Online frauds: You were alert but lost money due to bank’s error? Key RBI rules on bank liability, customer compensation

With the recent SBI data breach making headlines, the bank said the incident affected a “very very small number of customers.”

“Customer balances are completely safe,” the SBI said on Wednesday, adding that it was taking all possible steps to protect customers’ interests.

While this is a bank-specific incident, what happens in cases where a fraudulent transaction occurs in your account even though you have not shared or entered an OTP? Here’s what experts say about RBI rules on banks’ liability and compensation in online fraud cases.

What constitutes bank negligence in online fraud?

Bhargav KS, Managing Partner at K.S & B.K.S Law Associates, Bengaluru, said inadequate fraud detection, deficient authentication, ignored alerts, or a data breach can constitute bank negligence where they contribute to an unauthorised debit.

Kapil Makhija, Founder and COO at MinEMI.ai, said bank negligence is of two types. One, not following the standard course of action laid down by RBI rules, such as releasing a payment without two-factor authentication, allowing a transfer to a newly added beneficiary without the cooling period, or ignoring its own fraud alerts. Two, acting without the customer’s instruction, such as issuing a loan or card the customer never asked for.

What do the current and new RBI rules cover?

The Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026 will take effect on January 1, 2027.

Makhija explained that, under the current framework, which dates to 2017, the customer has zero liability in two situations: when the fraud arose from the bank’s own negligence, or when a third-party breach is reported within three working days. Report within seven working days and the liability is capped between ₹5,000 and ₹25,000 rupees depending on the account type. Beyond that, the bank’s policy applies.

The 2026 directions widen the reporting window for zero liability to five calendar days. Coverage expands beyond unauthorised transactions to fraudulent ones generally, including credential theft and coercion. The burden of proof shifts to the bank, which must now establish the customer’s liability.

“Resolution deadlines will be 45 days for domestic and 60 days for cross-border cases. Compensation for small-value frauds will be 85% of the loss or ₹25,000, whichever is lower,” Makhija added.

“The central protection remains unchanged: customers bear zero liability where bank negligence causes the loss, irrespective of reporting delay. Where bank negligence is established, the customer is entitled to full reversal; the liability framework imposes no monetary cap on that refund,” Bhargav KS added.

What should you do after discovering an unauthorised transaction?

Makhija recommends four immediate steps:

• Block the compromised card, UPI or net banking access to prevent further losses.
• Report the fraud through the bank’s official app, helpline, or branch and obtain written acknowledgement with the date and time.
• Call the national cybercrime helpline at 1930 and report the incident at cybercrime.gov.in to help freeze funds along the money trail.
• File a police complaint and preserve all evidence.

“Under existing rules, reporting third-party breaches within three working days of receiving bank communication preserves zero liability. Eligible cases require shadow credit within ten working days and final resolution within 90 days,” Bhargav KS added.

How much must a bank refund if negligence is established?

Makhija said when the fraud arises from the bank’s own negligence or deficiency, the customer is entitled to full reversal of the amount, regardless of when he reported it.

A bank can deny or limit compensation where the customer’s own negligence caused the loss: sharing an OTP or PIN, installing a malicious screen-sharing app, or ignoring a specific and clear warning from the bank that a transaction is likely a scam, he added.

Does a data leak automatically entitle customers to compensation?

SBI’s disclosure warrants protective action, but does not automatically establish liability for every subsequent fraud. Customers should seek written confirmation of exposure, monitor accounts, and preserve breach notices, Bhargav KS mentioned.

“Liability arises when the exposed data is subsequently used, and that is where customers must act now. Change credentials, turn on transaction alerts, treat every call quoting your own details as suspect, and preserve any phishing message you receive, because that evidence connects your loss to the breach,” Makhija suggested.

Disclaimer: This is for informational purposes only. Please refer to the RBI’s official website for the latest updates and consult your bank.