Unauthorised debits, and why you should not pay an EMI to a recovery agent

Quick answer

If an electronic payment went out that you did not authorise, tell your bank immediately through the channel it gives you for fraud or unauthorised transactions (app, phone banking, SMS reply to the alert, email or branch). RBI’s circular RBI/2017-18/15 dated 6 July 2017 (“Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions”) sets how liability is shared. Faster reporting generally means stronger protection, but some situations (for example sharing an OTP) are treated as customer negligence.

A loan EMI should be paid only into the lender’s official account or payment link named in a written communication from the lender. A recovery agent’s personal UPI ID, wallet or account is not a safe substitute.

What does RBI’s 2017 customer-liability circular say?

The circular applies to scheduled commercial banks, small finance banks and payments banks (co-operative banks have a parallel circular). In brief, and without turning every case into a slogan:

• Zero liability can apply where the unauthorised transaction is due to the bank’s fraud, negligence or deficiency (whether or not you reported it), or where a third-party breach occurred (neither you nor the bank at fault) and you notify the bank within three working days of receiving the bank’s communication about the transaction.
• If you shared payment credentials (PIN, OTP, password and similar), the circular says you bear the loss until you report; the bank bears loss after the report.
• Third-party breach reported after four to seven working days of the bank’s communication: your per-transaction liability is capped at the lower of the transaction value or the amount in the circular’s table (₹5,000, ₹10,000 or ₹25,000 depending on the type of account).
• Delay beyond seven working days: liability follows the bank’s board-approved policy.
• After you notify the bank, it should give a shadow reversal (credit) within 10 working days, value-dated to the transaction date, without waiting for an insurance claim.

Read the circular for the exact wording that applies to your account type. These are conditions, not a promise that every dispute ends in a full refund.

What should you do on the same day?

• Reply to the SMS or email alert if the bank allows it, or use the unauthorised-transaction link on the bank’s website or app. Note the complaint or reference number.
• Keep the transaction ID, amount, date, merchant or UPI name and screenshots.
• Ask the bank to block further pulls if a card, UPI ID or mandate was misused.
• If the debit looks like online fraud, extortion or a fake collection link, you can also report at cybercrime.gov.in or call 1930 (and complete the portal complaint as the portal instructs).
• Write to the lender if the debit was labelled as your loan EMI so its records stay consistent.

Why is paying an EMI to a recovery agent risky?

Agents sometimes ask for an immediate transfer “to stop the visit” or “to lock a settlement”. Money sent to a personal UPI ID may not be credited to your loan. You can be asked to pay again. RBI recovery-agent rules also require professional conduct; a demand to pay into a private account should be treated as a warning sign.

Pay only using the account number, payment gateway or official link in a letter or email from the lender. Get a receipt from the lender, not only from the agent. For settlements, wait for a written offer — see the settlement letter checklist.