---
title: "Banks: your rights and how to complain | dpdpr.in"
description: "Fraud, unauthorised transactions, data misuse and how to reach the RBI Ombudsman. Plain steps, helplines and templates."
url: "https://dpdpr.in/rights/banks/"
canonical: "https://dpdpr.in/rights/banks/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Banks: your rights and how to complain

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

## What data they hold

- KYC documents, PAN and Aadhaar details.
- Account, card and loan records and every transaction.
- Phone, email, address and nominee details.
- Credit information shared with credit bureaus.

## Your rights under current law

- RBI's rules on unauthorised electronic transactions: if the fault lies with the bank, you have zero liability. If the fault lies elsewhere and you tell the bank within 3 working days of its alert, you have zero liability. From 4 to 7 working days your liability is capped. The bank must credit the money (shadow reversal) within 10 working days of your report and settle the complaint within 90 days.
- Banks must give 24x7 ways to report fraud, including replying to the SMS alert, and must send you a complaint number.
- The RBI Integrated Ombudsman Scheme, 2026 gives a free complaint route after you complain to the bank.
- RBI's failed transaction rules set auto reversal times and pay Rs 100 per day of delay.

## Your DPDP rights once in force

Sections 11 to 14 of the DPDP Act (your rights) and the duties of companies in sections 4 to 10 start on **13 May 2027** (G.S.R. 843(E)). Until then, use the sector rules on this page. After that date you can use both.

Your bank will be a Data Fiduciary. From 13 May 2027 you can ask what it holds and who it shared it with. Some sharing is required by law, and banking laws on record keeping still apply, so erasure may be refused where the law needs the bank to keep records.

- Access: a summary of your data and who it was shared with ([section 11](https://dpdpr.in/act/section-11/)).
- Correction, completion, updating and erasure ([section 12](https://dpdpr.in/act/section-12/)).
- Grievance redressal by the company, before going to the Board ([section 13](https://dpdpr.in/act/section-13/)).
- Nominate someone to act after your death or incapacity ([section 14](https://dpdpr.in/act/section-14/)).
- Withdraw consent, as easily as you gave it ([section 6(4)](https://dpdpr.in/act/section-6/)).

## Common problems

- Money taken by fraud after a fake call or link.
- Debit or credit card used without your knowledge.
- Your details leaked to fraudsters who call you.
- Wrong information sent to a credit bureau.
- Marketing calls from the bank's partners.

## Evidence to keep

- SMS and email alerts for each transaction.
- Bank statement pages marked with the disputed entries.
- Your complaint number from the bank and the time you reported.
- 1930 acknowledgement and cybercrime.gov.in complaint ID.
- Screenshots of calls and messages from the fraudster.

See the full [evidence checklist](https://dpdpr.in/rights/evidence-checklist/).

## How to approach, step by step

Go in this order. Start with the company. Move to the next step only when the time limit has passed or the reply is not good enough. If money was lost or you were threatened, go to 1930 or the police first.

### Report money lost to fraud: call 1930

1930 is the national cyber crime helpline run with the Ministry of Home Affairs. It links your report to banks and wallets so they can try to stop the money. Call as fast as you can. The sooner the report reaches the bank, the better the chance.

**Keep this ready before you start:**

- Your mobile number.
- Name of the bank, wallet or app the money left from.
- Account number, wallet ID or UPI ID that was debited.
- Transaction ID or 12 digit UTR number for each payment.
- Date and amount of each payment.
- Card number, if a debit or credit card was used.
- Screenshots of the payment and of the chat or SMS.

1. Dial **1930** from any phone.
2. Tell them you want to report a financial cyber fraud.
3. Give each transaction one by one: bank, transaction ID or UTR, date and amount.
4. Write down the acknowledgement number they give you. It also comes by SMS.
5. Save that SMS. Take a screenshot of it.
6. Now file the full complaint on [cybercrime.gov.in](https://cybercrime.gov.in) (steps below). The official cybercrime.gov.in instructions ask you to complete it within 24 hours of the call.
7. Call your bank's official customer care number too, and ask them to block the card, UPI or account. Use the number on your card or passbook.

Checked on 1 November 2026 against: [I4C (Ministry of Home Affairs): National Cybercrime Reporting Portal and 1930](https://i4c.mha.gov.in/ncrp.aspx), [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx).

### Complain to the bank first, then the RBI Ombudsman

From 1 July 2026 the Reserve Bank Integrated Ombudsman Scheme, 2026 applies. It is free. It covers banks, many NBFCs, non bank wallets and prepaid cards, and credit information companies. You must complain to the bank or company first.

**Keep this ready before you start:**

- Your name, mobile number, email and full postal address.
- Name of the bank or company, and the branch if relevant.
- The complaint number and date of your complaint to the bank, and a copy of it.
- Account, card, loan or transaction details.
- Transaction date and reference number.
- The bank's reply, if any.
- A short account of what happened, your loss, and what you want (refund, correction, compensation).
- Supporting documents.

1. Complain to the bank in writing. Use its official app, website complaint form, email, or a letter at the branch.
2. Get a complaint number or written acknowledgement. Save it with the date.
3. Wait 30 days (or longer if RBI, NPCI or card network rules give a longer time for your type of issue).
4. If there is no reply in that time, or you are not happy with the reply, you can go to the RBI Ombudsman.
5. Do it within **90 days** from the end of that waiting time, or from the bank's last reply, whichever is later. Under the 2021 scheme this was one year; under the 2026 scheme it is 90 days.
6. Open [cms.rbi.org.in](https://cms.rbi.org.in). The portal shows a security check first.
7. Choose to file a new complaint. Fill the details asked: your details, the bank, your earlier complaint number, the transaction and what you want. We have not described each screen because we could not open the portal to check it; follow the labels shown.
8. Upload your complaint to the bank, the bank's reply and your evidence.
9. Submit. Write down the complaint number shown. Save it with your mobile number. You need both to track.
10. To track or withdraw, go to the **Track a complaint** tab on cms.rbi.org.in.
11. Other ways to file: email to crpc@rbi.org.in, or post a signed complaint form to Centralised Receipt and Processing Centre, Reserve Bank of India, Central Vista, Sector 17, Chandigarh 160017.
12. For help, call the RBI Contact Centre on **14448**. The voice menu works 24x7. Staff answer 8 AM to 10 PM, Monday to Saturday, in English, Hindi and ten regional languages. You cannot file a complaint by phone.
13. If the Ombudsman passes an Award in your favour, send the bank a letter accepting it within 30 days. The bank must then comply.
14. If you disagree with an Award, you can appeal to the Appellate Authority within 30 days of receiving it.

Checked on 1 November 2026 against: [RBI: Reserve Bank Integrated Ombudsman Scheme, 2026 (FAQs)](https://www.rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id=3407), [RBI: text of the Integrated Ombudsman Scheme, 2026](https://rbidocs.rbi.org.in/rdocs/content/pdfs/SCHEME16012026_A.pdf), [RBI Complaint Management System (CMS)](https://cms.rbi.org.in/).

### File a complaint on cybercrime.gov.in

The National Cyber Crime Reporting Portal takes complaints about online fraud, hacking, fake profiles, harassment and more. Your complaint goes to the police of your State or Union Territory. The screen names below come from the portal's FAQ and the Ministry of Home Affairs citizen manual. The portal can change. If a screen looks different, follow the words on the screen.

**Keep this ready before you start:**

- Date and time of the incident.
- Incident details in your own words. The portal checklist asks for at least 200 characters and no special characters such as # $ @ ^ \* \` ~ | !
- A photo or scan of a national ID (Voter ID, Driving Licence, Passport, PAN or Aadhaar) in .jpg, .jpeg or .png, not more than 5 MB.
- For money fraud: bank or wallet name, 12 digit transaction ID or UTR, date and amount.
- Evidence files such as screenshots, not more than 10 MB each.
- If known: the other person's mobile number, email, bank account, website link or social media handle.

1. Open [cybercrime.gov.in](https://cybercrime.gov.in) in a browser.
2. Click **File a complaint**.
3. Read the message. Tick **I Accept**.
4. Click **Report Other Cyber Crime**. (For sexual content involving women or children, use the women and child section instead.)
5. Type your name in **User Name**. Type your mobile number.
6. Click **Get OTP**. Type the OTP you receive. It is valid for 30 minutes.
7. Fill the security answer. Click **Submit**.
8. In **Incident details**, choose the **Category of complaint**. For money loss choose Online Financial Fraud. For fake profiles or harassment choose Online and Social Media Related Crime.
9. Choose the **Sub-Category** that fits best.
10. Enter the approximate date and time. If you are late, fill **Reason for delay in reporting**.
11. Choose **Where did the incident occur?** (for example a phone call, SMS, WhatsApp, a website or an app).
12. Upload your evidence files.
13. Write what happened in the details box. Say who contacted you, from which number, what they said, what you shared or paid, and when.
14. Click **Save and Next**.
15. Add suspect details if you have them: name, mobile number, bank account, UPI ID or website. Click **Save & Next**.
16. Fill your own details and address. Choose your State, District and Police Station.
17. Upload your ID proof. Click **Save & Preview**.
18. Check everything. Tick **I Agree**. Click **Confirm & Submit**.
19. Write down the **Complaint ID** shown on screen. You also get it by SMS and email. It is a complaint number, not an FIR number.
20. Click **Download PDF** and save the file in a safe folder.
21. To check progress later, log in the same way and click **Check Status**.
22. If you get no action, or are not happy with what the police did, contact the cyber crime grievance officer of your State or Union Territory listed on the portal. You can also visit your local police station with the PDF and ask for an FIR.

Checked on 1 November 2026 against: [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx), [National Cyber Crime Reporting Portal: checklist before filing](https://www.cybercrime.gov.in/Webform/Crime_AuthoLogin.aspx), [I4C (Ministry of Home Affairs): National Cybercrime Reporting Portal and 1930](https://i4c.mha.gov.in/ncrp.aspx).

### Use your DPDP rights (from 13 May 2027)

The rights in sections 11 to 14 of the DPDP Act, and the duties of companies that go with them, start on 13 May 2027 (G.S.R. 843(E)). Until then you can still write to a company and ask. Many will answer. But they are not yet bound by these sections.

**Keep this ready before you start:**

- The company's published method for rights requests. Rule 14 says companies must show it on their website or app.
- The identifier they ask for, such as your username, customer ID or registered mobile number.

1. Find the company's rights or grievance page, or its Data Protection Officer contact.
2. Send a written request using the method they publish. Use our [request letter template](https://dpdpr.in/rights/rights-request-letter/).
3. Ask for what you need: a summary of your data and how it is used, and the names of everyone it was shared with (section 11); correction, completion, updating or erasure (section 12); or a fix for a grievance (section 13). You can also nominate someone to act for you after death or incapacity (section 14), and withdraw consent (section 6(4)).
4. Save the acknowledgement or ticket number.
5. Wait for the time they publish. Rule 14(3) says it cannot be more than 90 days.
6. If they refuse or do not answer, you can complain to the Data Protection Board of India. You must use the company's grievance route first (section 13(3)).
7. The Board works as a digital office. Use the method it publishes on its website and app (rule 19). We will add the link when the Board publishes it.

Checked on 1 November 2026 against: [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf), [Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf), [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf).

## Ready-to-use complaint

Copy, fill the brackets, and send it through the company's official channel. Keep a copy.

To: Branch Manager / Principal Nodal Officer, \[bank\] Subject: Unauthorised transaction on account \[last 4 digits\]: request for reversal under RBI rules On \[date and time\] Rs \[amount\] was debited by \[UPI/card/net banking\], reference \[UTR\]. I did not authorise it. I reported it to you on \[date and time\] through \[channel\], complaint number \[number\], and to 1930 (acknowledgement \[number\]). Under RBI's instructions on limiting customer liability, please credit the amount within 10 working days and settle my complaint. Please also tell me how my details reached the fraudster. \[Name\], \[mobile\], \[date\]

## Time limits

- Report an unauthorised transaction within 3 working days of the bank's alert for zero liability (where the fault is not yours or the bank's).
- Shadow reversal: within 10 working days of your report.
- Bank must resolve within 90 days.
- RBI Ombudsman: after 30 days with no reply or a bad reply, and within 90 days after that.

## If this happened to you

- [\*\*A caller from a personal number knew all my bank details: genuine bank staff or fraud?\*\*Someone said they were from your bank or its agent, called from a personal mobile, and knew your details.](https://dpdpr.in/rights/scenarios/bank-impersonation-call/)
- [\*\*I got a KYC update message or call: is it really my bank?\*\*A message or call says your KYC is pending and your account will be blocked.](https://dpdpr.in/rights/scenarios/fake-kyc-sms/)
- [\*\*A customer care number turned out fake, or a real agent misused my data\*\*A helpline number you found online led to a scammer, or a real support agent misused your details.](https://dpdpr.in/rights/scenarios/fake-customer-care/)
- [\*\*My credit report shows a loan I never took\*\*A loan or card you never applied for appears on your credit report.](https://dpdpr.in/rights/scenarios/loan-i-never-took/)
- [\*\*A loan app or recovery agent is calling my relatives and friends\*\*A recovery agent calls your family, friends or contacts, or threatens you.](https://dpdpr.in/rights/scenarios/loan-app-threats/)
- [\*\*My SIM suddenly stopped working\*\*Your SIM lost network without warning, possibly because someone got a duplicate SIM.](https://dpdpr.in/rights/scenarios/sim-stopped-working/)
- [\*\*A bank employee told someone I know about my balance, loans or statement\*\*Someone in your circle knew your bank balance, loan or account statement, and it seems to have come from bank staff.](https://dpdpr.in/rights/scenarios/bank-staff-told-others/)
- [\*\*My bank shared my account details or statement with my employer\*\*Your salary bank or loan bank gave your employer details or a statement you did not authorise.](https://dpdpr.in/rights/scenarios/bank-shared-with-employer/)
- [\*\*A scammer knew my branch and that my KYC was pending, so the leak must be from the bank\*\*A fraud call or SMS quoted your branch, your account type or a pending KYC update.](https://dpdpr.in/rights/scenarios/scammer-knew-kyc-pending/)
- [\*\*A credit card telecaller on a personal mobile knew my PAN, employer and even my other bank\*\*A sales caller pushing a card or loan quoted your PAN, employer and accounts at another bank.](https://dpdpr.in/rights/scenarios/card-telecaller-knew-pan/)
- [\*\*A loan or card agent admitted my details came from a bank branch\*\*An agent told you openly that a branch employee gave them your details.](https://dpdpr.in/rights/scenarios/dsa-said-data-from-branch/)
- [\*\*Right after I got a new card, a caller knew the card number and my PAN\*\*Within days of a new card arriving, a caller quoted its digits and your PAN.](https://dpdpr.in/rights/scenarios/caller-knew-new-card/)
- [\*\*A reward points or limit upgrade call used my real card limit and address\*\*A caller offering to redeem points or raise your limit knew your real limit and address, and asked for an OTP.](https://dpdpr.in/rights/scenarios/reward-points-call/)
- [\*\*A credit card was issued and activated in my name without my consent\*\*A card you never asked for arrived, was activated, or appeared on your credit report.](https://dpdpr.in/rights/scenarios/credit-card-issued-without-consent/)
- [\*\*My own bank's loan or card sales team calls me every day\*\*Your bank keeps calling to sell loans or cards, even after you said no.](https://dpdpr.in/rights/scenarios/bank-loan-team-calls-daily/)
- [\*\*My bank says its customer data was found on the dark web\*\*Your bank or a news report says customer data from your bank was leaked.](https://dpdpr.in/rights/scenarios/bank-data-on-dark-web/)
- [\*\*My new number gets the previous owner's bank OTPs and recovery calls, or my old number was given away\*\*Mobile numbers are recycled. You now get someone else's OTPs and loan calls, or your own unused number went to a stranger.](https://dpdpr.in/rights/scenarios/new-number-previous-owner/)
- [\*\*Someone got a duplicate of my SIM and emptied my bank account\*\*Your phone lost signal, and soon after money left your account using OTPs sent to your number.](https://dpdpr.in/rights/scenarios/sim-swap-emptied-account/)

## Official sources

- [RBI: limiting liability of customers in unauthorised electronic banking transactions (6 July 2017)](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11040)
- [RBI: Reserve Bank Integrated Ombudsman Scheme, 2026 (FAQs)](https://www.rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id=3407)
- [RBI: turn around time and compensation for failed transactions (20 September 2019)](https://rbi.org.in/Scripts/NotificationUser.aspx?Id=11693&Mode=0)
- [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf)
- [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf)