RBI's new fraud refund rules from 1 January 2027: 5-day window, ₹25,000 compensation and 45-day deadline
From 1 January 2027 banks must prove your fault in a digital fraud, decide in 45 days and pay small fraud victims up to ₹25,000. How the RBI rules work.
RBI has rewritten the rules on who pays when money is lost in an online or card fraud. The new rules were issued on 24 June 2026 and apply to electronic banking transactions made on or after 1 January 2027. They cover UPI, cards, net banking, mobile banking and ATM transactions. Mint explained them again on 22 October 2026. Here is what changes for you.
What counts as a fraud now
Today's rules, from 2017, cover only "unauthorised" transactions. The new rules cover any fraudulent electronic transaction. That includes a payment made by a fraudster with details taken from you by a trick, and a payment you approved yourself because you were coerced or threatened, for example in a "digital arrest" call. The same rules are issued for commercial banks, small finance banks, payments banks, regional rural banks and co-operative banks.
Who pays
- The bank proves fault. The burden of proving that the customer is liable is on the bank.
- Bank's fault: full refund. If the fraud happened because the bank slipped, for example no SMS alerts, no 24x7 way to report, a system failure or an insider fraud, you get the money back however late you report it.
- Breach elsewhere: 5 days. If the fault lies with neither you nor the bank, for example with a payment app, a gateway or a telecom company, you get a full refund if you report within 5 calendar days. Today it is 3 working days. After 5 days, your bank's policy decides.
- Your fault: you bear the loss until you report. Sharing an OTP, PIN or password, installing a malicious app, ignoring a clear warning from the bank that a payment looks like a scam, or not updating your mobile number counts as your negligence. Any loss after you report it is the bank's.
Compensation for small frauds
Even when you were negligent, a bona fide individual victim, including a sole proprietor, can get compensation once in a lifetime:
- The gross loss must be up to ₹50,000.
- You get 85% of the net loss after any recovery, or ₹25,000, whichever is less.
- You must report the fraud to the National Cyber Crime Helpline 1930 or cybercrime.gov.in, and to your bank, within 5 calendar days.
- The bank pays within 5 calendar days of your application. RBI pays most of it, and your bank and the bank that received the money share the rest.
For example, if you lose ₹20,000, you can get ₹17,000. If you lose ₹40,000, you get ₹25,000. A loss of ₹60,000 is above the ₹50,000 limit, so this compensation does not apply. The scheme covers frauds that happen up to one year from 1 January 2027.
Deadlines for banks
- A decision on your complaint within 45 calendar days, or 60 days for a cross-border fraud.
- Any refund dated back to the day of the fraud, with no loss of interest and no extra charges.
- On a credit card, a temporary credit of the disputed amount within 5 calendar days of your complaint.
- If the bank rejects your claim, it must tell you why.
Banks must also send an SMS for every transaction above ₹500, email alerts where you have given an email address, a 24x7 way to report fraud, a direct report link on the home page of their website and app, and an instant acknowledgement with a complaint number.
What to do if you are hit
- Block your card, UPI or net banking at once through the bank's app or helpline.
- Report to the bank and keep the complaint number.
- Call 1930 or file at cybercrime.gov.in on the same day, which the compensation needs.
- Keep screenshots, SMS alerts and call details.
Until 31 December 2026 the old 2017 rules still apply. Read how they worked in a recent case: Kerala High Court orders SBI refund under RBI's zero liability rule.
Sources: RBI: Press release on review of framework of limiting customer liability in digital transactions, 24 June 2026, RBI: Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Third Amendment Directions, 2026, Mint: Key RBI rules on bank liability and customer compensation, 22 October 2026.
Rules, rates and limits change. Check the official source linked above before you rely on a figure here. Posts never contain referral or affiliate links from the writer.
Want to write for Saifu? Here is how.