UPI and Bank Fraud Refund: RBI Customer Liability Rules Explained

Under RBI’s current customer liability rules, you bear zero loss for an unauthorised electronic transaction if the bank was at fault, or if it was a third-party breach that you reported within 3 working days of the bank’s alert. Report in 4 to 7 working days and your liability is capped; after that, the bank’s Board-approved policy applies. The bank must credit the amount within 10 working days of your report and resolve the complaint within 90 days. New, wider rules apply to transactions from 1 January 2027.

The current framework, explained

These rules come from RBI’s 2017 circular on limiting customer liability in unauthorised electronic banking transactions, now carried into RBI’s 2025 Master Directions. They cover card, net banking, mobile banking and UPI transactions made through your bank account. The clock runs from when you receive the bank’s communication (SMS or email alert) about the transaction, counted in working days.

The cap in the 4 to 7 working day band depends on your account type:

• ₹5,000: Basic Savings Bank Deposit (BSBD) accounts.
• ₹10,000: other savings accounts, prepaid and gift cards, current, cash credit or overdraft accounts of MSMEs, such accounts of individuals with annual average balance up to ₹25 lakh, and credit cards with a limit up to ₹5 lakh.
• ₹25,000: all other current, cash credit or overdraft accounts, and credit cards with a limit above ₹5 lakh.

Your liability is the transaction value or this cap, whichever is lower.

Third-party breach versus customer negligence

Third-party breach means the fault lies neither with you nor with the bank but somewhere else in the system: card skimming at an ATM, a data leak at a merchant, a SIM swap you did not cause, malware you had no reason to suspect. Here your reporting speed decides your liability.

Customer negligence means you compromised the payment credentials yourself, such as sharing your OTP, PIN or CVV with a caller, or approving a UPI request after entering your PIN. In that case you bear the full loss until you report it to the bank. Any loss after reporting falls on the bank.

Who decides? The bank must prove customer liability. It cannot simply say “you must have shared the OTP”. Ask for the basis in writing. Many disputes turn on this point, and the Ombudsman looks at whether the bank actually proved negligence.

Step by step: getting your money back

1. Report immediately to the bank through its official helpline, app or email, and call 1930 or report on cybercrime.gov.in. See our first-hour checklist.
2. Put it in writing. Email the bank’s grievance address with date, time, amount, transaction ID or UTR, and a clear line: “I did not authorise this transaction and did not share any credentials.” Keep the acknowledgement.
3. Track the 10 working days. Ask the bank for the shadow reversal (a credit of the disputed amount to your account) within 10 working days of your report.
4. File an FIR and attach the copy to your bank file.
5. Escalate inside the bank to the nodal or principal nodal officer if the response is poor.
6. Approach the RBI Ombudsman if the bank rejects your complaint, does not reply within 30 days, or gives an unsatisfactory reply. See our RBI Ombudsman guide.

What changes from 1 January 2027

RBI finalised new directions in June 2026 that apply to electronic banking transactions on or after 1 January 2027. They are not in force today. Coming changes:

• They cover “fraudulent” transactions, including cases where the customer was tricked into authorising the payment, not only unauthorised ones.
• Zero liability for third-party breaches reported within 5 calendar days.
• Compensation of 85% of the net loss or ₹25,000, whichever is lower, where gross loss is up to ₹50,000, available once in a lifetime, if reported to the bank and to 1930 or the cyber crime portal within 5 calendar days.
• The compensation mechanism applies to frauds occurring within one year of the effective date.

Example

Farhan in Bhopal sees an SMS for a ₹30,000 card transaction in Dubai at 11 pm while his card is in his wallet. He blocks the card on the app, emails the bank the same night and files on cybercrime.gov.in. This is a third-party breach reported within 3 working days, so his liability is zero. The bank credits ₹30,000 within 10 working days while it investigates.

Frequently asked questions

Do these rules apply to UPI?

Yes, they apply to electronic banking transactions through your bank account, which include UPI.

I shared my OTP. Will I get a refund?

Under current rules, sharing an OTP is usually treated as customer negligence and you bear the loss until you report. From 1 January 2027, the new directions add limited compensation for tricked transactions meeting their conditions.

What is shadow reversal?

A temporary credit of the disputed amount to your account within 10 working days of reporting, while the bank investigates.

How long can the bank take to decide?

The complaint must be resolved and liability decided within 90 days.

Where do I go if the bank refuses?

To the RBI Ombudsman at cms.rbi.org.in, free of charge.

Quick quiz

To understand bank fraud, consumer rights and cyber safety in one course, take Everyday Law for Every Indian (₹349).

Sources

• RBI circular on customer protection: limiting liability of customers in unauthorised electronic banking transactions (6 July 2017), now in RBI Master Directions, 2025
• RBI directions on fraudulent electronic banking transactions, finalised June 2026, applicable from 1 January 2027
• Reserve Bank Integrated Ombudsman Scheme, 2026

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.