7 most important points from new RBI rules to help online fraud victims from January 1, 2027

The Reserve Bank of India (RBI) on June 24, 2026 issued revised directions titled the Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Third Amendment Directions, 2026. These directions will apply to electronic banking transactions (EBTs) undertaken by customers of banks on or after January 1, 2027.

The directions are primarily aimed at strengthening customer protection and ensuring fair conduct by banks in their dealings with customers during electronic banking transactions (EBTs), including fraudulent EBTs.

Here are the seven most important points from the new RBI rules to help online fraud victims:

1. Policy covering customer protection in EBTs Banks will formulate a policy covering various aspects of customer protection in EBTs, including:

• Channels for alerting customers about EBTs and reporting fraudulent EBTs.
• The rights and obligations of customers in case of EBTs, including fraudulent EBTs, after taking into account risks arising from customer negligence or bank negligence.
• Timelines for complaint resolution and disclosures to customers.
• Mechanisms for creating customer awareness about their rights and obligations in EBTs, along with the associated risks.

2. Security and fraud prevention

Banks will design their systems and procedures to make customers feel safe while carrying out EBTs. To achieve this, banks are required to strengthen digital payment security, proactively detect and prevent fraud, and assess risks arising from unauthorised electronic transactions.

3. Alerts for electronic banking transactions For all EBTs, other than ATM cash withdrawals, banks will mandatorily obtain customers' mobile numbers and email addresses. For EBTs exceeding ₹500, banks will mandatorily send an instant SMS alert to the customer. For transactions up to ₹500, banks may decide to send instant SMS alerts as per their internal policy, but without charging the customer. "Further, such transaction alerts shall contain relevant details pertaining to the EBT such as account/card number, amount, date, time, transaction channel, beneficiary/point of transaction, etc.," the RBI directions says.
4. Reporting of fraudulent EBTs The customers can report any fraudulent EBT to their bank and also lodge a complaint through the National Cyber Crime Reporting Portal or the National Cyber Crime Helpline (1930) at the earliest. Also, as any delay in reporting fraud to the bank may increase the risk of loss to both the customer and the bank, the bank will: Provide customers with 24x7 access through channels such as phone banking, SMS, instant messaging, a dedicated email address, IVR, a dedicated toll-free helpline, and reporting through the home branch. Provide a number in the transaction alert SMS itself, enabling customers to immediately send an SMS to notify their objection, if any. Provide a direct link on the homepage of their website and mobile application, wherever available, for reporting fraudulent EBTs.
5. Processing of complaint and liability determination As per the directions, the burden of proving customer liability in complaints involving fraudulent EBTs shall lie with the bank. The directions also clarify circumstances under which liability rests with the customer or the bank.

1. Zero liability in case of bank negligence A customer will be entitled to zero liability and reversal of the transaction where the fraudulent EBT occurs due to negligence or deficiency on the part of the bank, irrespective of whether the transaction is reported by the customer.

2. Zero liability for third-party breaches reported within five days A customer will be entitled to zero liability and reversal of the transaction in cases of a third-party breach if the unauthorised fraudulent EBT is reported to the bank within five calendar days from the date of occurrence.

3. In cases of third-party breaches reported after five calendar days, the customer's liability will be determined as per the bank's policy.

4. Customer liability in case of negligence Where the fraudulent EBT occurs due to negligence by the customer, the customer will be liable for the loss incurred, to the extent of the loss not eligible for compensation. Further, any loss arising from unauthorised transactions occurring after the customer has reported the fraudulent EBT to the bank will be borne by the bank. A bank may also, at its discretion, waive customer liability in cases of fraudulent EBTs.

6. Complaint resolution timeline Banks will be required to examine the fraudulent EBT, establish liability, and issue a response to the customer within 45 calendar days from the date of receipt of the complaint. In the case of cross-border fraudulent EBTs, the bank's response must be sent within 60 days of receiving the complaint. Where a bank is required to reverse a fraudulent EBT, it must ensure that the reversal is value-dated to the original date of occurrence so that the customer does not suffer any loss of interest or incur additional interest or charges. In cases where a complaint is rejected and customer liability is established, the bank must disclose the reasons for rejection, along with supporting details, if any.
7. Compensation for small-value fraudulent transactions As per the revised directions, a bona fide victim who has lodged a complaint involving a gross loss of up to ₹50,000 due to a fraudulent EBT will be compensated 85% of the net loss amount, or ₹25,000, whichever is lower. This benefit can be availed only once during the victim's lifetime and is subject to the following conditions: (a) The loss is established to be bona fide; and (b) The victim has reported the fraudulent EBT(s) on the National Cyber Crime Reporting Portal or through the National Cyber Crime Helpline (1930), and to the bank, within five calendar days of the occurrence.

However, the new directions will not apply to cases where the loss amount exceeds ₹50,000. In such cases, recovery will be governed by the existing operating procedures.