Lost Money to Online Fraud? When Your Bank Must Pay — and What Changes From January 2027
Lost Money to Online Fraud? When Your Bank Must Pay — and What Changes From January 2027
RBI rules already make banks bear losses from their own failures and from third-party breaches reported quickly. New directions issued on June 24, 2026 tighten deadlines from January 1, 2027 and add one-time compensation of up to ₹25,000 even when the customer was careless.
A message says your card has been used for a ₹38,000 purchase you never made. Or you followed a “customer care” caller’s instructions, downloaded an app, and watched your balance drain. The first question is panic. The second, once the shock passes, is whether you will ever see the money again, and whether the bank has to give it back.
The answer depends on three things: whose fault the fraud was, how quickly you reported it, and the date it happened. India’s rules on this have been in place since July 2017. They are about to change. From January 1, 2027, new RBI directions shorten the bank’s deadlines, add clearer definitions of negligence, and, for the first time, offer compensation to some victims who made a mistake.
Fewer Big Frauds, Far More Small Ones
Two data sets tell the story, and they point in different directions. RBI’s 2025-26 annual report, as reported by Outlook Business, shows 10,114 bank fraud cases worth ₹48,021 crore in FY26, against 23,722 cases worth ₹32,803 crore in FY25. Those figures cover frauds of ₹1 lakh and above, and are dominated by loan frauds. The value jump also includes 314 older cases worth ₹30,199 crore reclassified after a 2023 Supreme Court judgment.
Everyday online fraud shows up more clearly in data from the Indian Cyber Crime Coordination Centre (I4C). It recorded cyber fraud losses of ₹22,849 crore from 19.19 lakh complaints in 2024 and ₹19,813 crore from 21.78 lakh complaints in 2025, as reported by IANS. Home Minister Amit Shah said in February 2026 that more than ₹8,000 crore of about ₹20,000 crore defrauded had been saved or frozen.
Three Kinds of Fault Decide Who Pays
Every unauthorised transaction is sorted into one of three buckets. The bucket decides who carries the loss. Under both the 2017 circular and the 2027 directions, the logic is the same: whoever was at fault pays, and speed of reporting matters when nobody inside the customer-bank relationship was at fault.
Bank negligence: the bank pays, always
If the fraud happened because of the bank’s failure, you have zero liability whether or not you reported it quickly. The 2027 directions spell out what counts: not implementing mandated security systems, not sending mandatory transaction alerts, not offering 24×7 fraud reporting, not acting diligently after a report, and system failures, security breaches or internal fraud.
Third-party breach: speed decides
If the fault lies with neither you nor the bank, but somewhere else in the system, your liability depends on how fast you report. The 2027 directions name third-party application providers, payment aggregators, payment gateways and telecom service providers. A SIM swap through a mobile operator’s lapse, or a payment gateway data leak, would typically fall here.
Customer negligence: you pay, until you report
If you shared your PIN, password or OTP, you bear the loss until you report it to the bank. Anything after that is the bank’s loss. The 2027 directions widen the list to include delayed reporting, downloading malicious apps, ignoring specific and clear scam warnings from the bank, and failing to update your registered mobile number or email.
The Reporting Clock: Where Zero Liability Ends
For third-party breaches, the reporting window is the single most important number. The rails below show how it works under each set of rules. Under the 2017 circular, the clock counts working days from the bank’s communication about the transaction. Under the 2027 directions, it counts calendar days.
Until December 31, 2026 (working days)
Zero
₹5k to ₹25k cap
Bank policy
From January 1, 2027 (calendar days)
Zero
Bank’s board policy
The capped band under the current rules depends on the kind of account. That is why two people defrauded on the same day, both reporting on day five, can end up with different losses.
The Supreme Court Case That Sharpened the Rule
In State Bank of India v. Pallabh Bhowmick, decided in January 2025, a customer trying to return an online purchase was called by someone posing as the retailer’s customer care. Following instructions, he downloaded an app, and unauthorised transactions of ₹94,204.80 followed. He reported the fraud to SBI within 24 hours.
SBI argued that the customer had shared his OTP and M-PIN, so the transactions were authorised. The customer said the fraud came from a data breach at the retailer, which he did not control. The Gauhati High Court held SBI liable, its Division Bench agreed, and a Supreme Court bench of Justices JB Pardiwala and R Mahadevan dismissed SBI’s appeal, as reported by LiveLaw. The court said banks should remain vigilant and have the technology to detect such fraud, while also expecting customers not to share OTPs.
What Actually Changes on January 1, 2027
RBI announced the review in its policy statement of February 6, 2026, released a draft on March 6, 2026, and issued final amendment directions on June 24, 2026. The changes apply to electronic banking transactions on or after January 1, 2027.
| Rule | Until December 31, 2026 | From January 1, 2027 | Effect on you |
|---|---|---|---|
| Zero-liability window | 3 working days | 5 calendar days | Simpler to count; can be shorter over long weekends |
| Capped liability band | ₹5,000 to ₹25,000 for 4 to 7 days | Not stated in summaries | Check the final text for late reports |
| Shadow credit | 10 working days | 5 calendar days for credit card frauds | Faster provisional credit |
| Complaint resolution | Up to 90 days | 45 days domestic, 60 days cross-border | Answers in half the time |
| Compensation for negligence | None; bank may waive | 85% of net loss, up to ₹25,000, once | Small losses partly covered |
| SMS alerts | Mandatory registration | Mandatory for all transactions above ₹500 | Faster detection |
| Negligence definitions | Broadly worded | Specific lists for bank and customer | Fewer disputes over labels |
The ₹25,000 Safety Net, Worked Out
The biggest change for ordinary customers is a compensation scheme for victims who were themselves careless, the group that today usually bears the full loss. It covers individuals, including sole proprietors, whose net loss is up to ₹50,000. The payout is 85% of the net loss or ₹25,000, whichever is lower. It can be claimed once in a lifetime, and only if the fraud is reported to the bank and to the National Cyber Crime Reporting Portal or helpline 1930 within five calendar days.
The money does not come only from your bank. Reports of the directions say RBI funds the largest share, with the customer’s bank and the bank that received the money each contributing. The split works as a share of the net loss: RBI 65%, the customer’s bank 10% and the beneficiary bank 10%, adding up to the 85% payout.
| Net loss | Your compensation | RBI share | Your bank | Beneficiary bank |
|---|---|---|---|---|
| ₹10,000 | ₹8,500 | ₹6,500 | ₹1,000 | ₹1,000 |
| ₹20,000 | ₹17,000 | ₹13,000 | ₹2,000 | ₹2,000 |
| ₹25,000 | ₹21,250 | ₹16,250 | ₹2,500 | ₹2,500 |
| ₹29,412 | ₹25,000 | ₹19,118 | ₹2,941 | ₹2,941 |
| ₹40,000 | ₹25,000 | ₹19,118 | ₹2,941 | ₹2,941 |
| ₹50,000 | ₹25,000 | ₹19,118 | ₹2,941 | ₹2,941 |
Who Pays in Eight Common Fraud Scenarios
Real cases rarely arrive with labels. This decoder shows how typical scenarios are likely to be classified under the definitions in the 2027 directions. Banks and courts will still look at the facts of each case.
| What happened | Likely category | Who bears the loss |
|---|---|---|
| Bank’s system hacked or internal staff fraud | Bank negligence | Bank, in full |
| No SMS alert was sent for the transaction | Bank negligence | Bank, in full |
| Card cloned at a skimmer, reported in 2 days | Third-party breach | Bank, if reported within the window |
| SIM swap through a telecom lapse | Third-party breach | Bank, if reported within the window |
| Payment gateway or aggregator data leak | Third-party breach | Bank, if reported within the window |
| OTP or PIN shared with a caller | Customer negligence | You, until reported; compensation may apply from 2027 |
| Malicious app installed on instructions | Customer negligence | You, until reported; compensation may apply from 2027 |
| Fraud reported weeks later | Delayed reporting | Bank’s board policy decides |
What people most often get wrong is assuming that any fraud involving an OTP is automatically their fault. The Supreme Court’s 2025 ruling shows that if the breach started elsewhere and you reported quickly, the bank can still be held liable.
Your First Five Steps After a Fraud
Speed protects your money and your legal position. These steps run in order from the first minutes to the escalation stage.
What to Put in Your Written Complaint
A phone call starts the clock, but a written complaint builds your case. Banks decide liability by looking at timestamps, and the RBI Ombudsman will look at the same record if you escalate. A short, factual note is more useful than a long account of how upset you are.
- Each disputed transaction: date, time, amount, channel and the reference number from the alert.
- When you learned of it: the time the SMS or email alert arrived, and when you first reported it.
- What you did not authorise: a clear statement that you did not make or approve the transactions.
- How it may have happened: a phishing call, a SIM failure or a data leak, without guessing beyond what you know.
- Your request: a refund under RBI’s customer liability rules and a shadow credit within the prescribed time.
- Your other reports: the 1930 or cyber crime portal acknowledgement number.
Keep screenshots of alerts, call logs and the bank’s acknowledgement. If the bank later argues that you were negligent, the 2017 circular puts the burden of proving that on the bank, and your own record of quick reporting is your best answer.
Habits That Keep You on the Right Side of the Rules
Frequently Asked Questions
Is the bank liable if money is stolen from my account through online fraud?
Yes, if the fraud resulted from the bank’s negligence or a system failure, whenever you report it. If a third party caused the breach, the bank bears the loss if you report within 3 working days under current rules, or 5 calendar days from January 1, 2027. If you shared your OTP or PIN, you bear the loss until you report it.
How many days do I have to report online banking fraud to get my money back?
Under RBI’s 2017 rules, report within 3 working days of the bank’s communication for zero liability in third-party breaches. Reporting in 4 to 7 working days caps your loss at ₹5,000 to ₹25,000 depending on the account. From January 1, 2027, the zero-liability window becomes 5 calendar days.
What if I shared my OTP with a fraudster?
Sharing an OTP is usually treated as customer negligence, so you bear the loss until you report it, and the bank bears any loss after that. From January 1, 2027, you may claim one-time compensation of 85% of net loss, up to ₹25,000, for losses up to ₹50,000, if you report within five calendar days.
What is RBI’s new ₹25,000 compensation scheme for fraud victims?
Under directions issued on June 24, 2026, individuals who lose up to ₹50,000 to fraud involving their own negligence can claim 85% of the net loss or ₹25,000, whichever is lower. It is available once in a lifetime, for frauds in the first year from January 1, 2027, and requires reporting to the bank and the cyber crime portal or 1930 within five calendar days.
How long does a bank take to refund money lost in fraud?
Under current rules, the bank must give a shadow credit within 10 working days of your report and resolve the complaint within 90 days. From January 1, 2027, complaints must be resolved within 45 days for domestic cases and 60 days for cross-border cases, and credit card shadow reversals are due within 5 calendar days.
Who has to prove that the customer was negligent?
RBI’s 2017 circular states that the burden of proving customer liability lies on the bank. The bank cannot simply assert that you were careless; it must establish it. Reports on the 2027 directions differ on how clearly this is restated, so check the final RBI text.
What did the Supreme Court say about bank liability for online fraud?
In State Bank of India v. Pallabh Bhowmick, decided in January 2025, the Supreme Court dismissed SBI’s appeal and upheld a refund of ₹94,204.80 to a customer who reported a fraud within 24 hours. It relied on RBI’s 2017 zero-liability rules for third-party breaches and said banks must remain vigilant.
Where should I complain if my bank refuses to refund a fraud loss?
Complain in writing to the bank first and keep the complaint number. If it rejects your claim, does not respond, or misses the resolution deadline, file with the RBI Integrated Ombudsman at cms.rbi.org.in. Also report the fraud on the National Cyber Crime Reporting Portal or by calling 1930.
The Short Version
Your bank must cover online fraud losses caused by its own failures, whenever you report them. For breaches caused by others, reporting fast is everything: within 3 working days today, and 5 calendar days from January 1, 2027, for zero liability. If you shared an OTP or installed a fake app, you carry the loss until you report it. RBI’s new directions add a one-time safety net of 85% of net loss, up to ₹25,000, for losses up to ₹50,000 in 2027. Block first, call 1930, report to the bank in writing, and escalate to the RBI Ombudsman if needed.
