Lost money to cyber fraud? RBI's new rules offer compensation of up to ₹25,000

From 1 January 2027, customers who lose money in digital banking frauds will receive stronger protection under a revised Reserve Bank of India (RBI) framework. The updated rules move the onus of proving negligence onto banks, introduce compensation for lower-value cyber frauds, and tighten timelines for resolving complaints.

Under the new norms, individual customers, including sole proprietors, who lose up to ₹50,000 in fraudulent electronic banking transactions can receive 85% of their net loss as compensation, capped at ₹25,000. This benefit can be used only once in a customer’s lifetime.

RBI has strengthened customer protection standards for digital fraud by requiring banks to demonstrate that a customer was negligent in disputed electronic transactions. It has also created a formal compensation mechanism for victims of small-ticket cyber frauds.

These changes have been made through amendments to the RBI’s Responsible Business Conduct Directions and will apply to electronic transactions carried out on or after 1 January 2027. The framework covers internet and mobile banking, card usage, and other electronic banking channels.

The overhaul comes against the backdrop of a sharp increase in digital payment fraud and builds on RBI’s earlier rules governing customer liability in unauthorised transactions.

A key shift is in the burden of proof: banks must now establish customer liability in cases involving fraudulent electronic banking transactions. RBI has broadened what counts as bank negligence to include failure to maintain required security systems, not sending transaction alerts, not offering 24x7 reporting channels, delays in handling complaints, security breaches, system breakdowns, and internal fraud.

If a fraudulent transaction occurs due to a bank’s negligence, the customer will have zero liability, irrespective of whether they reported the transaction or not.

Likewise, customers will not be liable for losses arising from third-party breaches—such as failures at payment gateways, telecom operators, or payment aggregators—provided the unauthorised transaction is reported within five calendar days of its occurrence.

For the first time, RBI has set up a safety net for small-value fraud losses. Individual customers, including sole proprietors, who lose up to ₹50,000 in fraudulent electronic banking transactions will be eligible for 85% reimbursement of the net loss, subject to a maximum of ₹25,000. This facility is available only once in a customer’s lifetime.

This compensation applies in situations where the fraud is determined to have occurred because of customer negligence. Previously, such losses were largely borne entirely by customers.

RBI will fund the major portion of this compensation. In domestic fraud cases, the customer’s bank will contribute 65% of the compensation amount, with the customer’s bank and the beneficiary bank sharing the remaining part.

Access to this compensation is conditional on prompt reporting. Customers must notify both their bank and either the National Cyber Crime Reporting Portal or the Cyber Crime Helpline (1930) within five calendar days of the fraud. The bank must also be satisfied, through its internal assessment, that the claim is genuine.

RBI has repeatedly highlighted that delayed reporting increases the likelihood of permanent loss and reduces recovery prospects. Banks have been instructed to actively educate customers on the need for immediate reporting of suspicious or fraudulent activity.

The revised framework also places new operational responsibilities on banks to strengthen fraud detection and customer support. Banks must provide 24x7 channels for reporting fraud, including phone banking, SMS, dedicated email IDs, IVR, toll-free numbers, and in-branch reporting options. They must also offer direct fraud-reporting links on their websites and mobile apps.

Every fraud-related complaint must be recorded immediately and acknowledged with a unique complaint number and timestamp.

RBI has mandated instant SMS alerts for all electronic banking transactions above ₹500 and email alerts for all transactions where an email ID is registered. Banks are barred from levying charges for these regulatory SMS alerts.

On complaint resolution, RBI has set stricter deadlines. Banks must determine liability and close complaints related to domestic fraudulent transactions within 45 calendar days, and within 60 calendar days for cross-border fraud cases.

Where a customer is eligible for a reversal, banks must ensure the reversal is value-dated to the original transaction date so that the customer does not lose interest or incur extra charges.

In the case of fraudulent credit card transactions, banks must provide a shadow reversal of the disputed amount within five calendar days of receiving the complaint, ensuring that customers do not pay additional interest while the investigation is underway.

Overall, this framework represents one of RBI’s most extensive updates to digital fraud protection in recent years, increasing accountability for banks and creating a defined financial safety net for customers affected by cyber fraud.

‍