Got scammed online? You may get up to 85% refund or Rs 25,000 under RBI’s proposed rules; eligibility and process explained

The Reserve Bank of India (RBI) has proposed new regulations to enhance the safety of bank customers from online fraud. These draft guidelines are part of the RBI (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026. The objective of these rules is to boost customer safety in digital banking transactions such as internet banking, mobile payments, and card transactions. If approved, these rules will apply to transactions from July 1, 2026.

Under the draft rules, customers who lose money due to fraudulent electronic banking transactions may receive compensation. If the total loss is up to Rs 50,000, the customer could receive 85% of the net loss amount or Rs 25,000 (whichever is lower). This compensation will be available only once in a customer’s lifetime, provided the fraud claim is verified by the bank.

To qualify for compensation, the fraud must be reported quickly. Customers must inform both their bank and the National Cyber Crime Reporting Portal or Cyber Crime Helpline (1930) within five days of the fraud. The bank will also verify the claim using its internal investigation process before approving any compensation payment.

The compensation amount will be shared among multiple institutions. In cases where the loss is small and compensation equals 85% of the loss, the RBI may cover 65%, the customer’s bank may bear 10%, and the beneficiary bank may pay the remaining 10%. This shared responsibility aims to ensure faster relief for fraud victims.

In some cases, customers may not have to bear any financial loss. If the fraud happens due to bank negligence or system failure, the customer has zero liability, and the transaction must be reversed. Zero liability may also apply when a third-party breach occurs, and the customer reports the fraud within five calendar days.

To strengthen security, banks will have to send instant SMS alerts for all electronic transactions above Rs 500. If the customer has provided an email address, banks must also send email alerts for such transactions. These alerts will be in addition to other notifications like mobile app alerts or push notifications.

Banks will require customers to provide their mobile number and email address to use electronic banking services, except ATM cash withdrawals. This ensures that customers receive real-time alerts for transactions, which helps them quickly detect suspicious activity and report fraud before more money is lost.

Customers may lose protection if fraud happens due to their own negligence. Examples include sharing OTPs, PINs, or passwords, ignoring bank warnings about suspicious transactions, failing to report fraud quickly, storing card PINs carelessly, or downloading malicious apps. Practicing safe digital banking habits is essential to avoid losses and ensure protection.