RBI Digital Fraud Rules From January 1, 2027 — How Much Compensation Can You Claim, and What Must You Do Within 5 Days?
RBI Digital Fraud Rules From January 1, 2027 — How Much Compensation Can You Claim, and What Must You Do Within 5 Days?
The RBI’s revised framework for fraudulent electronic banking transactions adds a one-time compensation of 85% of net loss, capped at ₹25,000, for losses up to ₹50,000, alongside zero-liability rules, a 5-day reporting window and a 45-day resolution limit.
A message that looks like your bank, a call from someone claiming to be from customer care, an app you were told to install to “verify KYC”. Ten minutes later ₹30,000 has left your account. Until now, the first question your bank asked was whether you had shared an OTP, and if you had, the conversation often ended there. From January 1, 2027, the answer to that question still matters, but it no longer closes the door completely.
The Reserve Bank of India issued seven amendment directions on June 24, 2026 that rewrite how banks handle fraudulent electronic banking transactions. They widen what counts as fraud, shorten the time banks have to respond, put the burden of proving customer fault on the bank, and add a funded compensation scheme for small losses. This explainer sets out what you can claim, who pays, and the five-day clock that decides most outcomes.
Why the RBI Rewrote the Rules
The previous framework dates to July 6, 2017. It protected customers against “unauthorised” transactions, gave them 3 days to report for zero liability, and allowed banks up to 90 days to resolve complaints. It was built for card skimming and hacked accounts, not for the scams that now dominate, where fraudsters persuade victims to approve payments themselves. Those victims often fell outside the old definition entirely.
The new directions apply to commercial banks, small finance banks, payments banks, local area banks, regional rural banks, urban co-operative banks and rural co-operative banks, according to CorpLaw Updates. They were originally due on July 1, 2026; Business Standard reported that implementation was deferred by six months to January 1, 2027, and that they apply only to transactions on or after that date.
A caution on official fraud data: the RBI’s annual figures count only bank frauds of ₹1 lakh and above. For FY26 they show 10,114 cases worth ₹48,021 crore, but just 293 card, internet and digital payment cases worth ₹29 crore, according to Outlook Business. Most digital scams are far smaller than ₹1 lakh, which is exactly the band the new compensation scheme targets.
What Now Counts as a “Fraudulent” Transaction
The key change is in the definition. Under the new directions, a fraudulent electronic banking transaction includes a transaction made by a third party using fraudulently obtained credentials, a transaction a customer makes under coercion or duress, and an unauthorised transaction, as reported by Medianama and CorpLaw Updates. Coerced or pressured payments, the heart of most phone and “digital arrest” scams, are therefore inside the framework rather than outside it.
Before: the 2017 framework
- Covered only “unauthorised” transactions
- Zero liability if reported within 3 working days
- Limited liability of ₹5,000 to ₹25,000 if reported in 4 to 7 working days
- Credit within 10 working days; resolution within 90 days
- No compensation fund
From January 1, 2027
- Covers credential theft, coercion and unauthorised use
- Zero liability for third-party breaches reported within 5 calendar days
- Bank must prove customer liability
- Resolution within 45 days, or 60 for cross-border
- Compensation of up to ₹25,000 for losses up to ₹50,000
What the RBI treats as customer negligence
Negligence still matters for liability. Medianama lists examples the directions treat as customer negligence: sharing or failing to protect PINs, passwords or OTPs; delaying reports of fraud or a lost card; ignoring specific, clear scam warnings from the bank; downloading malicious apps; and not updating your registered mobile number or email. In those cases you bear the loss up to the moment you report it, and the bank bears everything after.
Who Pays in Each Scenario
The table below decodes the liability rules for every situation the directions describe. Liability and compensation are two separate questions: the first decides whether the bank must reverse your loss in full; the second is a safety net for small losses where the bank would not.
| Scenario | Your liability | Condition | Compensation scheme relevant? |
|---|---|---|---|
| Bank negligence or system failure | Zero | Whether or not you reported it | Not needed; bank bears the full loss |
| Third-party breach, reported within 5 days | Zero | Report within 5 calendar days | Not needed if reversed in full |
| Third-party breach, reported after 5 days | Per bank’s board policy | Late reporting | No; scheme requires reporting within 5 days |
| Customer negligence, loss before reporting | You bear it | For example, OTP shared | Yes, if loss up to ₹50,000 and reported within 5 days |
| Customer negligence, loss after reporting | Zero | Bank bears all later losses | Not needed |
| Coerced or pressured payment | Depends on fault findings | Now inside “fraudulent EBT” | Yes, within the scheme limits |
| Any case, bank chooses to waive | Zero | Banks have discretion to waive liability | Not needed |
Two rules shift power towards customers. Business Standard quotes the RBI as saying that “the burden of proving customer liability in complaints involving fraudulent EBTs shall lie on the bank.” And bank negligence now explicitly includes failing to send transaction alerts, lacking 24×7 reporting channels, failing to act on complaints, system malfunctions, security breaches and internal fraud.
The Compensation Formula, Line by Line
The scheme pays 85% of your net loss or ₹25,000, whichever is lower. Net loss means the gross loss minus anything recovered and returned. It applies to gross losses of up to ₹50,000, can be claimed only once in a lifetime, and covers frauds in the first year after January 1, 2027. Because 85% of ₹29,412 is ₹25,000, every net loss above ₹29,412 hits the cap.
| Net loss | You receive | RBI pays | Your bank pays | Beneficiary bank pays |
|---|---|---|---|---|
| ₹5,000 | ₹4,250 | ₹3,250 | ₹500 | ₹500 |
| ₹10,000 | ₹8,500 | ₹6,500 | ₹1,000 | ₹1,000 |
| ₹20,000 | ₹17,000 | ₹13,000 | ₹2,000 | ₹2,000 |
| ₹25,000 | ₹21,250 | ₹16,250 | ₹2,500 | ₹2,500 |
| ₹29,412 to ₹50,000 | ₹25,000 | ₹19,118 | ₹2,941 | ₹2,941 |
Domestic split as reported: below ₹29,412, the RBI funds 65% of the net loss and the customer’s bank and the beneficiary bank 10% each, totalling the 85% paid out. At the cap, the RBI pays ₹19,118 and each bank ₹2,941. The rupee figures above are our calculations using that split. The ₹25,000 row matches the worked example published by Upstox.
Worked example, as published by Upstox: you lose ₹40,000 and ₹15,000 is recovered before compensation is paid. Net loss is ₹25,000, so you receive 85%, or ₹21,250: ₹16,250 from the RBI and ₹2,500 each from your bank and the beneficiary bank. You end up ₹3,750 short of your original balance. If instead you had already received ₹25,000 and ₹15,000 was recovered later, the compensation is recalculated to ₹21,250 and you receive a further ₹11,250, so you again end at ₹36,250 of your ₹40,000.
Three Victims, Three Very Different Outcomes
The scenarios below are illustrations, not real cases, built from the rules as reported. They show how the same rules produce very different results depending on fault, amount and timing.
Asha: card details stolen in a data breach
Asha’s debit card details are leaked from a merchant’s systems and ₹60,000 is spent abroad. She sees the SMS alert and reports to her bank and 1930 the next morning. This is a third-party breach reported within 5 calendar days, so her liability is zero and the bank must reverse the full ₹60,000. The compensation scheme is irrelevant to her, and the ₹50,000 cap does not apply, because zero liability covers the whole loss.
Ravi: shares an OTP with a fake customer-care caller
Ravi reads out an OTP to a caller claiming to be from his bank and loses ₹18,000. That is customer negligence, so the bank does not have to reverse the loss incurred before he reported it. But he reports to the bank and 1930 within two days and applies for compensation. Using the formula, he receives 85% of ₹18,000, or ₹15,300, within 5 days of a complete application: ₹11,700 from the RBI and ₹1,800 each from the two banks, by our calculation. He has now used his one lifetime claim.
Meena: reports a week late
Meena is pressured by a caller posing as a police officer into approving UPI payments totalling ₹35,000, and only reports it eight days later, after talking to her family. Because she missed the 5-day window, she cannot claim compensation, and her liability falls under her bank’s board-approved policy. Coerced payments now fall within the definition of fraud, so had she reported within 5 days she could have applied for the capped ₹25,000, subject to the bank’s findings. Delay alone may have cost her that amount.
The Clock: What Happens, and When
Almost every benefit in the new rules depends on acting within 5 calendar days. The second chart compares the deadlines with those under the 2017 framework.
Credit card fraud gets an extra safeguard. Within 5 calendar days of your notification, the bank must make a shadow reversal equal to the disputed amount, so you are not charged interest or fees on money you dispute while the investigation runs. Reversals are value-dated to the original transaction date, CorpLaw Updates notes, so you lose no interest. Payments banks do not issue credit cards, so this provision does not apply to them.
From the 2017 Circular to the First Claims
- July 6, 2017RBI sets the earlier liability framework: 3-day zero liability, 90-day resolution.
- June 24, 2026Seven amendment directions issued, signed by CGM Veena Srivastava.
- July 1, 2026Original start date, deferred by six months.
- January 1, 2027Rules take effect for transactions on or after this date.
- December 31, 2027Approximate end of the one-year window for frauds eligible for compensation.
The compensation scheme is explicitly time-bound: it covers fraudulent transactions within one year of January 1, 2027. Banks must claim reimbursement from the RBI quarterly, within 30 days of each quarter’s end, and keep records for 2 years after the mechanism closes, according to CorpLaw Updates. Whether the scheme will be extended beyond the first year has not been announced.
What to Do If You Are Defrauded After January 1
- Call your bank’s 24×7 fraud channel immediately and ask for cards, UPI and net banking to be blocked; record the complaint number the bank must give you.
- Report the same day on the 1930 helpline or the National Cyber Crime Reporting Portal; keep the acknowledgement.
- Ask the bank for its compensation application form and submit it complete, with both complaint numbers, within 5 calendar days.
- Keep screenshots of messages, call logs and SMS alerts; the bank must send free SMS alerts for transactions above ₹500.
- Track the 45-day deadline; if the bank does not resolve or rejects your claim, escalate to the RBI Ombudsman.
What victims often get wrong: many people report only to the police or only to the bank. For the compensation scheme, reports must go to both your bank and 1930 or the cybercrime portal within 5 calendar days. Calendar days include weekends and holidays, so a fraud on a Friday evening leaves you until Wednesday.
Protect your eligibility before anything happens
Questions Victims Are Searching For
How much compensation can I get for online fraud under the new RBI rules?
For losses up to ₹50,000, you can get 85% of the net loss or ₹25,000, whichever is lower, once in a lifetime. This applies to fraudulent electronic banking transactions on or after January 1, 2027, within the scheme’s first year.
When do the new RBI digital fraud rules start?
January 1, 2027. They were originally due on July 1, 2026 but were deferred by six months, and they apply only to transactions on or after the start date.
How many days do I have to report a fraud?
Five calendar days, both to your bank and to the 1930 helpline or the National Cyber Crime Reporting Portal. This window decides zero liability for third-party breaches and eligibility for compensation.
Will I get compensation if I shared my OTP?
Sharing an OTP counts as customer negligence, so the bank need not reverse the loss before you report. The compensation scheme is designed as a safety net for such cases, paying up to ₹25,000 on losses up to ₹50,000 if you report within 5 days, once in a lifetime.
What if I lost more than ₹50,000?
Losses above ₹50,000 are outside the compensation scheme and follow existing procedures. Zero liability still applies if the bank was negligent or if a third-party breach was reported within 5 days.
How long does the bank have to resolve my fraud complaint?
45 calendar days for domestic fraud and 60 days for cross-border fraud. Compensation must be paid within 5 calendar days of receiving a complete application.
Does the rule apply to UPI and credit card fraud?
It applies to fraudulent electronic banking transactions at RBI-regulated banks, which include UPI, net banking and card transactions. Credit card frauds also get a shadow reversal within 5 calendar days.
Can both joint account holders claim compensation?
No. The compensation is once in a lifetime per person, and for a joint account only one holder may claim. That choice is permanent.
The Short Version
From January 1, 2027, the RBI treats coerced and credential-theft payments as fraud, makes banks prove customer fault and resolve complaints within 45 days. You owe nothing for bank negligence, or for third-party breaches reported within 5 days. For losses up to ₹50,000, a one-time scheme pays 85% of net loss up to ₹25,000, funded mostly by the RBI, if you report to your bank and 1930 within 5 calendar days. The scheme covers the first year only. Report fast, report to both, and keep every acknowledgement.
