Explainer · Banking

Money lost to online fraud: who pays it back from 1 January

Swami GuruPublished 4 min read
A yellow umbrella held over a piggy bank while a fishing hook tries to pull a coin out of its slot
5 days
to report the fraud to 1930 and your bank, or lose cover
Rs 25,000
the most the small-fraud scheme pays, once in your life
45 days
the longest your bank can take to settle a domestic fraud claim
Last checked
Next check
Read from5 sources

In one line

From 1 January 2027, if your bank was at fault you get every rupee back. If you were tricked into handing over an OTP, a loss of up to Rs 50,000 gets you 85% back, capped at Rs 25,000, once in your life, but only if you report it within five days.1

Does this apply to you?

Find yourself in the list.

Your bank was at fault
Check

A missing alert, a broken system, a breach or insider fraud at the bank isn't on you. You get the full amount back, whether you reported it or not.1

A breach somewhere else, not you or the bank
Act now

Full refund, but only if you report it within five calendar days. After that, the bank's own policy decides.1

You shared an OTP or installed a scam app
You pay

The loss is yours up to the moment you report it. If it's Rs 50,000 or less, you can claim 85% back, up to Rs 25,000, once.1

You lost more than Rs 50,000 by being tricked
You pay

The compensation scheme doesn't cover you. You're left with the bank's recovery process and the police complaint.3

The fraud happens before 1 January 2027
No change

The old 2017 rules still apply, and they don't cover payments you were deceived into making.4

What the rule actually says

The plain version first, then the line from the primary document.

In plain words
For the first time, a payment you were tricked or pressured into counts as fraud, not just one you never touched.1
The document saysRBI Directions, 24 June 2026: a fraudulent transaction includes one "executed by a third-party using the credentials obtained from the customer through fraudulent means," and one made under coercion or duress.
In plain words
The bank has to show you were careless. You don't have to prove you weren't.1
The document says"The burden of proving customer liability in complaints involving fraudulent EBTs shall lie on the bank."
In plain words
Small losses get most of the money back even when the bank says it was your fault. RBI itself pays 65% of it.21
The document saysCompensation is "85 per cent of the net loss amount" or Rs 25,000, "whichever is less," for a loss of up to Rs 50,000, once in a lifetime.

What the small-fraud scheme pays back

These are cases where the bank decides you were careless. You must report to 1930 or cybercrime.gov.in and to your bank within five calendar days, or the scheme pays nothing. If the bank was at fault, you get the whole amount back instead.

You get back
  • Rs 10,000, nothing recoveredRs 8,500
    85% of net loss
  • Rs 40,000, bank recovers Rs 15,000Rs 21,250
    85% of the Rs 25,000 still missing
  • Rs 30,000, nothing recoveredRs 25,000
    85% is Rs 25,500, so the cap applies
  • Rs 50,000, nothing recoveredRs 25,000
    Capped
  • Rs 60,000, nothing recoveredRs 0
    Above Rs 50,000, outside the scheme
  • Your second fraud, any amountRs 0
    Once in a lifetime
Coins falling from a cracked piggy bank into a yellow basket, with a few rolling away past it

What to do

  1. Save 1930 and your bank's fraud number in your phone, and in your parents' phones. The five-day clock starts on the day of the fraud, not the day you notice it.
  2. Check that your bank has your current mobile number and email. Not updating them counts against you as negligence.1
  3. If money goes, report it to your bank and to 1930 or cybercrime.gov.in the same day. Note the complaint number the bank has to give you on the spot.
  4. Credit card fraud: ask for a shadow reversal. The bank has to put the disputed amount back on your card, on hold, within five calendar days while it investigates.
  5. If the bank turns you down, it has to give reasons and supporting details. Get them in writing before you escalate.

The fine print

  • The Rs 25,000 can be claimed once in your life. On a joint account, only one holder can ever use it.1
  • The scheme covers frauds in its first year only, so up to 31 December 2027. RBI hasn't said what happens after that.1
  • Ignoring a specific scam warning from your bank, or downloading a malicious app, is listed as customer negligence. Read the warnings your bank sends.1
  • The 45-day limit has no penalty attached if a bank misses it. Payments banks follow the same refund rules, but their version has no shadow-reversal clause.2

What we don't know yet

  • How banks will classify a digital arrest case. The rules count a payment made under pressure as fraud, but don't say whether that's customer negligence. Those losses usually run into lakhs, well past the Rs 50,000 limit.
  • What the Supreme Court adds. On 29 October it said banks should compensate victims where a due-diligence lapse enabled the fraud, and asked RBI to notify new KYC rules by 30 November.45 Whether any of that changes these rules before 1 January isn't known.
  • Whether the compensation scheme is extended or widened after its first year.

Our take

This is the first time RBI has put in writing that a payment you were tricked into making is fraud, and that the bank, not you, has to prove you were careless. That's a real shift, and bank-side failures like a missing SMS alert now mean a full refund with no argument. The compensation scheme is the weaker half. Rs 25,000, once in your life, for losses under Rs 50,000 helps someone who loses a month's rent to a fake delivery link. It does nothing for someone who loses lakhs to a fake police officer on a video call, and those are the cases the Supreme Court is angry about. I'd like RBI to take the court's hint and widen it. Until then, report within five days, because almost everything in these rules hangs on it.5

Change log

10 Nov 2026Re-checked against the sources. No change.
3 Nov 2026First draft. Checked against RBI's (Commercial Banks - Responsible Business Conduct) Third Amendment Directions, 2026, dated 24 June 2026.
Next check10 Dec 2026, or sooner if the rules change.

Sources

  1. RBI, Commercial Banks Responsible Business Conduct Third Amendment Directions, 24 June 2026
  2. RBI, Payments Banks Responsible Business Conduct Second Amendment Directions, 24 June 2026
  3. Upstox, seven points from the new RBI fraud rules
  4. MediaNama, 30 Oct 2026, Supreme Court on bank compensation
  5. Outlook Money, 30 Oct 2026
More in Fine Print