Summary of this article
RBI rules define when banks must refund money lost to online fraud.
New rules from January 2027 expand protection and shift proof burden.
Customers must report fraud promptly to determine liability and compensation.
A recent data breach at SBI has drawn attention to the safety of customer information. The bank has described the number of affected customers as very small and maintained that customer balances are safe.
Online banking fraud can also involve transactions that customers have not approved, even when they have not shared or entered a one-time password (OTP). The Reserve Bank of India (RBI) has rules covering customer liability, bank responsibility and compensation in such cases.
Can Banks Be Held Responsible For Fraud
Banks can be held responsible when their failure to follow required security procedures leads to an unauthorised transaction. This includes inadequate authentication, ignored fraud alerts or gaps in security systems that allow the payments.
Disbursing a loan or credit card without the customer’s consent can also raise issues of unauthorised activity. The bank’s responsibility depends on the circumstances of the transaction and the applicable rules.
RBI Rules On Fraud Reporting And Customer Liability
Under the framework introduced by RBI in 2017, customers have zero liability when an unauthorised transaction results from the bank’s own negligence. Zero liability also applies to third-party breaches when customers report the transaction within three working days of receiving communication from the bank.
When a third-party breach is reported within four to seven working days, customer liability is capped at Rs 5,000 to Rs 25,000, depending on the account type. For reports made after seven working days, the bank’s approved policy applies.
The Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026, are scheduled to take effect on January 1, 2027. This revised framework has widened the reporting period for zero liability in eligible third-party fraud cases to five calendar days. It also broadens the coverage of fraudulent transactions and places the burden of proving customer liability on the bank.
Under the revised directions, banks will have 45 days to resolve domestic cases and 60 days for cross-border cases. Compensation for eligible small-value frauds will be 85 per cent of the loss or Rs 25,000, whichever is less.
Steps To Report Online Banking Fraud
Customers can report fraudulent transactions through their bank’s official app, helpline or branch. The bank should provide an acknowledgement of the complaint. Customers can also report cyber fraud by calling 1930 or visiting cybercrime.gov.in.
The reporting process can include submitting transaction details and relevant records to support the investigation. A police complaint may also form part of the process.
When Banks Must Refund The Lost Amount
When a fraudulent transaction results from the bank’s negligence, the customer is entitled to a full reversal under the applicable liability rules, regardless of the reporting delay.
If the loss results from the customer’s negligence, such as sharing an OTP or PIN, the customer may be liable until the fraud is reported to the bank. A data breach alone does not automatically establish a customer’s right to compensation. Liability depends on the circumstances of the transaction and the applicable RBI rules.
