RBI’s New Digital Fraud Rules: Who Pays When You Lose Money Online?
Disclaimer: This article is for general information/education and is not investment advice. The information is shared in good faith and for general informational purposes only. Ujjivan SFB does not make any representations or warranties regarding the accuracy, completeness, or reliability of the content.
June 29, 2026
Online fraud has become one of the biggest risks for digital banking users. A fake customer-care number, a phishing link, a malicious app, an OTP scam or a suspicious card transaction can result in money leaving an account within seconds.
To address this, the Reserve Bank of India (RBI) has issued the Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Third Amendment Directions, 2026. The directions apply to commercial banks, excluding Small Finance Banks, Payments Banks, Regional Rural Banks and Local Area Banks. This will apply to electronic banking transactions undertaken by bank customers on or after January 1, 2027.
The main question these rules answer is, "If a customer loses money in an online banking fraud, who is liable and how much does each party need to pay?"
What Has Changed?
Earlier, the framework focused mainly on unauthorised electronic banking transactions. The new RBI directions take a wider view and refer to fraudulent electronic banking transactions. This includes cases where a transaction is carried out using credentials obtained through fraud. It also includes cases where the customer approves a transaction under coercion or pressure from a third party, along with unauthorised electronic banking transactions.
This is an important change because many digital fraud cases are not always straightforward. In some cases, the customer may not have directly authorised the transaction. In others, the customer may have been tricked into approving it. The updated framework gives banks a clearer method to examine such complaints and decide liability.
What is an Electronic Banking Transaction?
Electronic Banking Transactions (EBT) include digital fund transfers and card transactions, such as:
In simple terms, if money moves through an electronic banking channel, it may fall under this framework.
When Does the Customer Have Zero Liability for Online Fraud?
The customer has zero liability in two major situations.
1. Fraud Due to Bank Negligence
If the fraudulent transaction happens because of negligence or deficiency on the part of the bank, the customer is entitled to zero liability and reversal of the transaction.
This applies whether or not the customer reports the transaction to the bank. Bank negligence can include:
In such cases, the customer does not bear the loss.
2. Third-Party Breach Reported Within Five Calendar Days
A third-party breach means the deficiency is neither with the bank nor with the customer, but somewhere else in the system. This may involve a third-party application provider, payment aggregator, payment gateway, telecom service provider or another intermediary.
If the customer reports such an unauthorised fraudulent transaction to the bank within five calendar days, the customer is entitled to zero liability and reversal of the transaction. If the customer reports it after five calendar days, the liability will be decided as per the bank's policy.
When Can the Customer Be Held Liable for Digital Fraud?
A customer may be held responsible for a fraudulent transaction if it occurs due to their negligence. In such cases, the customer is liable for the loss only until they report the fraudulent transaction to the bank. Any unauthorized transactions that take place after the customer has reported the fraud must be covered by the bank.
Examples of Customer Negligence Include:
However, the bank cannot simply reject a complaint by saying it was the customer's fault. RBI clearly states that the burden of proving customer liability lies on the bank. The bank must examine the complaint and classify it under the relevant category. This gives customers a stronger position during complaint handling.
What is the New RBI Digital Fraud Compensation Rule?
One of the most important parts of the new framework is the compensation rule for fraudulent electronic banking transactions. For eligible cases involving a gross loss of up to ₹50,000, a bona fide victim may receive compensation of 85% of the net loss amount or ₹25,000, whichever is lower. This benefit is available once during the customer's lifetime.
To qualify, the customer must report the fraudulent transaction both to the bank and through the National Cyber Crime Reporting Portal or the 1930 helpline within five calendar days from the occurrence of the fraud.
Who Pays the Compensation for Digital Fraudulent Transactions?
The compensation is shared between RBI, the customer's bank and, in domestic cases, the beneficiary bank. The beneficiary bank is the bank where the fraudulently debited amount is first credited.
What Must Banks Do Under the New Rules?
Banks must send instant SMS alerts for electronic banking transactions above ₹500. They must also send email alerts wherever the customer has provided an email address. Banks must provide 24x7 channels for reporting fraudulent transactions. These channels may include:
Banks must also acknowledge the complaint immediately and provide a complaint number, date and time of receipt.
For credit card fraud complaints, the bank must provide a shadow reversal within five calendar days from receiving the customer's notification. This is a temporary or provisional credit. The customer may not be allowed to use the amount immediately, but the customer should not bear additional interest or charges during the process.
How Long Can the Bank Take to Respond?
The bank must examine the complaint, establish liability and respond to the customer within the timeline set in its policy. However, RBI has set outer limits.
If the complaint is rejected, the bank must provide the reason and supporting details, if any.
What Should Customers Do After Online Fraud?
The first step is to act quickly. Customers should immediately report the transaction to the bank through official channels. They should also report the fraud through the National Cyber Crime Reporting Portal or by calling the 1930 helpline.
It is also important to save the complaint number, SMS alerts, emails, screenshots, bank communication, call logs and transaction details. Customers should avoid deleting scam messages or related communication, as these may help during complaint review.
Final Thoughts
RBI's new digital fraud rules bring more clarity to online banking fraud complaints. The new RBI framework gives customers clearer protection in digital fraud cases. It also gives banks clearer responsibility for complaint handling, transaction alerts, fraud reporting channels and liability decisions.
The rule does not mean every online fraud loss will be fully refunded. But it does create a structured process for deciding who pays, how much is paid and how quickly complaints must be handled. For banks, the message is equally clear, digital banking safety, fast reporting systems and fair complaint handling are now central to responsible business conduct.
Disclaimer:
The contents herein are only for informational purposes and generic in nature. The content does not amount to an offer, invitation or solicitation of any kind to buy or sell, and are not intended to create any legal rights or obligations. This information is subject to updation, completion, amendment and verification without notice. The contents herein are also subject to other product-specific terms and conditions, as well as any applicable third-party terms and conditions, for which Ujjivan Small Finance Bank assumes no responsibility or liability.
Nothing contained herein is intended to constitute financial, investment, legal, tax, or any other professional advice or opinion. Please obtain professional advice before making investment or any other decisions. Any investment decisions that may be made by the you shall be at your own sole discretion, independent analysis and evaluation of the risks involved. The use of any information set out in this document is entirely at the user's own risk. Ujjivan Small Finance Bank Limited makes no representation or warranty, express or implied, as to the accuracy and completeness for any information herein. The Bank disclaims any and all liability for any loss or damage (direct, indirect, consequential, or otherwise) incurred by you due to use of or due to investment, product application decisions made by you on the basis of the contents herein. While the information is prepared in good faith from sources deemed reliable (including public sources), the Bank disclaims any liability with respect to accuracy of information or any error or omission or any loss or damage incurred by anyone in reliance on the contents herein, in any manner whatsoever.
To know more about Ujjivan Small Finance Bank Products Visit:"https://www.ujjivansfb.bank.in"
All intellectual property rights, including copyrights, trademarks, and other proprietary rights, pertaining to the content and materials displayed herein, belong to Ujjivan Small Finance Bank Limited or its licensors. Unauthorised use or misuse of any intellectual property, or other content displayed herein is strictly prohibited and the same is not intended for distribution to, or use by, any person in any jurisdiction where such distribution or use would (by reason of that person's nationality, residence or otherwise) be contrary to law or registration or would subject Ujjivan Small Finance Bank Limited or its affiliates to any licensing or registration requirements.
