Customer Rights, Fair Practices and Unauthorized Transactions
Customer Rights, Fair Practices and Unauthorized Transactions. A detailed chapter in KYC, AML, Cybersecurity & Customer Protection, with explanations and examples for Indian banking examinations.
By Akhilesh Saini · Reviewed 8 Oct 2026
1. Banking is a service relationship
A bank is not only a lender or deposit-taker; it also owes customers fair treatment, clear disclosures, reasonable security and avenues for redress. The nature of the obligation depends on the product and law.
For exam preparation, distinguish broad consumer-rights principles from product-specific enforceable directions.
2. RBI's five customer-rights principles
RBI released its Charter of Customer Rights in 2014. The five overarching rights are:
- Right to Fair Treatment.
- Right to Transparency, Fair and Honest Dealing.
- Right to Suitability.
- Right to Privacy.
- Right to Grievance Redress and Compensation.
These are a simple framework for analysing bank-customer disputes.
3. Fair treatment
Customers should be treated courteously and without unfair discrimination. Processes should not cause needless hardship; different customers may need accessible service through branches, BCs, digital channels or permitted alternative verification methods.
Example: A senior customer needing a straightforward re-KYC update should be informed of permitted channels rather than being sent from desk to desk without explanation.
4. Transparency and honest dealing
A bank should communicate relevant terms before a customer commits:
- rate and reset method;
- interest and fees;
- penalties/charges;
- product risks;
- repayment obligations;
- complaint routes.
Hidden costs and unclear sales representations reduce meaningful customer choice.
5. Product suitability and mis-selling
A product may be legal but unsuitable for a customer's needs. Mis-selling occurs when the customer is improperly persuaded or materially misled regarding characteristics, risks or benefits.
Example: Promoting a market-linked insurance/investment product as if it were a fully guaranteed fixed deposit would misrepresent its nature.
6. Right to privacy
Banks collect intimate financial information. Privacy requires lawful handling, access restrictions, appropriate purpose and security safeguards. Some information must nevertheless be disclosed under valid tax, AML, law-enforcement or regulatory obligations.
The right is not absolute secrecy against every lawful request.
7. Grievance redress and compensation
A bank must provide complaint channels and clear escalation arrangements. Where applicable, remedies may include correcting account entries, restoring service, refunding charges and compensating eligible loss under law/directions.
The Ombudsman mechanism is a separate external avenue after the institution's grievance process.
8. Fair lending and Key Facts Statement
A Key Facts Statement (KFS) standardises important loan terms and costs for covered products. APR expresses the annualised cost of credit under the applicable framework.
A customer should be able to understand:
- principal and net disbursement;
- repayment schedule and loan tenor;
- interest type/benchmark;
- fees and charges;
- consequences of default;
- applicable grievance mechanism.
KFS scope and precise disclosure rules must be verified for the product; it is not a universal substitute for the full legal contract.
9. Penal charges vs penal interest
RBI's fair-lending framework moved covered defaults for non-compliance with material terms toward penal charges, not additional penal interest added to the contractual rate. Penal charges should not themselves be capitalised as interest under the applicable framework.
This improves transparency. It does not mean a bank cannot recover normal contractual interest or lawful dues.
10. Responsible recovery
A missed EMI does not authorise harassment, threats, public shaming or unlawful seizure. Recovery must follow law and RBI fair-practices requirements, while the borrower still owes legitimate contractual debt.
A borrower complaint about aggressive collection is distinct from contesting the validity of the debt itself.
11. Unauthorised electronic banking transactions
An unauthorised transaction is one the customer did not authorise under the relevant banking/payment framework. Determining responsibility requires facts: Was the bank deficient? Was the customer negligent? Was there a third-party breach? When was the bank notified?
The principal RBI customer-liability framework for banks was issued in 2017, with separate related frameworks for certain other regulated entities.
12. Three broad causes and how liability differs
A. Contributory fraud/negligence/deficiency on the bank's part
Under the applicable RBI framework, the customer has zero liability in these covered cases regardless of when the customer reports.
B. Third-party breach, neither bank nor customer at fault
Time from bank communication to customer reporting is crucial. Under the 2017 framework:
- report within 3 working days: zero liability;
- report within 4–7 working days: limited liability subject to prescribed caps and transaction amount;
- report beyond 7 working days: liability according to the bank's Board-approved policy.
Working-day counting follows the regulatory rule, not necessarily calendar days.
C. Customer negligence (for example voluntarily sharing credentials)
The customer may bear loss incurred before notifying the bank. Loss after notification is borne by the bank under the direction. The bank can voluntarily waive liability, but this is not a universal automatic entitlement to refund after every scam.
13. Customer liability — summary table
| Situation | Broad regulatory treatment |
|---|---|
| Bank deficiency causes covered unauthorised transaction | Zero customer liability |
| Third-party breach reported promptly within prescribed first three working days | Zero customer liability |
| Third-party breach reported during next four working days | Limited liability under applicable cap |
| Third-party breach reported later | Bank's Board-approved policy, subject to directions |
| Customer shares credentials negligently | Customer may bear pre-report loss; bank bears post-report loss |
Important: Never apply the "three-day rule" blindly without first asking what caused the transaction and whether it was genuinely unauthorised.
14. Example 1 — unauthorised debit without customer negligence
A customer sees an unexplained electronic debit and promptly reports it through an official bank fraud channel. Investigation shows a third-party breach with neither bank nor customer at fault.
The regulatory timing framework becomes relevant. Reporting without delay is essential for possible zero/limited liability.
15. Example 2 — customer approves scammer's payment
A fraudster persuades a customer to enter a UPI PIN and approve an outgoing transfer as a supposed "refund". The customer was deceived, but the payment may have been technically authorised.
The customer should urgently report the fraud to the bank and 1930, but must not assume that RBI's unauthorised-transaction liability rule automatically guarantees reimbursement. The particular facts, product rules and findings matter.
16. Reporting and temporary credit
For covered unauthorised electronic banking transactions, RBI's 2017 framework directs banks to provide temporary/shadow credit within the prescribed 10 working days after notification, without waiting for insurance settlement, and to resolve liability within the prescribed framework.
Shadow credit ≠ admission of permanent liability or a guaranteed final refund. The bank still investigates and follows the liability rule.
17. Alerts, blocking and the customer's responsibilities
Banks should facilitate timely transaction alerts and accessible reporting channels. Customers should:
- keep registered contact details current;
- monitor transactions;
- avoid sharing passwords/OTP/PINs;
- report suspected misuse immediately;
- preserve acknowledgement/reference details;
- cooperate with legitimate investigation requests without giving secrets to unknown callers.
18. ATM cash not dispensed and other failed transactions
A failed electronic transaction is not necessarily fraud. Examples include:
- cash not dispensed but account debited;
- beneficiary not credited;
- card/POS transaction reversal delay;
- duplicate debit.
RBI's harmonised turnaround-time and compensation framework and payment-system-specific rules govern relevant failed transactions. TATs vary by payment type; keep them as updateable current data rather than assuming one deadline for all.
19. Nomination, deceased customers and service quality
Transparent deposit nomination and deceased-customer claim processes are important aspects of customer service. Detailed deposit/nomination law belongs in Module 05. The broad principle is simple: lawful claims should be handled without unnecessary obstacles or arbitrary extra conditions.
20. Data protection and consent
A customer consenting to open an account does not necessarily consent to unrelated marketing or unlimited data sharing. Privacy obligations, legitimate processing and AML record retention coexist under separate rules.
India's DPDP Rules have staged start dates; a current regulatory reference must identify which provisions are operative.
21. Consumer rights vs commercial judgment
Customers have rights to fair service and disclosures, but not an automatic right to loan approval. Lending decisions can involve creditworthiness and risk judgement. A challenge to a bank's pure commercial decision is not necessarily an admissible Ombudsman complaint; an allegation of deficient service in how the product was handled may be different.
BA-12-04 — Quick check
- Name the five RBI customer-rights principles.
- Is KFS the same as a full loan contract?
- Can a bank lawfully harass a defaulter to collect dues?
- Is every customer-induced scam payment an unauthorised transaction?
- When can customer negligence affect liability?
- Is a temporary shadow credit the same as final settlement?
Answers: (1) Fair treatment; transparency; suitability; privacy; grievance redress/compensation. (2) No. (3) No. (4) No. (5) Such as when the customer knowingly shares credentials before notifying the bank. (6) No.