State Bank of India (SBI) reported finding 3,897 customer records on the dark web or simply fraudsters hacked and got hold of their KYC and bank details. If you fear being one of the victims, or you notice any debit of money from your bank account, then you can take few actions on your own, although, be assured SBI has swung into full action to protect customer interest. What actions does a bank take after cybercriminals hack a customer’s account? When cybercriminals hack an account or steal money through illegal digital transactions, banks do not automatically credit the money back. The Reserve Bank of India’s (RBI) recovery mechanism requires the customer to take immediate action by reporting the unauthorized transfer to the bank. What do RBI rules say? Under RBI rules on limiting customer liability in unauthorized electronic banking transactions, the speed at which a customer reports the fraud determines who bears the financial loss. Banks deliver instant transaction notifications via SMS and email. Once an unauthorized debit occurs, the customer must immediately inform the bank through registered communication channels. RBI zero liability guidelines and customer reporting timelines The RBI established clear guidelines regarding customer protection against electronic fraud. The framework divides financial responsibility into three distinct reporting windows based on customer speed and negligence. If the unauthorized electronic transaction occurs due to a system breach at the bank’s end or due to a third-party breach where neither the bank nor the customer is at fault (like in the case of SBI’s recent customer data leak on dark web), the customer gets a full refund. To qualify for zero liability, the account holder must report the transaction to the bank within three working days of receiving the debit alert. What if you file a complaint after 7 days? If the customer delays reporting and informs the bank between four to seven working days after the transaction, the customer faces capped limited liability. If the report is filed after seven working days, customer liability is determined entirely by the bank’s individual board-approved policy. Investigation timelines Once a customer logs an unauthorized transaction complaint within three working days, the RBI mandates that the bank must issue a provisional credit, also known as shadow credit. The bank must deposit the full disputed amount back into the customer’s account within 10 working days from the date of the complaint. The customer does not have to wait for the final police or forensic investigation to finish before receiving this temporary credit. The bank must resolve the dispute and arrive at a final settlement within 90 days from the date of receiving the complaint. The burden of proving customer negligence rests entirely on the bank, not the customer. Difference between DICGC ₹5 lakh deposit insurance and cyber fraud recovery rules Many bank customers confuse deposit insurance with protection against individual cyber hacking. These two safety mechanisms operate under completely different rules and laws in India. The Deposit Insurance and Credit Guarantee Corporation (DICGC) is a wholly owned subsidiary of the RBI governed by the DICGC Act. Under this law, every depositor in an insured bank is covered up to a maximum of ₹5 lakh for both principal and interest amounts. However, DICGC insurance triggers only when a bank fails, loses its banking license, or goes into official liquidation. It does not cover individual money loss caused by online phishing, dark web data breaches, card cloning, or stolen net banking passwords. Individual cyber fraud losses are handled exclusively under RBI electronic banking customer liability rules. Action plan if your bank account details are exposed or hacked If your personal information appears in a dark web leak or if you spot suspicious account activity, follow this immediate emergency protocol: First, call the Ministry of Home Affairs national cyber crime helpline at 1930 immediately. Reporting within the first one to two hours, known as the golden hour, allows cyber police to track and freeze the stolen funds before fraudsters transfer them out of the destination bank or digital wallet. Second, notify your bank immediately using their toll-free helpline, official mobile app, or short SMS service to block your debit cards, credit cards, UPI services, and net banking access. Third, lodge an official complaint on the central government portal at cybercrime.gov.in. Retain a digital copy of the transaction acknowledgment and the Cyber Crime Incident Report. Fourth, visit your bank’s home branch and submit a written dispute letter along with the cyber crime complaint copy. Ensure you obtain a stamped written acknowledgment receipt displaying the exact date and time of submission to protect your zero-liability rights under RBI guidelines. SBI confirms hackers steal information of 3,897 bank a/c holders On Wednesday, the SBI filed an official regulatory disclosure with the BSE and National Stock Exchange of India (NSE) under SEBI guidelines. The bank informed the market that it experienced an incident involving the loss of certain customer data. SBI received alerts on October 16, 2026, from CERT-In, the Defence Cyber Agency, and its Threat Intelligence Service Provider. These alerts pointed to a suspected leak of customer records on the dark web. 3,897 customer records identified with personal information After receiving the alert, SBI carried out a preliminary check of around 375,000 records available on the dark web. The bank identified 3,897 customer records containing Personally Identifiable Information (PII). The exposed details included customer names, registered mobile numbers, dates of birth, gender, email addresses, and home addresses. Identifiers like branch codes, Customer Information File (CIF) numbers, lead IDs, and loan metadata files were also exposed. What is dark web? The dark web is a hidden part of the internet that standard search engines like Google cannot find and regular web browsers like Chrome or Safari cannot open. To understand the dark web, it helps to see the internet in three main layers: Key features of the Dark Web Requires Special Browsers: Regular internet browsers cannot load dark web addresses. Users need specialized software (such as the Tor browser) that encrypts and routes internet traffic through multiple points across the world. Complete Anonymity: The dark web hides the location, identity, and IP address of both the person visiting the site and the person running it. Encrypted Web Addresses: Dark web links do not end with standard domain extensions like .com, .in, or .org. Instead, they use complex, randomly generated strings of characters ending in .onion. Post navigation ‘News channels must not show anti-national content’ says govt:Avoid inflammatory debates and use AI properly; 10-point advisory released
