The new rules, issued through amendments to the RBI’s Responsible Business Conduct Directions, will apply to electronic banking transactions undertaken from January 1, 2027.
The revised framework expands customer safeguards across internet banking, mobile banking, card transactions and other electronic banking channels amid a rise in digital payment frauds.
Burden of proof shifts to banks
In a significant shift, the RBI has placed the burden of proving customer liability on banks.
“The burden of proving customer liability in complaints involving fraudulent electronic banking transactions shall lie on the bank,” the central bank said.
Customers will enjoy zero liability where fraud occurs because of negligence or deficiency on the part of the bank. The RBI has defined bank negligence broadly to include security failures, system malfunctions, internal frauds, failure to send mandatory alerts, inadequate reporting channels and delays in acting on customer complaints.
Customers will also be entitled to zero liability in cases involving third-party breaches if the unauthorised transaction is reported within five calendar days of its occurrence.
Compensation for small-value fraud victims
One of the most notable changes is the introduction of a compensation framework for victims of small-value fraudulent electronic banking transactions.
Individual customers, including sole proprietors, who suffer losses of up to ₹50,000 due to fraudulent transactions and meet prescribed conditions will be eligible for compensation amounting to 85% of the net loss, subject to a maximum payout of ₹25,000.
Also Read: RBI proposes tighter oversight of AI and algorithms in financial firms
To qualify, customers must report the fraud both to their bank and through the National Cyber Crime Reporting Portal or Cyber Crime Helpline (1930) within five calendar days of the transaction. The compensation benefit can be availed only once during a customer’s lifetime.
The compensation mechanism will be funded jointly by the RBI, the customer’s bank and, in domestic fraud cases, the beneficiary bank. For eligible domestic frauds, the RBI will bear the largest share of the compensation, while the customer and beneficiary banks will contribute the balance amount.
Faster alerts, reporting and reversals
The RBI has also tightened customer notification requirements. Banks must send instant SMS alerts for all electronic banking transactions exceeding ₹500 and email alerts for all transactions wherever customers have registered email addresses. These alerts must include key details such as the transaction amount, date, time, channel and beneficiary information.
Banks will be prohibited from charging customers for regulatory SMS alerts.
To facilitate quicker reporting of frauds, banks will be required to provide round-the-clock reporting channels, including phone banking, SMS, email, IVR systems, toll-free numbers and digital reporting facilities. Direct links for reporting fraudulent transactions must also be prominently displayed on bank websites and mobile applications.
Further, every fraud complaint must be acknowledged immediately with a complaint number and timestamp.
Also read: RBI’s new NBFC norms keep Tata Sons listing question alive
The RBI has also prescribed strict timelines for complaint resolution. Banks must determine liability and resolve domestic fraud complaints within 45 calendar days and cross-border fraud complaints within 60 calendar days.
Where customers are entitled to a reversal, banks must ensure that it is value-dated to the original transaction date so that customers do not suffer any loss of interest or incur additional charges. For fraudulent credit card transactions, banks must provide a “shadow reversal” within five days of receiving customer notification.
