In a case of third-party breach, within how many working days must a customer report an unauthorised electronic banking transaction to have zero liability?

The correct answer is A, rupees 5,000. The Reserve Bank's liability table sets the lowest ceiling for Basic Savings Bank Deposit accounts, which are the no-frills accounts opened for financial inclusion, because their holders are the least able to absorb a loss. The customer pays the transaction value or five thousand rupees, whichever is lower, so a fraud of two thousand rupees costs the customer two thousand, not five.

Option B, rupees 10,000, is the ceiling for ordinary savings accounts, prepaid payment instruments and gift cards, current or overdraft accounts of micro and small enterprises, individual current accounts with a limit up to twenty five lakh rupees, and credit cards with a limit up to five lakh rupees. Option C, rupees 25,000, is the ceiling for other current, cash credit and overdraft accounts and for credit cards with a limit above five lakh rupees. Option D is wrong because zero liability needs a report within three working days.

The correct answer is C, ten working days. A shadow reversal is a provisional credit of the disputed amount into the customer's account. The circular requires the bank to make it within ten working days of the customer's notification, and specifically says the bank may not wait for any insurance claim of its own to be settled first. The idea is that the customer should not be out of pocket while the investigation runs.

Option A, three working days, is the reporting window for zero liability, not a bank deadline. Option B, seven working days, is the end of the limited liability window for the customer. Option D, thirty working days, is close to the thirty day period after which an unresolved complaint can be taken to the Reserve Bank's ombudsman, but it is not the shadow reversal deadline. Keep three timelines apart: three days and seven days for the customer, ten working days for the shadow reversal and ninety days for final resolution.

The correct answer is C, 90 days from the complaint. The circular requires every bank to have a board-approved policy fixing its own resolution period, and caps that period at ninety days from the date the complaint is received. If the bank cannot complete the exercise within ninety days, it must still compensate the customer as the circular prescribes, so delay does not work in the bank's favour.

Option A, 30 days, is the period after which a complaint not resolved by the bank can be taken to the Reserve Bank's ombudsman, which is a different deadline and a common source of confusion. Option B, 60 days, does not appear in this framework. Option D, 180 days, is far longer than the rule allows. Pairing helps: ten working days for the provisional credit, ninety days for the final decision, and thirty days of bank inaction before the ombudsman can be approached.

The correct answer is B, on the bank. The circular places the burden of proof squarely on the bank: if a bank says the customer is liable, it must establish that, rather than asking the customer to prove innocence. This matters because the bank holds the logs, the device records and the transaction trail, while the customer holds almost nothing, so putting the burden on the customer would make the protection meaningless.

Option A is the intuitive but wrong answer, and banks sometimes behave as though it were true, which is why the question is set. Option C is wrong because the police investigate the criminal offence; liability between the bank and its customer is a civil matter settled under the Reserve Bank's rules. Option D is wrong because a payment system operator such as a card network or the retail payments organisation is not a party to the customer's account relationship for this purpose.

The correct answer is C, the customer bears the loss till reporting and the bank bears the loss after reporting. Sharing a PIN, password or one-time password is treated as customer negligence, and in that case the circular makes the customer bear the whole loss up to the time the fraud is reported. The moment the report is made, the bank is on the hook for every further rupee, because it is then the bank's job to block the account and the instrument.

Option A is wrong because a customer who hands over a credential cannot pass the whole loss to the bank. Option B is the harsher reading that many candidates choose, but it ignores the second half of the rule and is the main trap in this question. Option D is wrong because the framework never prescribes an automatic equal split; liability depends on who was at fault and on how quickly the report came. The practical lesson is to report at once even when the mistake was one's own.