Lost money online? RBI's five-day rule from 2027

Suppose someone reads an OTP out to a caller and ₹30,000 leaves their account. Until now, what happened next depended largely on the bank's own policy. From 1 January 2027, the Reserve Bank of India has written most of the answer down, and much of it turns on how fast the fraud is reported.

What changed and when

On 24 June 2026 the Reserve Bank of India issued amendment directions on its framework for limiting customer liability in digital transactions (press release 2026-2027/533). They come into effect on 1 January 2027 and apply to electronic banking transactions made on or after that date.

Parallel directions were issued for commercial banks, small finance banks, payments banks, local area banks, regional rural banks, urban co-operative banks and rural co-operative banks. This article follows the text for commercial banks (RBI/2026-27/167).

The framework now covers fraudulent electronic banking transactions, not only unauthorised ones: a transaction executed by a third party using credentials obtained from the customer through fraud, a transaction approved under coercion, and a transaction the customer never authorised.

Who carries the loss

Bank negligence: zero liability for the customer and a reversal, whether or not the customer reports it. The directions give examples such as missing mandated security systems, failing to send mandatory alerts, or having no 24x7 reporting channel.Third-party breach: zero liability if the customer reports it to the bank within five calendar days of the transaction. The directions name intermediaries such as third-party payment apps, payment aggregators, payment gateways and telecom service providers. Reported later, liability follows the bank's own policy.Customer negligence: the customer bears the loss until the fraud is reported. Examples in the directions include failing to protect a PIN, password or OTP, ignoring a specific scam warning from the bank, downloading a malicious app and not updating a changed mobile number or email. Any loss after reporting falls on the bank.

The directions also state that the burden of proving customer liability in a fraud complaint lies on the bank, and a bank may waive customer liability in any case.

The clock that matters is five calendar days. Report on the day it happens, not the day you are sure.

Compensation for small frauds

For losses that fall on the customer because of their own negligence, the directions add a one-time compensation mechanism.

Who can claim: a bona fide individual victim, including a sole proprietor, whose gross loss is up to ₹50,000.How much: 85% of the net loss or ₹25,000, whichever is less, once in a lifetime. On a joint account, only one holder can claim.The condition: the fraud must be reported both to the bank and on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or helpline 1930, within five calendar days.Payment: once the bank finds the claim bona fide it provides the application form, and it pays within five calendar days of receiving the completed application. If money is recovered later, the compensation is recalculated and any additional amount due is paid.The window: the mechanism covers frauds that occur up to one year from the date the directions take effect.

A worked example: a loss of ₹20,000 with ₹5,000 recovered leaves a net loss of ₹15,000, and 85% of that is ₹12,750. On a net loss of ₹40,000, 85% would be ₹34,000, so the ₹25,000 cap applies.

What the bank must do

Alerts: an instant SMS for every electronic banking transaction above ₹500, and email alerts where an email address is registered, each showing details such as the amount, date, time, channel and beneficiary.Reporting channels: 24x7 channels, a number in the alert SMS for an immediate objection, a direct fraud-reporting link on the website home page and in the app, and an immediate acknowledgement with a complaint number, date and time.Resolution: within the bank's own timeline, but no later than 45 calendar days for domestic and 60 calendar days for cross-border fraudulent transactions. Reversals are value-dated to the original transaction date, and credit card frauds get a provisional shadow credit within five calendar days of the customer's report.Rejections: a bank that rejects a complaint must give its reasons and the supporting details.

What to do the day it happens

Report to your bank first through its 24x7 channel or the fraud-reporting link, and keep the complaint number with its date and time.Report on 1930 or cybercrime.gov.in the same day. The compensation mechanism needs both reports within five calendar days, and speed is what makes a freeze on the receiving accounts possible.Keep the trail: the alert SMS, transaction references, and the messages or call details that led to the fraud.Keep your mobile number and email updated with the bank. Failing to update them after a change is listed as customer negligence.

This article summarises the directions and is not legal advice. The directions themselves, linked below, are the authority.

Questions people ask

What is RBI's five-day rule for online fraud? Under RBI directions effective 1 January 2027, a customer has zero liability for a fraudulent electronic banking transaction caused by a third-party breach if it is reported within five calendar days of the transaction. The one-time compensation for small frauds also requires reporting to the bank and on 1930 or cybercrime.gov.in within five calendar days.

How much compensation can I get if I shared my OTP? If you are a bona fide individual victim and the gross loss is up to ₹50,000, the mechanism pays 85% of the net loss or ₹25,000, whichever is less, once in a lifetime, provided you reported to the bank and on 1930 or cybercrime.gov.in within five calendar days. It covers frauds occurring up to one year from 1 January 2027.

How long does a bank have to resolve a fraud complaint? No more than 45 calendar days for domestic and 60 calendar days for cross-border fraudulent transactions, counted from receipt of the complaint. Reversals are value-dated to the original transaction date.

From DunimeInstalled an app before the money moved? Yantrix checks a phone for spyware and remote-access implants.→