected account holder should report the unauthorised transaction to the bank promptly and report financial cyber fraud through 1930 or the National Cyber Crime Reporting Portal. Keep transaction records, bank statements, messages, emails and other relevant communications as evidence. If requested, provide these records to the investigating authority and follow the bank's complaint and escalation process. Early reporting can support timely investigation and may help the concerned authorities trace the transaction. However, reporting a fraud does not guarantee recovery of the disputed amount or a specific legal outcome. The result depends on the facts, evidence, investigation and applicable rules.