Money · 8 minute read
Bank fraud? New RBI rules on who pays and how much you get back
From 1 January 2027, new RBI rules decide who bears the loss in digital bank fraud, how fast banks must act, and who can get up to ₹25,000 back. Here is what changes, in plain words.
Written by JJ Social Media Team
Published 19 October 2026
AT A GLANCE
• From 1 January 2027, if the bank is at fault for a digital fraud, you pay nothing.
• Report to your bank at once. To keep zero liability where someone else in the system was at fault, and for the small-loss compensation, report within five calendar days of the transaction (for compensation, also to 1930 or cybercrime.gov.in).
• Shared an OTP? For frauds during 2027 with losses up to ₹50,000, individuals may get 85% of the net loss, up to ₹25,000, once in a lifetime.
• Banks must decide fraud complaints within 45 calendar days (60 if cross-border). Frauds before 2027 follow the older rules.
Law as of 19 October 2026. This explainer reflects Indian law and court rulings as they stood on that date. Laws change, so check the current position or ask a lawyer before relying on it.
New RBI fraud compensation rules: the short answer
From 1 January 2027, new RBI rules decide who pays when money is taken from your bank account by digital fraud. If the bank was at fault, you pay nothing. If the fault was somewhere else in the system, such as a payment app or telecom company, you pay nothing if you report it to your bank within five calendar days of the transaction. If you were tricked into sharing an OTP or PIN, you usually bear the loss up to the moment you report it. But for small losses of up to ₹50,000, a new one-time scheme pays back 85% of the net loss, up to ₹25,000.
Banks must also decide fraud complaints faster, within 45 days in most cases. This guide explains the new rules, how they differ from today's rules, and where to complain. It explains the general rules only. For advice on your own case, speak to a lawyer or your District Legal Services Authority, which gives free legal aid to people who qualify.
What the RBI changed, and from when
On 24 June 2026, the Reserve Bank of India (RBI, the country's banking regulator) issued final "Amendment Directions" for all types of banks: commercial banks, small finance banks, payments banks, regional rural banks, local area banks and co-operative banks.
The new rules apply to electronic banking transactions made on or after 1 January 2027. These include UPI, net banking, card and mobile banking payments. Frauds before that date follow the older rules, explained below.
The three big changes are:
- Wider cover. The old rules spoke of "unauthorised" transactions, meaning payments you did not make. The new rules cover "fraudulent" transactions, which also include payments made using login details obtained by fraud, and payments you approved only because someone coerced or forced you.
- Faster decisions on fraud complaints.
- New compensation for small losses, even where the customer was careless.
Who pays for the fraud? The three situations
It depends on whose mistake let the fraud happen. The bank has to prove that you are liable, not the other way round.
| Whose fault | Example | Who bears the loss |
|---|---|---|
| The bank's | The bank did not send the required alert, or its system was hacked | The bank. You pay nothing, whether or not you reported it. |
| Someone else in the system | A flaw at a payment app, payment gateway or telecom company | Nothing for you if you report to the bank within 5 calendar days of the transaction. If later, the bank's own policy decides. |
| The customer's | You shared an OTP, PIN or password, or installed a harmful app | You, up to the time you report it (but see the compensation scheme below). The bank bears any loss after you report. |
Examples of customer negligence (carelessness) include giving your PIN, password or OTP to another person, keeping a written PIN with the card, ignoring clear bank warnings that a payment looks like a scam, downloading harmful apps, not telling the bank promptly after you learn of a fraud or a lost card, and not updating your mobile number or email with the bank. A bank can also choose to waive your share of the loss.
Many scams work by tricking people into sharing an OTP, for example a fake "KYC update" call. That is why the new compensation scheme matters. In other scams, like the digital arrest scam, people are pressured into sending the money themselves. The new rules now count payments made under coercion as fraudulent, but how the loss is shared in such a case depends on the bank's assessment.
The new ₹25,000 compensation scheme
This helps people who lost a small amount after being tricked, for example into sharing an OTP:
- Who can claim: an individual, including a sole proprietor (a one-person business), whose fraud falls in the customer negligence category.
- How big the loss can be: the total (gross) loss must be ₹50,000 or less.
- How much you get: 85% of the net loss, or ₹25,000, whichever is lower. The net loss is the loss minus any money that was recovered.
- Report within five calendar days of the transaction to both your bank and the National Cyber Crime Reporting Portal (cybercrime.gov.in) or helpline 1930.
- Once in a lifetime. You can get it only once. In a joint account, only one holder can claim, and someone who claims as a joint holder cannot claim again on their own account.
- Only for the first year. It covers frauds that happen within one year from 1 January 2027, that is, during 2027.
Say you lost ₹40,000 after sharing an OTP, and ₹15,000 of it was later recovered. Your net loss is ₹25,000. 85% of that is ₹21,250, which is below the ₹25,000 cap, so that is the compensation. A ₹70,000 loss would not qualify, as it is above ₹50,000.
How you claim: once the bank finds your complaint genuine, it gives you an application form. You fill in your details and the details of your complaint, including your 1930 or cyber portal complaint. The bank must pay within five calendar days of getting your completed form.
How fast the bank must act
| What | Rule from 1 Jan 2027 |
|---|---|
| Decide your complaint | Within 45 calendar days of receiving it (60 days if the fraud was cross-border). |
| Credit card fraud | A provisional credit ("shadow reversal") within 5 calendar days of your complaint |
| Pay compensation | Within 5 calendar days of your completed application |
| SMS alerts | Instant SMS for every electronic payment above ₹500, plus email if you gave one |
A shadow reversal means the bank shows the disputed amount back in your card account while it investigates. You cannot use that amount yet, but you are not charged interest or fees on it.
The rules for frauds before 1 January 2027
For frauds before 1 January 2027, the older RBI rules, first issued in 2017 and now part of RBI's 2025 Responsible Business Conduct Directions, still apply. They cover unauthorised electronic transactions:
- Bank at fault: nothing for you to pay.
- Fault elsewhere in the system: nothing to pay if you report within three working days of the bank's message about the transaction. If you report within four to seven working days, your loss is capped at ₹5,000, ₹10,000 or ₹25,000, depending on the type of account or card (or the transaction amount, if lower). After seven working days, the bank's own policy decides.
- Your carelessness, such as sharing an OTP: you bear the loss until you report it.
- Timelines: the bank must credit the disputed amount within 10 working days of your report, and resolve the complaint within 90 days.
The old rules have no small-loss compensation scheme.
Bank not helping? Where to complain
If money has just been lost, act fast. Our guide on what to do in the first hour after online fraud explains the first steps: call 1930, inform your bank on its official number, and save evidence.
If your bank does not reply within 30 days, or within the longer time RBI rules give it for fraud complaints (45 days, or 60 if cross-border, from 2027; 90 days under the older rules), or you are unhappy with its reply, you can complain to the RBI Ombudsman under the Reserve Bank - Integrated Ombudsman Scheme, 2026. This scheme applies from 1 July 2026:
- You must complain to your bank first.
- File within 90 days after the bank's time to reply ends or after its last reply, whichever is later.
- File online at cms.rbi.org.in, by email to crpc@rbi.org.in, or by post to the RBI's Centralised Receipt and Processing Centre in Chandigarh.
- It is free, and you do not need a lawyer.
- The RBI's toll-free number 14448 gives guidance and complaint status, but you cannot file a complaint on it.
Quick answers
Will the bank refund money lost in online fraud?
It depends on whose fault it was. For frauds from 1 January 2027, you pay nothing if the bank was at fault, or if the fault was elsewhere and you reported to the bank within five calendar days of the transaction. If you shared an OTP or PIN, you usually bear the loss until you report it, apart from the small-loss compensation.
Can I get ₹25,000 from RBI for online fraud?
Only in some cases, and only for individuals. You claim through your own bank, which pays you; the RBI funds most of the payout behind the scenes. The fraud must happen within one year from 1 January 2027, the total loss must be ₹50,000 or less, and you must report to your bank and to 1930 or cybercrime.gov.in within five calendar days of the transaction. You get 85% of the net loss or ₹25,000, whichever is lower, and only once in your life.
Do the new rules apply to a fraud that happened in 2026?
No. They apply to transactions on or after 1 January 2027. Earlier frauds follow the older rules.
Want the full picture?
Marriage, divorce and maintenance, in one guide
English + Hindi PDF · UPI or cards · Instant email delivery
Related explainers
Marriage & family IPC 498A is now BNS 85: cruelty law explained simply IPC 498A is now BNS 85. What counts as cruelty, how to file a complaint, how arrest works and what the 2025 cooling period means. PUBLISHED 5 OCTOBER 2026 Read ↗ Marriage & family CrPC 125 is now BNSS 144: who can claim maintenance? Wives, children and parents can claim a monthly allowance. What changed from CrPC 125, how courts set the amount, and what happens on non-payment. PUBLISHED 7 OCTOBER 2026 Read ↗
This article is for information and awareness, not legal advice. For your own case, consult a qualified lawyer or your District Legal Services Authority. Spotted a mistake? Tell us at jagrukjantaaofficial@gmail.com and we will correct it.
Jagruk Jantaa: Home · Blog · The guide (English) · गाइड (हिंदी) · Brands · About