The Reserve Bank of India (RBI) has issued new rules that could make it easier for victims of online fraud to get their money back. Announced on June 24, the RBI’s updated framework will apply to eligible electronic banking transactions made from January 1, 2027. The new RBI online fraud rules cover UPI, mobile banking, net banking, and debit and credit card payments, and place clearer responsibility on banks when unauthorised transactions occur.
The most important change is the reporting window. If a third party causes the fraud and neither you nor the bank is at fault, you may get zero liability and a full reversal if you report the unauthorised transaction to your bank within five calendar days of it occurring.
This is a change from the earlier framework, which used a three-working-day window for zero liability in many third-party fraud cases.
Key things to keep in mind:
- Report the transaction through your bank’s app, helpline, branch, email, or official grievance channel.
- Save the complaint number, SMS alerts, screenshots, and bank emails.
- Also report the fraud immediately through the national cybercrime helpline, 1930, and the cybercrime reporting portal.
- Do not wait for the bank’s investigation to begin before filing your complaint.
The faster you act, the stronger your claim becomes.
When will the bank have to refund your money?
The RBI says banks cannot reject a fraud complaint by simply claiming that the customer shared an OTP or was careless. The bank must provide evidence to show that the customer was responsible for the loss.
You may get a full refund in these situations:
- The fraud happened because of a bank’s security failure, system lapse, or failure to send alerts.
- A third party caused the fraud, and you report it within five calendar days.
- The transaction happened after you had already informed the bank about fraud or a compromised card, account, or device.
If the bank is at fault, you may be eligible for zero liability even if you report the transaction later.
What happens if you report late?
Missing the five-day deadline does not automatically mean you lose everything. The RBI has introduced a compensation structure for cases reported after five days, although the amount a customer receives may be capped and will depend on the type of account and transaction.
The RBI will share the cost of compensation with banks for one year, starting January 1, 2027. The move is meant to make banks respond faster and improve fraud controls.
However, if you knowingly share your PIN, password, OTP, or card details, you may have to bear losses that occur before you report the fraud. Any loss after you report it should be handled by the bank.
What you should do after spotting fraud
If money disappears from your account, act immediately:
- Block your card or freeze the account through the banking app or helpline.
- Raise a written complaint with the bank and note the reference number.
- Call 1930 and file a report on the cybercrime portal.
- Escalate the matter through the bank’s grievance officer if you do not receive a response.
- File a complaint through the RBI Ombudsman system if the bank does not resolve the issue properly.
The new rules give consumers stronger protection, but speed remains critical. Report a suspicious transaction as soon as you see it, as waiting even a day can make recovering your money harder.
