RBI Sets Digital Fraud Relief Rules From Jan 1, 2027 With Compensation Up To ₹25,000

In a major overhaul aimed at reinforcing depositor confidence in India's expanding digital financial ecosystem, the Reserve Bank of India (RBI) has introduced an updated compensation and liability framework for fraudulent electronic banking transactions (EBTs). Set to take effect on January 1, 2027, the revised directions offer substantial financial relief to individual account holders ensnared by phishing schemes, credential theft, and coercion scams.

Under the updated guidelines, bona fide victims of small-value electronic banking frauds can claim structured compensation, while banks will face stricter resolution timelines and increased accountability.

Compensation Limits and Eligibility Criteria

The compensation framework specifically targets small-value fraudulent transactions to cushion individual retail depositors from unexpected cyber losses.

Key provisions of the compensation payout include:

• Gross Loss Cap: The fraud must involve a qualifying electronic banking transaction with a gross loss of up to ₹50,000.
• Reimbursement Formula: Eligible victims can receive the lower of 85% of their net loss amount (after deducting any recoveries) or ₹25,000. For instance, on a fraudulent debit of ₹20,000, 85% equates to ₹17,000 in compensation; for a ₹50,000 loss, the payout is capped at ₹25,000.
• One-Time Benefit: The small-value fraud compensation mechanism is accessible once during a customer's lifetime.
• Applicability Window: The compensation provisions will be payable for eligible losses incurred on fraudulent transactions occurring up to one year from the rollout date, covering incidents up to January 1, 2028.

Strict Five-Day Reporting Deadline

To become eligible for the small-value fraud compensation scheme, depositors must adhere to a strict reporting protocol. Customers are required to lodge an official complaint within five calendar days of the transaction's occurrence.

Unlike previous frameworks that counted working days, this window is strictly measured in calendar days, meaning weekends and statutory public holidays are included in the count. Furthermore, the customer must report the incident across two mandatory channels:

• The respective account-holding bank via its official branch, net banking, or mobile application.
• The National Cyber Crime Reporting Portal (cybercrime.gov.in) or the national helpline at 1930.

Liability Guidelines and Burden of Proof

The central bank's directions fundamentally realign the burden of proof, requiring banks—rather than defrauded depositors—to establish negligence or complicity before denying claims.

Customer liability scenarios are structured as follows:

• Zero Customer Liability: In instances where fraud stems from bank deficiency, system vulnerabilities, or employee negligence, the customer bears zero liability and is entitled to a full value-dated refund, regardless of reporting delays. Zero liability also applies to third-party breaches where neither the customer nor the bank is at fault, provided the incident is flagged within five calendar days.
• Customer Negligence: If a customer compromises credentials, they bear the full loss until the fraudulent activity is formally reported, after which the bank assumes full liability for any subsequent transactions. However, small-value losses up to ₹50,000 remain eligible for the 85% or ₹25,000 compensation mechanism.
• Mandatory SMS Threshold: To aid rapid discovery of unauthorized debits, banks will be mandated to send instant SMS alerts for all electronic banking transactions exceeding ₹500.

Cost Sharing and Resolution Timelines

The compensation payout burden will not rest entirely on the customer’s bank. For claims below ₹29,412 (where 85% is reimbursed), the RBI will absorb 65% of the compensation payout, with 10% borne by the customer's bank and 10% by the beneficiary bank. For eligible claims between ₹29,412 and ₹50,000 where the maximum ₹25,000 is disbursed, the RBI contributes ₹19,118, while the sending and receiving banks each contribute ₹2,941.

Banks are required to examine and resolve domestic fraud claims within 45 calendar days (60 days for cross-border cases). Once compensation eligibility is established, the bank must disburse the funds into the customer's account within five calendar days. If an institution rejects a liability claim, it must provide detailed technical justifications, including transaction, OTP, and SMS logs.