RBI finalises digital banking fraud protection rules; introduces shadow reversal, extends relief to sole proprietors

Mumbai: Victims of involving losses of up to Rs 50,000 will be eligible to receive compensation of up to Rs 25,000 from their banks once in their lifetime under final guidelines issued by the .

Under the regulator’s directions on limiting liability of customers in , which will come into effect on January 1, 2027, the compensation will be funded jointly, with 65% contributed by the RBI, 10% by the victim’s bank and 10% by the beneficiary bank — the bank where the fraudster first received the funds.

The draft directions limited the small-value fraud compensation mechanism to “individual persons.” The final directions expand this to explicitly include sole proprietors — a significant broadening of coverage that brings millions of within the protective ambit of the scheme for the first time.

The RBI has also introduced compensation for cross-border frauds in the final guidelines. Under the framework, for cross-border fraudulent transactions where there is no Indian beneficiary bank, the RBI will bear 65% of the compensation while the customer’s bank will contribute the remaining 35%.

To be eligible, customers must report the fraud to both the National Portal or helpline (1930) and their bank within five calendar days of the incident. Banks must pay compensation within five calendar days of receiving the customer’s application.

A significant addition not included in the March draft is the introduction of a for . Under this provision, when a customer reports a fraudulent credit card transaction, the bank must provide a provisional credit for the disputed amount within five calendar days, even before the investigation is complete.

The final framework also mandates banks to send instant SMS alerts for all above Rs 500, a tenfold reduction from the earlier threshold of Rs 5,000.

Complaints must be investigated and resolved within 45 calendar days for domestic fraudulent transactions and 60 calendar days for cross-border transactions.

Banks will also be required to institute periodic reporting of digital fraud complaints to their board or a designated board committee. The board must regularly review these complaints and take appropriate steps to strengthen systems, controls and customer protection measures.