Scammed Online? RBI’s New ₹25,000 Fraud Compensation Rules
Understanding RBI’s New Framework for Digital Fraud Compensation
India’s digital payments story is one of the great financial transformations of our time, reaching households in every corner of the country. Yet the convenience that makes a payment instant also makes a fraud instant. A call from a “bank officer”, a fake parcel-delivery link or an urgent message from a “relative” can empty an account within seconds.
To strengthen customer protection, the Reserve Bank of India (RBI) has finalised a revised framework for fraudulent electronic banking transactions, announced on 24 June 2026 and applicable to transactions on or after 1 January 2027 . It answers the first question every victim asks: who bears the loss?
From “unauthorised” to “fraudulent”: a wider safety net
Since 2017, customer liability has been governed by the RBI’s circular on unauthorised electronic banking transactions. Protection rested on a single test: did the customer authorise the transaction? Many modern scams, however, persuade victims to make the payment themselves.
The new directions replace the narrow idea of an “unauthorised” transaction with the broader concept of a “fraudulent electronic banking transaction”. It covers transactions by a third party using fraudulently obtained credentials, transactions executed by a customer under coercion or duress, and unauthorised transactions. The framework applies to commercial banks, small finance banks, payments banks, regional rural banks and co-operative banks alike.
Who bears the loss?
|
Situation |
Customer’s liability |
| Fraud due to the bank’s negligence or deficiency | Zero, whenever reported |
| Third-party breach (neither bank nor customer at fault), reported within 5 calendar days | Zero |
| Fraud caused by the customer’s negligence, such as sharing an OTP or PIN | Loss up to the time of reporting; the bank bears any loss after that |
Source:
Two procedural safeguards deserve attention. The burden of establishing customer liability rests on the bank, and complaints must be resolved within 45 calendar days for domestic transactions and 60 for cross-border ones. For credit-card fraud, banks must make a temporary “shadow reversal” within five calendar days of notification.
The compensation scheme: relief even where the customer erred
The most significant innovation is a one-time compensation scheme for small-value frauds involving customer negligence – precisely the cases in which victims previously received nothing. Its key terms are:
- Eligibility: individual customers, including sole proprietors, with a net loss of up to ₹50,000.
- Amount: 85% of the net loss or ₹25,000, whichever is lower.
- Condition: the fraud must be reported to the bank and to the National Cyber Crime Reporting Portal or helpline 1930 within five calendar days.
- Limits: available once in a lifetime, for frauds occurring during the first year of the framework; payment within five calendar days of a complete application.
- Funding: shared, with the RBI bearing the major share alongside the customer’s bank and the bank that received the funds.
An illustration: Meena loses ₹20,000 after sharing an OTP with a caller posing as her bank, and reports it within 48 hours. Eighty-five per cent of her loss is ₹17,000, which is below the cap, so she receives ₹17,000. Had she lost ₹40,000, 85% would be ₹34,000, and the payment would be capped at ₹25,000.
What the framework achieves
- Speed as the cornerstone. The five-day reporting window rewards prompt action, the most important factor in tracing and freezing fraudulent funds.
- Responsibility across the payment chain. Asking the beneficiary bank to contribute recognises that the receiving end of a transaction also has a role in detecting mule accounts.
- A calibrated first phase. The loss ceiling, lifetime limit and one-year window suggest a measured design; experience gathered during 2027 can inform future refinement.
- Greater transparency. Instant SMS alerts become mandatory for every transaction above ₹500, with email alerts wherever an address is registered.
A global perspective
India is part of a wider international movement. In the United Kingdom, payment service providers have, since 7 October 2024, been required to reimburse victims of authorised push payment fraud up to £85,000 per claim, with the cost shared between sending and receiving institutions. The common thread is clear: protection works best when every institution in the payment chain shares responsibility.
Compensation, however, is only one layer. The RBI has indicated that it is exploring further safeguards, including a possible one-hour hold on certain payments above ₹10,000, since such transactions account for about 45% of fraud cases by volume and 98.5% by value. These proposals remain under consideration.
If you are defrauded: a five-day checklist
- Call 1930 or file a complaint at gov.in immediately.
- Inform your bank through its official channels the same day, and block your cards and UPI access.
- Preserve evidence: screenshots, SMS messages, call logs and transaction IDs.
- Record every acknowledgement or complaint number.
- If your bank does not respond within 30 days, or you are dissatisfied, approach the RBI Integrated Ombudsman at rbi.org.in.
Conclusion
The new framework marks a thoughtful step from a narrow, authorisation-based test towards a customer-centric approach to digital fraud. It rewards vigilance, spreads responsibility and, for the first time, offers relief to customers who made an honest mistake. For a nation building its future on digital payments, trust is the real currency, and this framework is an important investment in it. The best protection, however, remains awareness: pause, verify and never share an OTP, PIN or password.
References
- Business Standard, “RBI caps compensation for digital fraud victims at ₹25,000 under new norms”, June 2026. https://www.business-standard.com/industry/banking/rbi-finalises-fraud-compensation-framework-for-victims-of-digital-fraud-126062401240_1.html
- MediaNama, “RBI caps customer liability in digital fraud from 2027”, 25 June 2026. https://www.medianama.com/2026/06/223-rbi-final-amendment-directions-limiting-customer-liability-digital-transactions-effect-2027/
- Reserve Bank of India, “Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions”, circular dated 6 July 2017. https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11040
- CorpLawUpdates, “RBI Overhauls Customer Liability Framework for Digital Banking Fraud, Adds Compensation Scheme – Effective January 1, 2027”, June 2026. https://www.corplawupdates.in/updates/rbi-fraudulent-ebt-customer-protection-compensation-directions
- Payment Systems Regulator (UK), policy statement on the maximum level of reimbursement for Faster Payments APP scams, as reported by Regulation Tomorrow, October 2024. https://www.regulationtomorrow.com/2024/10/psr-issues-policy-statement-confirming-maximum-level-of-reimbursement-for-faster-payments-app-scams/
- Business Standard, report on the RBI’s proposed security safeguards for digital payments, 29 May 2026. https://www.business-standard.com/finance/news/rbi-digital-payments-fraud-upi-security-frictions-126052900821_1.html
- National Cyber Crime Reporting Portal, Ministry of Home Affairs, Government of India. https://cybercrime.gov.in
- Reserve Bank of India, Complaint Management System (Integrated Ombudsman Scheme, 2021). https://cms.rbi.org.in
Disclaimer: This article is for general information and educational purposes only and does not constitute legal or financial advice. Readers should refer to the official notifications of the Reserve Bank of India and consult a qualified professional before acting on any information contained herein.
