RBI Sets January 1, 2027 Rollout for Digital Fraud Rules with Capped Compensation of Up to Rs 25,000

The Reserve Bank of India (RBI) has issued revised guidelines to shield retail customers from escalating digital banking frauds, instituting a compensation mechanism for small-value scams alongside tighter complaint resolution timelines. Under the amended Responsible Business Conduct directions, which take effect on January 1, 2027, victims of fraudulent electronic banking transactions (EBTs) can claim financial reimbursement even if they inadvertently compromised credentials or fell victim to social engineering.

The revised framework covers transactions undertaken via Point of Sale (POS) terminals, Automated Teller Machines (ATMs), internet banking, mobile applications, and card networks.

Compensation Capped at Rs 25,000

For small-value electronic fraud involving a gross loss of up to ₹50,000, eligible victims can receive partial reimbursement.

Key Compensation Terms:

• The compensation payout is capped at 85% of the net loss amount or ₹25,000, whichever is lower.
• Net loss is determined after subtracting any recoveries made prior to or after disbursing the claim. If subsequent recoveries occur, the bank recalculates the final liability.
• This relief can be availed only once in a customer's lifetime.
• The small-value fraud compensation mechanism will initially apply to transactions occurring within a one-year window from the implementation date, running up to January 1, 2028.

Filing Deadline and Zero Liability Rules

The central bank has replaced the earlier three-working-day notification standard with a revised five-calendar-day timeline. To qualify for the ₹25,000 small-value scam payout, the victim must lodge a formal complaint with both their bank and the National Cyber Crime Reporting Portal or the National Cyber Crime Helpline (1930) within five calendar days of the incident.

In incidents where unauthorized debits occur due to negligence or deficiency on the part of the bank, the customer bears zero liability, and the transaction must be reversed irrespective of whether it was reported. For third-party breaches where the fault lies neither with the bank nor with the customer, zero liability applies if the user alerts the bank within five calendar days. If reported after five days, the customer's liability is evaluated under the board-approved policies of the bank or through the small-value compensation criteria.

Burden of Proof Shifts to Banks

Under the updated directions, the burden of proving customer negligence or liability in disputed transactions lies entirely on the financial institution rather than the consumer. If a bank rejects a claim, it must provide documented proof to the customer, including OTP delivery records, transaction histories, and SMS delivery logs.

The RBI has also established strict operational turnaround windows:

Resolution Timelines:

• Banks must complete investigations and settle domestic fraud complaints within 45 calendar days.
• Cross-border and international fraud disputes must be settled within 60 calendar days.
• If a customer is entitled to reimbursement, the bank must credit the approved sum within five calendar days of receiving the formal claim.
• In cases involving credit cards, provisional credit (shadow reversal) must be extended to the consumer within five days to prevent interest accruals or late fee charges while the inquiry is pending.