In a significant move to protect ordinary bank customers from the growing menace of digital payment fraud, Reserve Bank of India (RBI) has proposed a structured compensation mechanism under which individual victims of small-value electronic banking fraud could recover up to 85% of their loss, subject to a ceiling of ₹25,000, even in cases where the fraud occurred partly due to the customer's own negligence or was carried out by a third party.
The proposed framework is particularly noteworthy because it places the burden of proving customer liability squarely on the bank, not the customer and makes RBI a direct financial contributor to fraud compensation for the first time, bearing the largest share of the payout.
The compensation mechanism proposed by RBI applies to individual customers who suffer losses of up to ₹50,000 on account of fraudulent electronic banking transactions in two specific situations: cases where the fraud occurred due to a third-party breach (meaning neither the bank nor the customer was directly at fault) and cases where the customer was negligent.
To qualify, the victim must satisfy two conditions. First, the loss must be established as genuine and bona fide through the bank's internal processes. Second, the customer must have reported the fraud both to the national cybercrime reporting portal (cybercrime.gov.in) or the national cybercrime helpline (1930) and to the bank within five calendar days of the fraudulent transaction.
If both conditions are met, the customer is entitled to receive 85% of the net loss amount calculated after deducting any recoveries already made or ₹25,000, whichever is lower. This compensation is available only once in a customer's lifetime. In the case of joint accounts, only one account holder may claim, and doing so disqualifies that person from claiming again as an individual account holder in future, and vice versa.
One of the most significant aspects of the proposal is how compensation costs are shared. For losses below ₹29,412, where the 85% compensation formula applies, RBI bears 65% of the compensation amount, while the customer's bank and the beneficiary bank (the bank that received the fraudulently transferred funds) each contribute 10%.
For losses between ₹29,412 and ₹50,000, where the compensation is capped at ₹25,000, RBI contributes ₹19,118, while the customer's bank and the beneficiary bank each contribute ₹2,941.
The draft directions provide detailed worked illustrations to clarify how recoveries made after compensation is paid are to be apportioned between the customer, the RBI, and the two banks. Banks are required to seek reimbursement of the RBI's share on a quarterly basis.
To understand the practical implications, consider a scenario where a customer loses ₹40,000 to a scam and ₹15,000 is recovered before the compensation is paid. The net loss is ₹25,000. The customer receives ₹21,250 (85% of ₹25,000), with RBI contributing ₹16,250 and each bank contributing ₹2,500.
Zero Liability for Bank-Side Failures
Beyond the compensation mechanism, the draft directions significantly strengthen customer protections across the board. Where a fraudulent transaction occurs due to the bank's own negligence, including failure to maintain mandated security systems, failure to send transaction alerts, failure to provide reporting channels, or internal fraud, the customer is entitled to zero liability and full reversal of the transaction, regardless of whether the customer even reported it.
The draft defines bank negligence broadly to include failing to put in place mandated systems and procedures, failing to send mandatory transaction alerts, failing to act diligently on customer notifications, and system malfunctions or security breaches.
Similarly, if a third-party breach involving intermediaries such as payment aggregators, payment gateways, third-party application providers, or telecom service providers is reported to the bank within 5 calendar days, the customer again faces zero liability and is entitled to a full reversal.
Burden of Proof Shifts to Banks
The draft directions explicitly state that the burden of proving customer liability in fraud complaints will lie on the bank. Banks will be required to examine and classify each complaint, establish liability, and communicate a response to the customer within 30 calendar days of receiving the complaint, failing which the customer's case is effectively strengthened.
Where a transaction is to be reversed, the bank must ensure the reversal is value-dated to the original transaction date, so that the customer does not suffer any loss of interest or incur additional interest charges.
In cases where the bank rejects a complaint and establishes customer liability, it must disclose the reasons for rejection, along with supporting evidence, including logs for OTP, SMS, and transactions.
When the Customer Bears the Loss
The draft is equally clear about situations where the customer will be held liable. Customer negligence is defined to include sharing credentials such as PIN, password, or OTP with another person, whether intentionally or otherwise; failing to notify the bank promptly after discovering a fraud; ignoring specific and clear warnings from the bank that a transaction is likely a scam; failing to exercise reasonable care with credentials; and downloading malicious applications.
In such cases, the customer bears the loss until the point of reporting the fraud to the bank. Any further losses after that point are the bank's responsibility.
Mandatory Alerts and Reporting Infrastructure
The draft also tightens banks' obligations around transaction alerts. Banks will be required to send instant SMS alerts for all electronic banking transactions above ₹500. For transactions of ₹500 or below, banks may decide their own SMS policy. Email alerts must be sent for all electronic banking transactions wherever the customer has provided an email address.
Banks must also provide 24x7 access for customers to report fraud through multiple channels, including phone banking, SMS, email, IVR, a dedicated toll-free helpline, and home branch visits. A direct link for reporting fraudulent transactions must be placed on the bank's homepage. Transaction alert SMSes must themselves carry a number to which the customer can immediately reply to flag an objection.
Additionally, banks will no longer be allowed to charge customers for SMS alerts sent in compliance with regulatory requirements or for promotional and customer awareness purposes.
A Compensation Window of One Year
RBI has clarified that the compensation mechanism will be available for fraudulent transactions occurring within one year from the effective date of the directions, that is, up to 30 June 2027. This suggests the framework is being introduced as a transitional measure, with the longer-term intent likely being to reduce fraud incidence through stronger bank-side security rather than rely indefinitely on a compensation fund.
Digital payment fraud in India has grown sharply in recent years, with RBI data indicating tens of thousands of reported cases annually resulting in significant financial losses to individuals. The existing framework left many victims, particularly those who had been tricked or coerced, with little or no recourse, especially when banks argued that customer negligence broke the chain of liability.
The proposed directions represent a meaningful shift in that dynamic. By making RBI a direct financial stakeholder in fraud compensation, explicitly defining bank negligence, shifting the burden of proof to banks, and creating a time-bound, process-driven compensation mechanism, RBI is signalling that the cost of inadequate fraud prevention should not fall primarily on the customer.
Public comments on the draft are being sought before the directions are finalised for implementation from 1 July 2026. Comments or feedback on the draft amendment directions may be submitted by the regulated entities and members of public and other stakeholders on or before 6 April 2026 through
RBI's website.
