The Reserve Bank of India has finalised its comprehensive digital banking fraud protection rules, significantly expanding customer protection measures for digital payment frauds. According to The Economic Times, the revised framework now includes compensation mechanisms for small-value fraud victims and introduces shadow reversal mechanisms for credit card frauds, marking a substantial broadening of the central bank's digital transaction protection measures. The RBI has mandated that banks provide shadow reversal or provisional credit of the disputed amount within 5 days from the date of customer notification for fraudulent electronic banking transactions via credit cards, even before investigation completion. This provision ensures immediate financial relief for credit card fraud victims, with customers not bearing any additional burden of interest or charges during this period.
Under the new framework, banks must formulate a comprehensive policy covering various aspects of customer protection in electronic banking transactions. As per the RBI directions, this policy will include channels for alerting customers about EBTs and reporting fraudulent EBTs, rights and obligations of customers, timelines for complaint resolution and disclosures, and mechanisms for creating customer awareness about their rights and obligations in electronic banking transactions. The policy must also address associated risks arising from customer negligence or bank negligence. Banks are required to strengthen digital payment security, proactively detect and prevent fraud, and assess risks arising from unauthorised electronic transactions to make customers feel safe while carrying out electronic banking activities.
The revised framework introduces mandatory transaction alerts for all electronic banking transactions, with banks mandatorily obtaining customers' mobile numbers and email addresses for all EBTs. For transactions exceeding ₹500, banks must send instant SMS alerts containing relevant details such as account/card number, amount, date, time, transaction channel, beneficiary/point of transaction. Banks may also decide to send alerts for transactions up to ₹500 as per their internal policy, but without charging the customer. Customers can report fraudulent EBTs to their bank and also lodge complaints through the National Cyber Crime Reporting Portal or the National Cyber Crime Helpline (1930). Banks must provide 24x7 access through multiple channels including phone banking, SMS, instant messaging, dedicated email addresses, IVR systems, toll-free numbers, and branch-based reporting facilities.
Under the final guidelines, eligible victims can receive up to ₹25,000 compensation from banks for digital payment fraud losses up to ₹50,000, effective from January 1, 2027. The compensation will be funded jointly with 65% contribution from RBI, 10% from the victim's bank, and 10% from the beneficiary bank where the fraudster first received funds. For fraud cases involving losses below ₹29,412, customers will receive compensation equal to 85% of the net loss, while for losses of ₹29,412 or more but up to ₹50,000, the RBI will contribute ₹19,118 and banks will each contribute ₹2,941. As reported by Mint, the compensation is calculated as 85% of the net loss amount (calculated after reducing recoveries made, whether before or after paying the compensation, from the gross loss amount), or ₹25,000, whichever is less, once during a customer's lifetime. The new framework also introduces a five-day reporting window for zero liability claims, representing an improvement from the earlier three-working-day window in many third-party fraud cases.
The most significant change in the revised framework is the shift in the burden of proof from customers to banks. Under the new directions, banks will be responsible for establishing customer liability in complaints involving fraudulent electronic banking transactions. Zero liability applies where fraudulent EBTs occur due to negligence or deficiency on the part of the bank, irrespective of whether the transaction is reported by the customer. For third-party breaches reported within five calendar days, customers are entitled to zero liability and reversal of the transaction. However, in cases of third-party breaches reported after five days, customer liability will be determined as per the bank's policy. Banks must examine fraudulent EBTs, establish liability, and issue responses to customers within 45 calendar days from receipt of complaint, with 60 days for cross-border fraudulent EBTs. Where banks are required to reverse fraudulent EBTs, reversals must be value-dated to the original date of occurrence to prevent customer loss of interest or additional charges.
