Lost money to online fraud? RBI's new refund rules from 1 January 2027, explained

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

From 1 January 2027 you get zero liability if you report a third-party fraud within five calendar days, faster bank deadlines, and a one-time compensation of up to ₹25,000 even if you were tricked into sharing an OTP.

01 / What is changing, and when

On 24 June 2026 the Reserve Bank of India issued amendment directions that rewrite how banks must handle fraudulent electronic banking transactions: UPI, cards, net banking and other digital payments. The rules apply to transactions made on or after 1 January 2027. For anything before that date, the older 2017 rules still decide your case.

The changes apply to commercial banks, small finance banks, payments banks, regional rural banks, urban and rural co-operative banks and local area banks. RBI says they widen the old rules to cover more kinds of fraud, cut the time banks take to deal with complaints, and add compensation for small frauds.

02 / Report within five calendar days

The most important number is five calendar days. Under the new rules you owe nothing if the fraud happened because of your bank's negligence, whenever you report it. You also owe nothing if a third party caused it, neither you nor the bank was at fault, and you tell your bank within five calendar days of the transaction. Report later than that and the bank's own policy decides how much of the loss you bear.

RBI's text lists what counts as bank negligence, including not sending transaction alerts, not offering 24x7 channels to report fraud, not acting diligently on your complaint, and system failures, security lapses or internal fraud at the bank.

03 / If you were tricked: one-time compensation

Under the 2017 rules, if you shared your PIN or OTP you usually bore the whole loss until you reported it. That is still the starting point: RBI's new text says a customer whose negligence led to the fraud, such as not taking reasonable care of a PIN, password or OTP, is liable until they report it. But it adds a new safety net for small losses.

• Who: an individual, including a sole proprietor.
• How much: for a gross loss of up to ₹50,000, 85% of the net loss (after any money recovered) or ₹25,000, whichever is less.
• How often: once in your lifetime.
• Conditions: the bank must find the loss genuine under its policy, and you must report the fraud to your bank and on 1930 or cybercrime.gov.in within five calendar days.
• Payment: the bank gives you an application form and must pay within five calendar days of receiving it. For domestic frauds RBI funds 65% of the compensation, and your bank and the bank that received the money 10% each.

04 / Faster deadlines for banks

• Banks must settle complaints about fraudulent transactions within 45 calendar days, or 60 for cross-border transactions. Under the 2017 rules the limit is 90 days.
• For a credit card fraud, the bank must reverse the disputed amount on your card (a shadow reversal) within five calendar days of your complaint.
• The burden of proving that you are liable stays with the bank.

05 / Until 31 December 2026: the old rules

For transactions up to 31 December 2026, RBI's 2017 circular applies. You owe nothing for a third-party fraud reported within three working days of the bank's alert. Report within four to seven working days and your loss is capped at between ₹5,000 and ₹25,000 depending on the account, or the transaction amount if lower. After that the bank's policy applies. Banks must credit the disputed amount within 10 working days of your report and settle the complaint within 90 days. We explain the caps in full on our help page.

06 / What to do the moment money goes

1. Call 1930 and report the fraud, then complete the complaint on cybercrime.gov.in. How to report.
2. Call your bank's fraud line and block your card, UPI and net banking. Official numbers for 20 banks.
3. Send the bank a written complaint with each transaction's date, amount and reference, and keep the complaint number.
4. Keep your 1930 or cybercrime.gov.in acknowledgement: from 2027 you need it for compensation.
5. If the bank does not reply in time or you disagree, go to the RBI Ombudsman within 90 days. How to complain.