Consumer complaint bank fraud: step-by-step legal guide

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Online fraud

A bank becomes answerable to you as a consumer when money leaves your account without your authority and the failure lies with the bank's systems, staff or security. Under the Consumer Protection Act, 2019, a bank's refusal to reverse an unauthorised transaction can be a deficiency in service you can challenge before a consumer commission.

A consumer complaint bank fraud case is not about punishing the thief. It is about asking the bank to answer for its own failure in the chain — a card that should have been blocked, a fraud report that sat unread, a reversal promised and never made, a lien on the wrong account. The Consumer Protection Act, 2019 treats banking as a service, and a shortcoming in that service is a 'deficiency in service' that a consumer commission can act upon. That is a genuinely separate remedy from the criminal case against the fraudster.

Two legal layers usually decide whether you win. The first is the RBI's directions on unauthorised electronic transactions, which fix how much of the loss you can be made to bear and give you a timeline the bank must respect. The second is the consumer commission's power to order a refund, interest and compensation where the bank has not honoured those directions. Read together, they turn an argument about whose fault it was into a paper exercise: what did the bank's records show, and by when did you report it.

When a bank is answerable — and when it is not

A bank is answerable when the unauthorised transaction happened despite reasonable security, when it delayed or refused a genuine fraud report, when it debited you after promising not to, when it failed to block a card or account on request, when it shared or mishandled your data, or when it charged fees not disclosed to you. In each of these cases the complaint is against the bank's conduct, not against the person who took the money.

It is not answerable for the way a free market investment you authorised later failed, for a loan you knowingly signed, or for a transaction you authorised and then regretted. Nor is it answerable when your own gross negligence — writing down a password and PIN together, or responding to a phishing page with your OTP — is the direct cause, though the RBI's directions still limit your liability in a third-party breach. A commission deals with established services and established obligations; if the loss is entirely the fraudster's and the bank has done everything required of it, the criminal case is your real remedy.

Where you file: the commission and the value rules

Consumer commissions sit at three levels, and the value of the goods or services paid as consideration decides which one hears your complaint. Under the 2021 rules the District Commission hears claims where the consideration does not exceed ₹50 lakh, the State Commission hears claims between ₹50 lakh and ₹2 crore, and the National Commission hears claims above ₹2 crore. Nearly every individual banking dispute therefore belongs before the District Commission in the district where the branch or the complainant is situated.

What went wrong	The ground you plead	What you want from the bank
Money left the account without your authority	Deficiency in service; breach of RBI directions on unauthorised transactions	Recredit of the amount with interest
Card or account not blocked after your request	Deficiency in service and negligence	Recredit of later transactions and compensation
Reversal promised in writing but not made	Deficiency in service and unfair trade practice	Amount, interest, compensation and costs
Recovery calls outside the bank's own code	Deficiency in service	Stop the conduct, compensation for harassment
Undisclosed charges or forced bundling	Unfair trade practice	Refund of the charge and compensation

Step-by-step: filing the complaint

Report to the bank in writing, at once. Do it the same day. Email the branch, the nodal officer and the customer care address, keep the acknowledgement, and record the date and time. This one document decides most of the case.
Register the offline track separately. Also report the transaction on cybercrime.gov.in or on 1930 and keep the acknowledgement number. The RBI directions require a prompt report, and the police record supports the consumer complaint without being necessary to it.
Serve a formal notice. Send the bank a written notice describing the transaction, the loss, the RBI directions it has breached and the relief you want, and give it 15 days to respond. Most complaints are either settled here or strengthened here.
Wait out the bank's timeline. The bank is expected to respond within the period fixed by the RBI, and if it does not reply at all you can also move the banking ombudsman. For the consumer commission there is no mandatory waiting period, but proving you gave the bank a fair chance helps.
Prepare the complaint. Include your name and address, the branch, the facts in order, the deficiency, the evidence, the relief claimed and the valuation. Attach the account statement, the transaction reference, the written complaint and the bank's reply.
File it. Most State and District Commissions accept complaints through the e-Daakhil portal, and paper filing is still available. Pay the prescribed fee, which is small for claims of this size, and keep the diary number.
Follow the hearing dates. Consumer complaints are meant to be decided within about three months where no testing or analysis of goods is needed, though in practice delays happen. Appear, file your evidence affidavit, and press for the order.
Enforce the order if needed. If the bank does not comply, the commission can be asked to enforce the order as a decree, and a non-compliant bank faces consequences for delay.

What you can ask for

Recredit of the unauthorised amount, with interest from the date of the transaction.
Compensation for the deficiency, including money spent, time lost and mental agony caused by the bank's conduct.
Costs of the proceedings, which are modest but real.
Directions to correct the practice, such as wrongful entries in your records, a wrongly reported default, or a charge that should never have been levied.

What you cannot ask a consumer commission to do is convict a fraudster or order the police to arrest him. That belongs to the criminal case. Keeping the two apart keeps both clean: the commission looks at the bank's conduct, and the criminal court looks at the offence.

The RBI layer that does most of the work

The RBI's directions on limiting customer liability in unauthorised electronic banking transactions are the strongest tool an Indian victim has. Their structure is simple. If the loss flowed from contributory fraud, negligence or deficiency on the bank's side, the customer's liability is zero, whether or not the transaction was reported. If the breach was a third-party one where the deficiency lay elsewhere in the system, the customer still has zero liability provided the bank is notified within three working days of receiving the bank's communication about the unauthorised transaction. If the customer notifies after three working days but within seven, the liability is limited and shared as the directions prescribe; beyond seven working days, the bank's board-approved policy applies. The bank must also act on the report immediately and complete a shadow reversal within a defined time.

That framework converts the argument. Instead of proving who hacked you, you show the date you told the bank. A bank branch manager who tells you to 'wait for the police' without recording your report is creating exactly the deficiency the commission will look at. Because these directions sit under the RBI's regulatory power, a consumer commission can and does read them against the bank's conduct.

What decides the outcome

Courts and commissions weigh the same four things. First, the date and manner of your report: a timestamps-on email beats a phone call, and a phone call beats nothing. Second, the bank's own record: whether its log shows the transaction as unauthorised, whether its fraud monitoring flagged it, and whether its staff acted on your instruction. Third, the customer's conduct: sharing an OTP, clicking a link, or leaving a device unlocked may reduce your claim, while ordinary care strengthens it. Fourth, the value and nature of the loss: commissions are comfortable with recredit and interest, less predictable on large compensation claims.

It also matters that you plead the deficiency, not just the loss. A complaint that says 'money was stolen, so the bank must pay' invites the bank's standard answer that the fraud was a third party's act. A complaint that says 'the bank was told on this date and failed to act, contrary to the RBI directions' gives the commission something specific to hold the bank to.

Mistakes that get complaints dismissed

Complaining only by phone. Without a written record, you cannot show when the bank was informed.
Filing after two years. A consumer complaint must ordinarily be filed within two years of the cause of action, and condonation is discretionary, not a right.
Suing the wrong party. Name the bank and the branch, not the fraudster, in the consumer forum; the fraudster belongs in the criminal case.
Attaching nothing. Statements, transaction references and the bank's own replies are the complaint.
Overvaluing the claim to reach a higher commission. Pecuniary jurisdiction is fixed by the consideration paid for the service, not by your estimate of suffering.

Consumer commissions and the banking ombudsman overlap, but they are not a queue you can join twice for the same relief. The ombudsman route under the RBI scheme and the consumer route both need the same written record, so build that record first and then choose. Where the loss is significant, a coordinated approach helps: a cyber crime lawyer in Kolkata can run the fraud FIR while the consumer complaint proceeds on the bank's conduct, so that neither remedy is weakened by the other. West Bengal victims often also file before the District Commission at Kolkata, and the practical mechanics of that filing are covered in our West Bengal page.

What the bank will argue, and how to answer it

Banks defend these complaints in a predictable way. The first answer is that the transaction was authenticated with an OTP or a PIN, so it must have been the customer's own doing. That is an assertion, not proof. A commission will ask for the authentication logs, the internet protocol address, the device identifier and the alert records, and the assertion does not survive if the bank cannot produce them or if its alerts went to a phone number or email it never updated.

The second answer is that fraud is a crime, so the police should deal with it. The answer to that is simple: the fraudster's criminal liability and the bank's obligation to its customer are different things, and the bank's duties under the RBI's directions on unauthorised transactions do not disappear because a crime was committed by someone else. A third answer, delay, is answered by the written complaint and its acknowledgement. A fourth, that the first transaction was genuine and only the later ones were disputed, is answered by the statement itself, which shows the pattern. Anticipating each of these in the complaint is what turns a general grievance into a case the bank has to meet.

When to involve a lawyer

Bring in a lawyer if the loss is large, if the bank has denied liability in writing, if its reply blames you for sharing credentials you never shared, or if the commission has issued a notice that needs a considered reply. The complaint itself is deliberately simple — it is written for a lay consumer — but the bank will send trained staff, and the difference between a complaint that gets a recredit and one that gets dismissed is usually the precision of the pleaded date and the RBI directions relied on. Preserve everything, complain in writing the same day, and let the paper trail do the work.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Can I file a consumer complaint against a bank for online fraud?

Yes. Banking is a service under the Consumer Protection Act, 2019, so a bank's failure to reverse an unauthorised transaction or to act on your fraud report can be pleaded as a deficiency in service. The complaint lies against the bank's conduct and is separate from the criminal case against the fraudster.

Which consumer commission hears a bank fraud complaint?

The District Commission normally hears individual banking disputes because the consideration paid for the service does not exceed ₹50 lakh under the 2021 jurisdiction rules. The State Commission hears claims between ₹50 lakh and ₹2 crore, and the National Commission hears those above ₹2 crore. The consideration is what you paid the bank for the service in dispute, not the amount you lost.

What is the time limit to file a consumer complaint against a bank?

A consumer complaint must ordinarily be filed within two years from the date the cause of action arose, which is usually when the bank refused to reverse the transaction or the deficiency became known. Delay beyond two years needs condonation, which the commission may or may not grant, so the date of the bank's refusal is the date that matters.

How much of my money can I lose if I report a fraud late?

Under the RBI directions on unauthorised electronic transactions, liability is zero if you notify a third-party breach within three working days of the bank's communication. Notifying within four to seven working days makes liability limited and shared, and beyond seven working days the bank's board-approved policy applies. Write to the bank the same day, because the notification date fixes your liability.

What documents do I need for a bank fraud consumer complaint?

The account statement showing the transaction, the transaction or UTR reference, your written fraud report with its acknowledgement, the bank's reply or its silence, and any communication from the nodal officer. These documents establish the date you informed the bank, which is the single most important fact in the case.

Is a consumer complaint better than the banking ombudsman?

Both work, and both need the same written record. The ombudsman route under the RBI scheme is free, quick and non-adversarial but cannot be run through an advocate, while the consumer commission can award compensation and costs but takes longer. Choose one for the same grievance rather than filing both.

Can I claim compensation for harassment by the bank?

Yes, if the bank's conduct itself caused the harm. A commission can award compensation for mental agony, time and expense caused by a deficiency in service, and it can also direct the bank to correct wrongful entries in your records. Compensation depends on evidence of the bank's conduct, not merely on the original fraud.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact