Your Rights If You Are a Victim of UPI or Online Banking Fraud: RBI Zero Liability Rules and Reporting Timelines Explained

If money has left your account through a UPI payment, a card transaction or net banking that you did not make, or that you were tricked into approving, the first few days decide how much of it you can realistically get back. Indian law and RBI rules give victims of digital fraud real protections, but almost all of them depend on how quickly you report and who was at fault. The rules are also in the middle of a major change: RBI issued a new customer protection framework on June 24, 2026, and it takes effect for transactions on or after January 1, 2027.

This guide explains what protections apply to you today, what changes from January 2027, the exact reporting deadlines, and the step-by-step process to follow after a fraud so that your claim is as strong as possible.

Quick Answer

Under RBI’s existing 2017 framework, which still governs transactions until December 31, 2026, you have zero liability for an unauthorised online transaction if the fault lies with the bank, or if a third party breach caused it and you report it to your bank within three working days of being told about the transaction. Report in four to seven working days and your liability is capped at a fixed amount that depends on your account type. The bank must credit the disputed amount to your account within 10 working days and resolve the complaint within 90 days. From January 1, 2027, a new framework replaces this: the reporting window for zero liability in third party breaches becomes five calendar days, banks must resolve complaints in 45 days for domestic cases, the bank carries the burden of proving you were at fault, and eligible victims of small frauds up to ₹50,000 can receive compensation of 85% of the net loss or ₹25,000, whichever is lower. In every case, report to your bank immediately and to the National Cyber Crime Reporting Portal or helpline 1930.

About This Guide

This guide was compiled by the FinanceChecks.com editorial team using RBI’s circular of July 6, 2017 on limiting customer liability, RBI’s Commercial Banks (Responsible Business Conduct) Third Amendment Directions, 2026 issued on June 24, 2026, the RBI Integrated Ombudsman Scheme, and analysis from established legal and technology policy publications. Because this is a legal-rights topic where wrong timelines can cost readers real money, we have separated the rules that apply today from those that apply from 2027, and we recommend confirming details with your own bank’s published customer protection policy. We will update this guide as banks publish their revised policies ahead of the January 2027 effective date.

Which Rules Apply to You Right Now

There are two frameworks in play, and which one covers you depends on when the fraudulent transaction takes place.

For any electronic banking transaction up to December 31, 2026, the older framework applies. This is RBI’s circular titled “Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions” from July 2017, later folded into RBI’s 2025 consolidated directions. It covers card payments, net banking, mobile banking, UPI and other electronic transfers made through banks.

For any electronic banking transaction on or after January 1, 2027, the new amended directions apply. They widen the scope from “unauthorised” transactions to “fraudulent electronic banking transactions,” which includes transactions carried out by a third party using credentials obtained through fraud, and transactions a customer was pushed into approving under coercion or duress.

Liability Under the Current 2017 Framework

Situation	Your Liability	What You Must Do
Fraud caused by bank negligence or deficiency, even if you never reported it	Zero	Nothing further needed for liability, but report as early as possible
Third party breach (fault is neither yours nor the bank’s) and you report within 3 working days of the bank’s alert	Zero	Report to the bank within 3 working days of the alert
Third party breach reported in 4 to 7 working days	Limited, capped at ₹5,000 to ₹25,000 depending on account and card type	Report as soon as possible within 7 working days
Third party breach reported after 7 working days	Decided as per the bank’s board approved policy	Report immediately and raise a written complaint
Fraud caused by your own negligence, such as sharing PIN, password or OTP	You bear the loss until you report, and the bank bears losses after you report	Report the moment you notice

Once you report, the bank must credit the disputed amount back to your account within 10 working days, without waiting for the investigation to finish, and must resolve the complaint within 90 days. If it cannot resolve the case in that period, it must compensate you. In all these cases, the burden of proving customer liability rests on the bank.

What Changes From January 1, 2027

RBI’s June 2026 directions overhaul the framework in several ways that favour customers, though with some limits.

Feature	Current Rules (till Dec 31, 2026)	New Rules (from Jan 1, 2027)
Scope	Unauthorised transactions	All fraudulent electronic banking transactions, including those under coercion or duress
Zero liability window for third party breach	3 working days	5 calendar days
Zero liability for bank negligence	Yes, regardless of reporting	Yes, regardless of reporting
Burden of proof	On the bank	On the bank, with formal definitions of bank and customer negligence
Complaint resolution time	90 days	45 days for domestic, 60 days for cross-border
Credit card fraud reversal	Within 10 working days	Shadow reversal within 5 calendar days
SMS alerts	Mandatory registration for alerts	Instant SMS for all transactions above ₹500
Compensation for small frauds	None	85% of net loss or ₹25,000, whichever is lower, for losses up to ₹50,000, once in a lifetime
Reporting to authorities	Not specified	Report to the bank and to the Cyber Crime Portal or 1930 within 5 calendar days

The new definition of customer negligence is worth reading carefully. It includes sharing or failing to protect PINs, passwords or OTPs, delaying the report, ignoring specific and clear scam warnings issued by your bank, downloading malicious applications, and not keeping your registered mobile number and email updated with the bank. Bank negligence includes failing to send mandatory alerts, failing to provide 24×7 reporting channels, not acting diligently once you report, and system failures or internal fraud.

The compensation scheme has strict conditions. It is meant for bona fide victims whose loss involved customer negligence, it covers losses up to ₹50,000, you must report to both the bank and the cyber crime channels within five calendar days, you can claim it only once in your lifetime, and the bank must pay within five calendar days of receiving your complete application. It applies to frauds occurring during the first year after the directions come into force.

What To Do Immediately After a UPI or Online Banking Fraud

Speed matters more than anything else, so the order of steps below is deliberate.

First, contact your bank at once. Use the 24×7 helpline, the mobile app or net banking to block the card, freeze UPI access or block the account, and ask the bank to place a hold on the beneficiary account if the money can still be traced. Take note of the complaint number and the time of acknowledgment, since your reporting date is what counts for zero or limited liability.

Second, report the fraud on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call 1930. Reporting fast helps because this channel can flag the receiving account and, in some cases, freeze funds before they are moved on. Under the new rules, this report is also a condition for compensation.

Third, put your complaint in writing. Email the bank’s grievance or nodal officer address with your account details, transaction IDs, amounts, date and time, screenshots of SMS alerts and the fraud message or call details. A written trail becomes your proof if the bank disputes the timeline later.

Fourth, file a police complaint or FIR if the amount is significant or the bank asks for it, and keep a copy.

Fifth, if the bank does not reverse the amount or resolve the complaint within the prescribed period, escalate to the RBI Ombudsman.

Escalating to the RBI Ombudsman and Beyond

The RBI Integrated Ombudsman Scheme, 2026, effective from July 1, 2026, gives you a free route when your bank fails to fix the problem. You must first complain to the bank and give it time to respond, and for categories like unauthorised electronic banking transactions the waiting period is aligned with the resolution timelines RBI has prescribed. You can then file online at cms.rbi.org.in. There is no upper limit on the value of the dispute you can bring, and the Ombudsman can award up to ₹30 lakh for consequential loss plus up to ₹3 lakh for time, expenses and harassment. Since escalation windows are time-bound, check the portal for the current deadline rather than waiting.

Beyond the ombudsman, you can also approach the Consumer Commission under the Consumer Protection Act for deficiency in service, and pursue criminal action through the police against the fraudster.

Common Mistakes Victims Make

The most damaging mistake is waiting. Many victims spend a day or two hoping the money returns, or trying to get the scammer to reverse it, and by the time they call the bank they have crossed a liability threshold. Another frequent error is reporting only to the bank and skipping the cyber crime portal, which weakens the chance of freezing funds and, from 2027, can cost you the compensation. Victims also often forget to save evidence, deleting the SMS, chat or call log before making a formal complaint. Some assume that approving a payment themselves, for example on a fake collect request or under pressure from a scammer, means they have no rights at all, when in fact the new rules explicitly recognise transactions made under coercion or duress as fraudulent. Finally, many people never update their registered mobile number with the bank, which can undermine a claim because the bank’s alerts may not have reached them.

My Take

The most meaningful change in the new framework is not the compensation scheme, it is the formal shift of the burden of proof and the clear definitions of negligence. Until now, arguments about whether a customer was careless often came down to a bank’s word against yours. Written definitions of bank negligence, such as failing to send alerts or provide 24×7 reporting, give victims something concrete to point to.

That said, the protections have limits worth being honest about. The ₹25,000 compensation ceiling, the once-in-a-lifetime restriction and the five-day reporting requirement mean victims of larger scams still have to rely on the zero liability route, the ombudsman or the courts. The best protection remains prevention: keep your registered mobile number current, turn on transaction alerts, never share an OTP or approve a collect request you did not initiate, and treat any call that creates urgency around your bank account as a red flag. If it does happen, remember that the first hour matters more than the first week.

Frequently Asked Questions

1. Am I entitled to a refund if I lose money in a UPI fraud? It depends on the cause and how fast you report. If the fraud stems from bank negligence or a third party breach and you report within the prescribed window, your liability is zero and the bank must reverse the amount. If you shared credentials, you bear the loss until you report.

2. What is RBI’s zero liability rule? It is a customer protection rule under which you bear no loss from an unauthorised electronic transaction when the fault is the bank’s, or when a third party breach occurs and you report within the specified window.

3. How many days do I have to report an online banking fraud? Under the current framework you should report within three working days for zero liability. From January 1, 2027, the window becomes five calendar days for third party breaches.

4. How long does a bank take to return my money? Currently the bank must credit the disputed amount within 10 working days of your report and resolve the complaint within 90 days. From 2027, complaints must be resolved within 45 days for domestic cases and 60 days for cross-border cases.

5. What is a shadow reversal? It is a temporary credit the bank gives after you report a fraud. You cannot use the money, but you will not be charged interest or fees on it while the investigation is pending.

6. What if I was tricked into sharing my OTP or approving a payment? This can be treated as customer negligence, in which case you bear losses until you report. Under the 2027 rules you may still qualify for the small-value compensation if your loss is up to ₹50,000 and you report within five calendar days.

7. How much compensation can I get under the new rules? Eligible victims can receive 85% of the net loss or ₹25,000, whichever is lower, once in their lifetime, for fraud losses up to ₹50,000.

8. Where should I report a UPI fraud besides my bank? Report to the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the 1930 helpline as soon as possible.

9. What can I do if my bank refuses to refund me? Escalate to the RBI Ombudsman through cms.rbi.org.in after giving the bank the prescribed time to respond, and consider approaching the Consumer Commission if the issue remains unresolved.

10. Do these rules apply to wallets and small finance banks? The 2017 framework applies to banks, small finance banks, payments banks and prepaid payment instrument issuers. The 2026 amendment directions apply to commercial banks and, in a separate version, to rural co-operative banks, so check the specific policy of your provider.

Disclaimer

This article is for general informational purposes only and does not constitute legal or financial advice. Timelines, liability limits and compensation rules are based on RBI circulars and directions available at the time of writing and may vary by bank, account type and the facts of your case. The 2026 amendment directions apply only to transactions on or after January 1, 2027. Readers should verify current rules with their bank, RBI’s official website and, where needed, a qualified legal professional. FinanceChecks.com is not affiliated with RBI or any bank.