Online frauds: You were alert but lost money due to bank's error? Key RBI rules on bank liability, customer compensation

With the recent SBI data breach making headlines, the bank said the incident affected a “very very small number of customers.”

“Customer balances are completely safe,” the SBI said on Wednesday, adding that it was taking all possible steps to protect customers’ interests.

While this is a bank-specific incident, what happens in cases where a fraudulent transaction occurs in your account even though you have not shared or entered an OTP? Here’s what experts say about RBI rules on banks' liability and compensation in online fraud cases.

Bhargav KS, Managing Partner at K.S & B.K.S Law Associates, Bengaluru, said inadequate fraud detection, deficient authentication, ignored alerts, or a data breach can constitute bank negligence where they contribute to an unauthorised debit.

Kapil Makhija, Founder and COO at MinEMI.ai, said bank negligence is of two types. One, not following the standard course of action laid down by RBI rules, such as releasing a payment without two-factor authentication, allowing a transfer to a newly added beneficiary without the cooling period, or ignoring its own fraud alerts. Two, acting without the customer’s instruction, such as issuing a loan or card the customer never asked for.

The Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026 will take effect on January 1, 2027.

Makhija explained that, under the current framework, which dates to 2017, the customer has zero liability in two situations: when the fraud arose from the bank’s own negligence, or when a third-party breach is reported within three working days. Report within seven working days and the liability is capped between ₹5,000 and ₹25,000 rupees depending on the account type. Beyond that, the bank’s policy applies.

The 2026 directions widen the reporting window for zero liability to five calendar days. Coverage expands beyond unauthorised transactions to fraudulent ones generally, including credential theft and coercion. The burden of proof shifts to the bank, which must now establish the customer’s liability.

“Resolution deadlines will be 45 days for domestic and 60 days for cross-border cases. Compensation for small-value frauds will be 85% of the loss or ₹25,000, whichever is lower,” Makhija added.

“The central protection remains unchanged: customers bear zero liability where bank negligence causes the loss, irrespective of reporting delay. Where bank negligence is established, the customer is entitled to full reversal; the liability framework imposes no monetary cap on that refund,” Bhargav KS added.

Makhija recommends four immediate steps:

• Block the compromised card, UPI or net banking access to prevent further losses.
• Report the fraud through the bank’s official app, helpline, or branch and obtain written acknowledgement with the date and time.
• Call the national cybercrime helpline at 1930 and report the incident at cybercrime.gov.in to help freeze funds along the money trail.
• File a police complaint and preserve all evidence.

“Under existing rules, reporting third-party breaches within three working days of receiving bank communication preserves zero liability. Eligible cases require shadow credit within ten working days and final resolution within 90 days,” Bhargav KS added.

Makhija said when the fraud arises from the bank’s own negligence or deficiency, the customer is entitled to full reversal of the amount, regardless of when he reported it.

A bank can deny or limit compensation where the customer’s own negligence caused the loss: sharing an OTP or PIN, installing a malicious screen-sharing app, or ignoring a specific and clear warning from the bank that a transaction is likely a scam, he added.

SBI’s disclosure warrants protective action, but does not automatically establish liability for every subsequent fraud. Customers should seek written confirmation of exposure, monitor accounts, and preserve breach notices, Bhargav KS mentioned.

“Liability arises when the exposed data is subsequently used, and that is where customers must act now. Change credentials, turn on transaction alerts, treat every call quoting your own details as suspect, and preserve any phishing message you receive, because that evidence connects your loss to the breach,” Makhija suggested.

Sheetal Goel is a Content Producer at Livemint, where she covers corporate developments, personal finance, business trends, markets, and SEBI-related updates. She focuses on simplifying complex financial concepts and presenting them in a clear, reader-friendly manner, thereby helping audiences better understand investment trends, personal finance, and market developments. Her writing focuses on making finance more accessible to everyday readers while maintaining clarity, accuracy, and relevance. <br><br> She holds a degree in Economics (Hons.) along with an MBA in Finance, which has helped her develop a strong foundation in financial analysis, market understanding, and business reporting. Before joining journalism, she worked with finance and broking firms, where she closely followed market developments, investment strategies, and evolving industry trends. This practical exposure strengthened her understanding of financial markets. She has also written content across multiple formats and platforms, including YouTube, LinkedIn, and Instagram. <br><br> Over time, she has developed expertise in covering market-linked stories, investor-focused topics, and regulatory updates in a simplified yet informative style. She also enjoys reading and listening to Hindi poetry, reflecting her appreciation for literature and creative expression beyond the world of markets and numbers.

Get Latest real-time updates

Catch all the Instant Personal Loan, Business Loan, Business News, Money news, Breaking News Events and Latest News Updates on Live Mint. Download The Mint News App to get Daily Market Updates.

HomeMoneyPersonal FinanceOnline frauds: You were alert but lost money due to bank's error? Key RBI rules on bank liability, customer compensation

✕

Wait for it…

Oops! Looks like you have exceeded the limit to bookmark the image. Remove some to bookmark this image.