RBI's new fraud compensation from 2027: who gets it and what to do

On 24 June 2026 the Reserve Bank of India issued the Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Third Amendment Directions, 2026. They change how banks must treat customers who lose money in fraudulent electronic transactions. The rules apply to transactions on or after 1 January 2027, not 1 July 2026 as the March draft had proposed. The directions are addressed to commercial banks; customers of other types of bank should ask their bank whether they apply. The framework is not yet in force, but the habits it rewards can be built today.

The headline is a compensation scheme for small losses. Individual customers, including sole proprietors, who lose up to ₹50,000 in a fraudulent electronic banking transaction arising from their own negligence may receive 85% of the net loss, capped at ₹25,000. Net loss means the loss after deducting whatever has already been recovered. The benefit can be claimed only once in a customer's lifetime, and, according to Moneylife, it is available for transactions in the first year after the directions come into force.

Take an example. If the net loss is ₹20,000, 85% is ₹17,000, so that is the compensation. If the net loss is ₹40,000, 85% is ₹34,000, but the cap limits the payout to ₹25,000. A loss above ₹50,000 falls outside the scheme and continues under the existing dispute process. This is an illustration of the formula, not a prediction for any individual case.

Who pays? Press reports say the Reserve Bank bears the largest share, with the customer's bank and the beneficiary bank contributing the balance. The practical point for families is simpler: you claim from your own bank, and the bank must acknowledge your complaint and act to prevent further unauthorised transactions. Banks have up to 45 calendar days to resolve domestic complaints and 60 days for cross-border ones, longer than the 30 days in the draft.

The directions also restate the position on zero liability. Where the fraud arises from the bank's own negligence, the customer has zero liability even if the fraud is reported late. Where it arises from a third-party breach, the customer has zero liability if it is reported within five calendar days of the transaction. For fraudulent credit card transactions, the bank must provide a shadow reversal within five calendar days of being notified. Moneylife reports that where a third-party breach is reported after five days, the compensation scheme no longer applies and liability follows the bank's own policy. Coverage differs in detail, so the safe reading is the cautious one: report at once.

The condition that matters most is time. Moneylife reports that a customer must report within five calendar days of the transaction, both to the bank and through the National Cybercrime Reporting Portal or the 1930 helpline. Coverage of the final text is not uniform on how that deadline applies in each situation, so read the Reserve Bank's directions or ask your bank for its written policy. The sensible approach is not to test the deadline at all.

What does the first hour look like? First, call your bank's fraud line and ask it to block the card, UPI handle or net-banking access. Second, call 1930, the national helpline for financial cyber fraud, and give the transaction reference, amount, time and the account the money went to. Third, file the same details at cybercrime.gov.in. Both channels exist so that the banks involved can be alerted quickly while the money may still be traceable. Fourth, write to your branch by email, describing the call, with the time and date, so a record exists if liability is later disputed.

Keep evidence before you tidy anything up. Take screenshots of the messages, the payment screen, the caller's number and any link or app the fraudster sent. Do not delete the chat. Do not uninstall the app until a screenshot is saved, and do not pay any 'recovery fee' to a stranger who contacts you afterwards. Note down the names of the bank staff you speak to and any complaint numbers you are given.

On the criminal side, a fraudster who deceives you into handing over money commits cheating. BNS S. 318 deals with cheating: simple cheating under BNS S. 318(2) carries up to three years, and cheating that dishonestly induces delivery of property under BNS S. 318(4) carries up to seven years and a fine. If the fraudster pretended to be a bank officer, a courier agent or a policeman, BNS S. 319 on cheating by personation applies, with imprisonment of up to five years, or a fine, or both. These are the provisions an FIR would typically cite; which one applies depends on the facts and is for the police and courts to decide.

Three limits are worth stating plainly. The scheme covers losses up to ₹50,000, so a larger loss is not compensated under it. It is available once. And it does not replace reporting: a customer who waits weeks may find that neither the compensation nor any chance of the money being held remains. Large losses, such as those in investment scams and digital arrest calls, still depend on how fast the report reaches the banks.

For households, the new framework should change one habit: treat a suspicious debit as a five-day emergency, not a matter to sort out next week. Save the bank's fraud number and 1930 in your phone, tell elderly relatives about 1930, and agree on one family rule that nobody approves a payment or installs an app on the strength of a phone call alone.

This post is general information, not legal advice for any individual case. The immediate steps above need no one's help: call the bank, call 1930, file at cybercrime.gov.in, and do it today, not after the framework starts.