RBI Fraud Rules: ₹25,000 Back From 2027

RBI’s New Bank Fraud Rules From 1 January 2027: Up to ₹25,000 Compensation, SMS Alerts Above ₹500 and a 5-Day Reporting Window

If money disappears from your bank account because of digital fraud, the Reserve Bank of India’s revised customer-protection rules could make a significant difference. From 1 January 2027, new directions will apply to electronic banking transactions, introducing a compensation mechanism for eligible small-value frauds, clearer rules on customer liability and mandatory SMS alerts for transactions above ₹500.

One important point: ₹25,000 is the maximum compensation under a specific scheme, not a guaranteed refund for every person who loses money to a scam. Your eligibility, the type of fraud, the amount lost and how quickly you report it all matter.

Here is what bank customers need to know before the new rules take effect.

1 What changes from 1 January 2027?

The revised directions cover electronic banking transactions undertaken by customers on or after 1 January 2027.

The main provisions include:

Compensation of up to ₹25,000 for eligible small-value electronic banking frauds.
A gross-loss limit of ₹50,000 for claims under the small-value compensation mechanism.
Mandatory instant SMS alerts for electronic banking transactions above ₹500.
A requirement to report eligible frauds to the bank and the National Cyber Crime Reporting Portal or helpline within five calendar days to qualify for the specified compensation.
Greater clarity on how banks assess customer liability and handle fraud complaints.

These are provisions of the revised RBI directions, not a promise that every disputed transaction will automatically be refunded.

2 Who can receive up to ₹25,000?

Under the new framework, a bona fide individual victim with a qualifying fraudulent electronic banking transaction involving a gross loss of up to ₹50,000 may receive compensation.

The compensation is calculated as 85% of the net loss or ₹25,000, whichever is lower. Recoveries are deducted when calculating the net loss.

The scheme is subject to the RBI’s eligibility conditions and is available once during a person’s lifetime.

How much could you receive?

Eligible net loss	85% of net loss	Maximum scheme compensation
₹5,000	₹4,250	₹4,250
₹10,000	₹8,500	₹8,500
₹20,000	₹17,000	₹17,000
₹30,000	₹25,500	₹25,000
₹50,000	₹42,500	₹25,000

These examples assume the loss is eligible, established as bona fide and calculated after accounting for recoveries. The final amount depends on the applicable rules and the bank’s assessment.

Remember: The ₹25,000 cap does not mean that everyone who loses ₹50,000 will receive ₹25,000. The fraud must meet the scheme’s conditions.

3 What if you were tricked into sending money?

This is one of the most important distinctions for people affected by digital scams.

Fraud can happen in different ways. A criminal may obtain your credentials and initiate a transaction, misuse a banking weakness, or deceive you into approving a payment or sending money to someone posing as a legitimate recipient.

These situations may be treated differently under the RBI framework.

The fact that you were deceived does not, by itself, guarantee compensation. Some transactions that customers approve after being tricked are classified differently from transactions that were never authorised by the customer. The applicable category and eligibility rules therefore matter.

If you have been scammed:

Report the transaction to your bank immediately.
Call the National Cyber Crime Helpline at 1930.
File a complaint at the National Cyber Crime Reporting Portal.
Preserve transaction IDs, bank messages, screenshots, phone numbers, chat records and complaint acknowledgements.
Ask your bank to register the complaint and explain the applicable customer-liability and compensation provisions.

Do not wait until the new rules begin in January 2027 to report a fraud. Immediate reporting can help your bank take steps to restrict further losses and may improve the chances of tracing or recovering funds.

4 Why the five-day reporting window matters

To qualify for the specified small-value fraud compensation, an eligible victim must report the incident to both the bank and the National Cyber Crime Reporting Portal or helpline within five calendar days of the transaction.

Calendar days are not the same as working days. Weekends and public holidays can fall within this period.

For example, if a qualifying fraudulent transaction occurs on Monday, do not assume you can wait until the following Monday. Report it as soon as you discover it.

What should you do first?

First: Contact your bank through its official app, website or customer-care number.
Second: Call 1930 and report the cybercrime.
Third: Submit the complaint at cybercrime.gov.in and keep the acknowledgement details.
Fourth: Request that the bank block or secure the affected payment instrument, account access or other compromised facility, as appropriate.
Fifth: Follow up with the bank using your complaint reference number.

The five-day condition relates to the specified compensation mechanism. It should not be interpreted as permission to delay reporting other kinds of fraud.

5 SMS alerts for transactions above ₹500

From 1 January 2027, banks covered by the revised directions must send instant SMS alerts for electronic banking transactions exceeding ₹500.

For transactions of ₹500 or less, the directions allow banks to decide whether to send instant SMS alerts under their internal policies. Email alerts are also required where the customer has provided an email address, in accordance with the applicable directions.

These alerts can help customers spot transactions they did not make or approve.

What should you check in your bank account now?

Confirm that your current mobile number is registered with your bank.
Update your email address if it has changed.
Check that transaction alerts are enabled wherever the bank offers them.
Read debit alerts promptly, including those for small payments.
Never share an OTP, UPI PIN, card PIN or internet-banking password with anyone claiming to be from your bank.

An SMS alert is a warning mechanism, not a guarantee that every fraud will be prevented. If a transaction looks suspicious, contact your bank immediately using an official channel.

6 Will banks have to prove that the customer was responsible?

The revised framework places the burden of proving customer liability on the bank when it assesses complaints involving fraudulent electronic banking transactions.

This is significant because customers should not have to rely solely on a verbal explanation that they were responsible for a disputed transaction. The bank must assess the complaint under the applicable categories and rules.

However, this does not mean that every complaint must be decided in the customer's favour. The facts, transaction type, evidence and relevant liability provisions still matter.

When filing a complaint, ask the bank to provide:

A complaint or service-request number.
Details of the disputed transactions.
The action taken to prevent further unauthorised transactions.
The basis for its decision on customer liability.
The applicable compensation or reversal provisions.
The process for escalating the complaint if you disagree with the outcome.

Keep copies of the bank’s responses and any documents you submit.

7 What if the bank rejects your complaint?

Start by requesting a written explanation and the supporting details for the decision. If you believe the bank has not addressed the complaint properly, use its formal grievance-redressal process.

If the matter remains unresolved, you may be able to approach the RBI through the Complaint Management System, subject to the applicable eligibility requirements and timelines.

Do not assume that filing a complaint with the RBI automatically guarantees reimbursement. The appropriate remedy depends on the facts, the bank’s response and the applicable rules.

For cybercrime reporting, use cybercrime.gov.in or call 1930. These channels serve a different purpose from the RBI’s banking grievance mechanism.

8 Do the new rules apply to frauds that happened before January 2027?

The revised directions state that they apply to electronic banking transactions undertaken on or after 1 January 2027.

Therefore, customers should not assume that the new compensation scheme automatically applies to transactions carried out before that date. Earlier incidents must be assessed under the rules applicable to those transactions and the facts of the case.

The RBI already has a framework for limiting customer liability in unauthorised electronic banking transactions. Under the existing framework, the outcome can depend on factors such as bank negligence, third-party breaches, customer negligence and how quickly the incident is reported.

For an older incident, consult the RBI’s customer-protection directions on unauthorised electronic banking transactions and ask your bank which provisions apply.

9 A practical checklist for every bank customer

You do not need to wait until January 2027 to improve your protection against digital fraud.

Confirm that your registered mobile number is correct.
Keep your bank’s official fraud-reporting number accessible.
Save 1930 in your phone.
Bookmark cybercrime.gov.in.
Review bank alerts and statements regularly.
Never share OTPs, PINs or passwords.
Do not install remote-access apps at the request of an unknown caller.
If money is lost, report it immediately and retain every complaint reference.
For a qualifying incident from 1 January 2027, ensure that the bank and cybercrime reporting requirements are met within five calendar days if you want to claim the specified compensation.

Frequently Asked Questions

Is ₹25,000 guaranteed if I lose money in an online scam?

No. It is the maximum compensation under a specific scheme for eligible small-value frauds. The scheme covers qualifying gross losses up to ₹50,000, pays 85% of the net loss or ₹25,000, whichever is lower, and is subject to conditions.

Does the compensation apply if I shared an OTP?

Not automatically. The facts and the applicable transaction category matter. If you were deceived into sharing credentials or approving a payment, report the incident immediately and ask the bank to assess the complaint under the revised directions. Do not assume that sharing an OTP either automatically disqualifies you from every remedy or guarantees compensation.

Do I have five working days to report the fraud?

No. The specified compensation condition refers to five calendar days, not five working days. Report the fraud as soon as possible.

Will I receive an SMS for every transaction below ₹500?

The revised directions make instant SMS alerts mandatory for electronic banking transactions above ₹500. For transactions of ₹500 or less, the bank may decide whether to send instant SMS alerts under its internal policy.

When do the revised rules begin?

They apply to electronic banking transactions undertaken on or after 1 January 2027.

The bottom line

The RBI’s revised bank-fraud directions introduce a compensation mechanism of up to ₹25,000 for eligible small-value frauds, mandatory SMS alerts for electronic banking transactions above ₹500 and a five-calendar-day reporting condition for the specified compensation.

The most useful step is still immediate action: contact your bank, report cybercrime through 1930 or the official portal, and preserve the evidence. Quick reporting can help limit further losses and protect your ability to pursue the remedies available under the applicable rules.

Sources for further reading