If money leaves your bank account or card through a transaction you did not make, how much the bank must refund depends on three things: who was at fault, how quickly you reported it, and the date of the transaction. For any unauthorised electronic transaction today, a customer who reports a third-party fraud within three working days owes nothing, and the bank must put the money back. From 1 January 2027 that window becomes five calendar days, the rules extend to transactions you were tricked into approving, and small-value victims get a new compensation route of up to ₹25,000.
Both sets of rules come from the Reserve Bank of India. The current position sits in the RBI (Commercial Banks – Responsible Business Conduct) Directions, 2025, which carried forward the July 2017 framework on limiting customer liability. The replacement framework was notified on 24 June 2026 through the Responsible Business Conduct Third Amendment Directions, 2026 and applies to electronic banking transactions undertaken on or after 1 January 2027. The RBI press release of 24 June 2026 confirms that matching amendments were issued for small finance banks, payments banks, local area banks, regional rural banks, urban co-operative banks and rural co-operative banks.
Report first, argue later
Whatever the facts, the clock starts when the debit happens or when the bank's alert reaches you, so the first hour matters more than the paperwork. The practical order is:
- Block the card, UPI access or net banking login through the bank's app, helpline or the reply number given in the transaction SMS. Banks must offer round-the-clock reporting channels.
- Report the transaction to the bank in writing (app, email or the fraud-reporting link on its website) and keep the complaint number. Banks are required to send an immediate acknowledgement with the complaint number and the date and time of receipt.
- Lodge a complaint with the cyber crime helpline 1930 or the National Cyber Crime Reporting Portal. Under the 2027 rules this report is a condition for small-value compensation, and the bank will in any case advise you to make it.
- Save the SMS and email alerts, screenshots of calls or messages, and the acknowledgement. Under both frameworks the burden of proving that you are liable lies on the bank, but your own record of dates decides which liability band you fall into.
Transactions up to 31 December 2026: the three-day and seven-day bands
For an unauthorised electronic transaction before 1 January 2027, paragraphs 67 to 75 of the 2025 Directions decide the outcome. The starting point is fault.
When the bank is at fault
If the fraud happened because of contributory fraud, negligence or deficiency on the bank's side (a system breach, an internal fraud, a failure of its own security), you have zero liability. It does not matter whether or when you reported it.
When a third party is at fault and neither you nor the bank slipped
This covers card skimming, data leaks elsewhere in the payment chain and similar breaches where the customer did nothing wrong. Liability then depends on how many working days you took to notify the bank after receiving its communication about the transaction:
- Within three working days: zero liability.
- Within four to seven working days: your liability per transaction is limited to the transaction value or a fixed cap, whichever is lower.
- After seven working days: liability is decided by the bank's Board-approved policy, which you can usually find on the bank's website.
Working days are counted as per the working schedule of your home branch, and the date on which you received the communication is excluded.
The caps for the four-to-seven-day band are:
- Basic Savings Bank Deposit (BSBD) accounts: ₹5,000.
- ₹10,000: all other savings accounts, and prepaid payment instruments and gift cards.
- ₹10,000: current, cash credit and overdraft accounts of MSMEs, and such accounts of individuals with an annual average balance of up to ₹25 lakh.
- ₹10,000: credit cards with a limit of up to ₹5 lakh.
- ₹25,000: all other current, cash credit and overdraft accounts, and credit cards with a limit above ₹5 lakh.
When you were negligent
If the loss arose because you shared payment credentials such as a PIN, password or OTP, the 2025 Directions put the entire loss on you until you report the transaction to the bank. Reporting quickly still helps: it stops further debits, and the bank must act on it.
What the bank owes you while it investigates
Once you notify the bank, it must give a shadow reversal (a provisional credit of the disputed amount) within 10 working days, without waiting for any insurance claim. The bank must resolve the complaint and fix liability within the time in its Board-approved policy, and in no case later than 90 days from receipt. If it cannot resolve the complaint in 90 days, it must pay you the compensation that the zero or limited liability rules would give. Any reversal is value-dated to the date of the original transaction, so you should not lose interest.
A worked example under the current rules
Say Meena holds an ordinary savings account. Her debit card is skimmed at an ATM, and on 9 October 2026 a single ₹40,000 withdrawal is made in another city. She receives the bank's SMS the same day but only reports it on the fifth working day after that.
- This is a third-party breach, reported in the four-to-seven-working-day band.
- Her cap is ₹10,000, and the transaction value is ₹40,000. The lower figure applies, so her liability is ₹10,000.
- The bank must bear the remaining ₹30,000.
Had she reported within three working days, her liability would have been nil. Note that the text caps liability per transaction. If the same ₹40,000 had gone out as four withdrawals of ₹10,000 each, a literal reading would cap each at ₹10,000, which gives her no relief. How a particular bank applies this depends on its policy, so read it before you argue the point.
Transactions from 1 January 2027: what the 2026 amendment changes
The Third Amendment Directions rewrite this part of the Directions under a new heading on customer protection. Five changes matter most to someone who has lost money.
Fraud you were tricked into approving is now covered
The old framework spoke only of unauthorised transactions. The new definition of a fraudulent electronic banking transaction also covers a transaction executed by a third party using credentials obtained from you by fraudulent means, and a transaction you executed yourself under coercion or duress from a third party. Calls impersonating officials, fake KYC updates and similar scams now sit inside the framework rather than outside it.
Five calendar days instead of three working days
For a third-party breach, zero liability applies if you report to the bank within five calendar days from the date the transaction occurred. After that, the bank's policy decides your share. Bank negligence still means zero liability whether or not you reported, and any loss from transactions after you report falls on the bank.
Negligence now has a written meaning
The amendment now lists what counts as negligence on each side. Bank negligence includes failing to send mandatory alerts, not providing 24x7 reporting channels, not acting diligently on your report, system malfunctions, security breaches and internal fraud. Customer negligence includes not taking reasonable care of a PIN, password or OTP, not reporting promptly, ignoring specific scam warnings from the bank, downloading malicious apps, and not keeping the registered mobile number and email updated. A customer who is negligent bears the loss until the fraud is reported.
Shorter timelines
The bank must examine the complaint and respond within the time in its policy, capped at 45 calendar days for domestic fraud and 60 calendar days for cross-border fraud. For credit card fraud, it must give a shadow reversal of the disputed amount within five calendar days of your report, with no interest or charges on it. A rejection must state the reasons with supporting details. Banks must also send an instant SMS alert for every electronic transaction above ₹500.
Compensation for small-value fraud
The biggest change is paragraph 76T. It applies where the loss falls on the customer under the negligence rule. An individual, including a sole proprietor, can then claim compensation if:
- the loss is up to ₹50,000;
- the bank's internal process accepts the person as a bona fide victim; and
- the fraud was reported both to the bank and to the National Cyber Crime Reporting Portal or helpline 1930 within five calendar days of its occurrence.
The compensation is 85% of the net loss (gross loss minus any recovery, whether made before or after the payout) or ₹25,000, whichever is less. It is available once in a lifetime. For a joint account, only one holder may claim, and a person who claims as a joint holder cannot later claim as a single account holder, or the other way round. Your bank pays within five calendar days of receiving your application, in the form given in Annex II of the Directions, and then recovers the RBI share and the beneficiary bank's share. Under paragraph 76U, the mechanism covers fraudulent transactions occurring within one year from the date the amendment takes effect.
Working out the compensation in 2027
Because 85% of ₹29,412 is just above ₹25,000, the cap starts to bite at a loss of about ₹29,412. Two examples show how the numbers run.
- Say Arjun shares an OTP with a caller posing as his bank and loses ₹40,000 on 12 February 2027. He reports to the bank and to 1930 the next day. 85% of ₹40,000 is ₹34,000, so the ₹25,000 cap applies and he receives ₹25,000.
- Say Kavya loses ₹20,000 in a similar way and reports on time. She receives 85% of ₹20,000, which is ₹17,000. Two months later police recover ₹6,000 from the fraudster's account. Her net loss is now ₹14,000, so her entitlement falls to ₹11,900 and the ₹5,100 difference is adjusted out of the recovered money. She ends up with ₹17,900 of her ₹20,000 back.
A loss above ₹50,000 does not qualify for this mechanism at all, and a victim who has already used it once cannot use it again. In those cases the fault-based rules above are the only route.
Cases these rules do not settle
The framework is written for electronic banking transactions, which the amendment ties to electronic funds transfers under the Payment and Settlement Systems Act, 2007. A forged or altered cheque is a different problem; for high-value cheques the preventive tool is the Positive Pay System for cheques. Losses on accounts with entities other than banks follow their own directions, so check the rules for that type of entity rather than assuming the bank bands apply.
When the bank refuses or goes silent
You must complain to the bank first. The Reserve Bank – Integrated Ombudsman Scheme, 2026 has applied from 1 July 2026. Under it you can approach the RBI Ombudsman in two situations. The first is that the bank has not replied within 30 days, or within any longer time that RBI, NPCI or card network rules allow for that kind of complaint. The second is that you are not satisfied with its reply.
According to the RBI's FAQs on the 2026 Scheme, the complaint must be filed within 90 days from the date that period expires or from the bank's last communication, whichever is later.
Filing is free, through cms.rbi.org.in, by email to crpc@rbi.org.in, or by post to the Centralised Receipt and Processing Centre in Chandigarh, and the contact centre is on toll-free 14448. A police investigation into the fraud does not by itself make the Ombudsman complaint non-maintainable, but a matter already pending before, or decided on merits by, a court, tribunal or arbitrator will be rejected.
Before filing, attach the bank's acknowledgement with its date and time, your 1930 or portal complaint number and the bank's written reply, because the Ombudsman will measure every timeline from those records.
