Zero liability of a customer
Type of fraud: If the fraud happens due to the bank's negligence , the customer obviously is not liable. For instance, if there is a glitch at the backend of the bank where customer details are compromised or if bank staff disclose these details to third parties, then you will not be liable to pay. The RBI's July 2017 notification states that if a 'third-party' breach happens when neither the bank nor the customer is at fault, and the customer informs the bank within three working days, here, too, the customer is not liable to pay.
A third-party breach can happen at an ATM (skimming, card trapping etc.), by using public Wi-Fi, malware in ATMs or bank servers, at merchant outlets where you swipe your credit or debit card, or even on your own computer (using ways like pharming and so on).
What you should do: To protect yourself and your money, the first step is make sure you apply for the SMS and email alerts service of your bank. The second step would be to intimate the bank as soon as you get the alert that money has been debited from your account. Do it within three days. If you do not, then depending on how long you take, your liability increases.
Limited liability of a customer
Type of fraud: If the fraud or wrongful debit has happened because of your negligence you will have to bear the brunt. This could happen if you mentioned your PIN number or password in passing or left it lying around and someone used it without your knowledge.
What you should do: The good news is that even though this transaction has happened due to your negligence, if you report it to the bank before seven working days (and after three days) from receiving the debit message, the RBI notification says that the per transaction liability of the customer will be limited to the transaction value or an amount set by the central bank, whichever is lower. And if you take more than seven days, "the customer liability shall be determined as per the bank's Board approved policy," says the RBI notification.
How long will it take for the reversal?
Banks have to credit or reverse the unauthorised electronic transaction to the customer's account within 10 working days from the date of notification by the customer. And once reported, in case of debit card or bank account fraud, the bank should ensure that the customer does not suffer loss of interest. If the transaction has happened on a credit card, the customer should not have to additional burden of interest.
Also, once reported, banks have to resolve the case within 90 days from the date of receipt of the complaint.