RBI fraud rules from 1 January 2027: report in 5 days for zero liability, up to ₹25,000

Three points follow from the text. First, the burden of proving that a customer is liable lies on the bank, which must examine each complaint and classify it. Second, for a third-party breach reported after five calendar days, the customer's liability is set by the bank's own policy rather than by a fixed rule. Third, any loss from a transaction made after the customer has reported the fraud is the bank's to bear.

The definition of a fraud is wider than before. It now includes a transaction carried out by a third party using credentials obtained from the customer through fraud, and one the customer approved under coercion or duress, as well as an unauthorised transaction. A bank may also waive a customer's liability at its own discretion.

Up to ₹25,000 for small frauds: how the compensation works

The most unusual part is a compensation scheme for small losses, including cases where the customer was careless. A genuine victim who is an individual, a sole proprietor included, and whose gross loss is up to ₹50,000, can receive 85 per cent of the net loss or ₹25,000, whichever is less. The net loss is the gross loss minus anything recovered. A customer can claim only once in a lifetime. In a joint account, only one holder may claim, and that person cannot claim again later as a single account holder, or the other way round.

There are two conditions. The bank must be satisfied, through the processes in its own policy, that the loss is genuine. And the victim must have reported the fraud to the bank and to the National Cyber Crime Reporting Portal or the helpline 1930 within five calendar days. The bank has to pay within five calendar days of receiving the application form, and the scheme covers frauds that occur up to one year from 1 January 2027.

The circular works through the arithmetic. If ₹40,000 is reported lost and ₹15,000 is recovered before compensation, the net loss is ₹25,000 and the payout is 85 per cent of that, which is ₹21,250. If nothing is recovered, a ₹40,000 loss pays the ₹25,000 cap. The cap starts to bite at a loss of ₹29,412, because 85 per cent of that is ₹25,000. If money is recovered after the payout, the bank recalculates what is owed and pays any further amount due.

The money is shared. For a domestic fraud of less than ₹29,412, the Reserve Bank bears 65 per cent of the loss, the customer's bank 10 per cent and the bank that first received the stolen money 10 per cent. For ₹29,412 to ₹50,000, the ₹25,000 payout is split ₹19,118 from the Reserve Bank and ₹2,941 each from the two banks. For a cross-border fraud, the Reserve Bank and the customer's bank share it. Banks claim their share from the Reserve Bank every quarter.

What banks must now do: alerts, a 24x7 line and a 45-day clock

The circular also lists duties that determine whether a bank is judged at fault. These are the practical changes a customer will see.

Banks must collect a mobile number from every customer who uses electronic transactions, other than ATM cash withdrawals, and an email address where available, and verify them at onboarding and at intervals set in their policy. They must send an instant SMS alert for every transaction above ₹500. Below that, an SMS is optional but must be free. An email alert is required for every transaction where an address is on file. Alerts must show the account or card number, amount, date, time, channel and beneficiary. Banks may not charge for SMS sent to comply with regulations.

Reporting must be easy. Banks must offer 24x7 channels such as phone banking, SMS, a dedicated email address, IVR or a toll-free line, put a number in the alert SMS itself for an immediate reply, and carry a direct link for reporting fraud on the home page of the website and the mobile app. Each report must be logged as a complaint and acknowledged at once with a complaint number and the time of receipt, and the bank must act promptly to stop further unauthorised transactions on the account.

The time limits are firm:

• A complaint must be resolved within the time in the bank's policy, which cannot exceed 45 calendar days for a domestic fraud or 60 calendar days for a cross-border one.
• A reversal must be value-dated to the original date, so the customer loses no interest.
• For a credit card, a provisional "shadow reversal" of the amount must be given within five calendar days of the customer's notice.
• A rejected complaint must come with reasons and supporting details.

Boards must also review fraud complaints regularly, broken down by card-present, card-not-present, internet banking, mobile banking and ATM cases.

The circular applies to commercial banks other than small finance banks, payments banks, regional rural banks and local area banks. The Reserve Bank's March draft proposed matching directions for each of those groups and for co-operative banks, so customers of other lenders should check their own bank's policy.