Digital Fraud? RBI's New Rule: Who Pays Now (Jan 2027)

From 1 January 2027, RBI's revised directions flip the burden of proof onto banks in digital-fraud disputes — your bank must prove you were negligent, with evidence. If you report within 5 calendar days to both the bank and the National Cyber Crime portal (or helpline 1930), even negligence-driven frauds up to ₹50,000 now carry compensation of 85% of net loss or ₹25,000, whichever is lower, as a one-time lifetime benefit.

The biggest change: your bank must prove YOU were at fault

Under the old framework, customers effectively had to demonstrate they were not negligent. The revised directions invert this: the burden of proving customer liability now rests on the bank. In practice: when you report a fraudulent electronic banking transaction, the bank investigates and must establish customer liability with evidence. If the bank rejects your claim, it must give you the reasons for rejection plus supporting evidence — transaction records, authentication logs — not a one-line "customer negligence" dismissal. Banks must act immediately to stop further unauthorised transactions once you report. Any fraud occurring after you report is borne by the bank, full stop. Banks get 30 calendar days to investigate and determine liability; domestic complaints must be resolved within 45 days, cross-border ones within 60.

Zero liability: when you owe nothing at all

Some situations keep the "zero liability" protection intact: bank negligence or system deficiency — if the fraud happened because of a lapse in the bank's own systems, your liability is zero. Third-party breaches — fraud routed through a payment gateway or mobile-provider system you never authorised is also zero-liability, provided you report it to the bank within 5 calendar days. Note the window changed: the older framework's zero-liability cut-off was 3 working days. The new one gives 5 calendar days.

The new safety net: compensation even when you were negligent

This is the genuinely new part. If the fraud happened because of your negligence — you shared an OTP, clicked a malicious link, downloaded a screen-sharing app at a scammer's request, or ignored a bank warning that a transaction looked like a scam — you were previously on your own once reported. Under the new directions, a bona fide individual victim (including sole proprietors) who loses up to ₹50,000 in a fraudulent digital banking transaction caused by customer negligence is eligible for compensation of 85% of the net loss or ₹25,000, whichever is lower. Key conditions: one-time, lifetime benefit — designed for first-time victims. You must report to both your bank and the National Cyber Crime Reporting Portal (or the national helpline 1930) within 5 calendar days of the fraudulent transaction. The bank must pay out within 5 days of the compensation claim being established. The scheme covers frauds occurring during one year from 1 January 2027 — it is a one-year mechanism that will then be reviewed, with the bank's share of compensation planned to rise over time. How the compensation is shared: for a loss below ₹29,412 (where 85% is paid), RBI bears 65%, the customer's bank 10%, and the beneficiary bank 10%. For losses between ₹29,412 and ₹50,000 (flat ₹25,000 paid), RBI contributes ₹19,118 while the two banks pay ₹2,941 each. In cross-border frauds, the customer's bank carries the larger share. You do not need to chase any of these parties — the bank handles the routing. Credit-card fraud gets a special shield: for fraudulent credit-card transactions, banks must provide a provisional credit ("shadow reversal") equivalent to the amount involved within 5 calendar days of receiving your complaint — so interest and late fees do not pile up while the case is investigated. Banks must also send instant SMS alerts for all electronic banking transactions above ₹500.

What is NOT changing

Reporting is everything. The compensation and zero-liability protections all hinge on the 5-calendar-day reporting window. Miss it, and the old limited-liability position stands. Until 1 January 2027, the current zero/limited liability timelines continue to apply — including the usual 3-working-day period. The new rules cover only transactions on or after the effective date.

What to do TODAY if fraud hits you

The rules below are live right now — do not wait for 2027: 1. Call 1930 immediately (the National Cyber Crime helpline) and file on the National Cyber Crime Reporting Portal. Speed is what freezes money trails. 2. Inform your bank through its official fraud-reporting channel — app, helpline, or branch — and get a complaint/acknowledgement number in writing. 3. Do not transact further on the compromised account/card until the bank confirms it is secured. 4. Save everything: SMS alerts, the scammer's number, UPI transaction IDs, screenshots. 5. Follow up in writing and note the date. If the bank rejects your claim, demand the written reasons and evidence the new directions require. 6. If the bank stalls or rejects without evidence, escalate through the RBI's complaint and ombudsman channel.

This article is for educational purposes only and is not financial advice. Please consult a SEBI-registered investment adviser for personalized guidance. Investments are subject to market risk.