E-fraud victims to get 85% of loss or Rs 25k as compensation

MUMBAI: Come Jan 2027, first-time victims of online frauds can receive compensation that is lower of either Rs 25,000 or 85% of the loss amount through a state-backed co-contributed compensation mechanism.

RBI has delayed by six months this proposal that provides limited compensation to victims even if they have given away OTP or password.Moreover, RBI has tweaked the definition of “deceptive” transactions for better consumer protection. The draft had classified scams involving coercion or tricked credentials as “authorised” transactions.The six-month delay in RBI’s implementation of the cyberfraud safety net acknowledges the scale of technological and procedural overhauls required and follows industry concerns over system readiness, even as the broader thrust of the rules remains intact.The RBI has drawn clear boundaries around the framework’s scope. Disputes over defective goods or undelivered services fall outside its ambit, as do frauds involving paper cheques, which are excluded from the definition of electronic banking transactions.Timelines for grievance redress have also been relaxed. Banks will now have up to 45 days to resolve domestic fraud complaints and 60 days for cross-border cases, replacing the draft’s uniform 30-day cap.

The RBI has paired this leniency for banks with sharper customer safeguards. A new “shadow reversal” mechanism mandates that, in cases of credit-card fraud, banks must provisionally credit the disputed amount within five days of notification.The treatment of cross-border fraud has also been recalibrated. The draft’s assumption of shared liability, including a 10% contribution from beneficiary banks, has been abandoned where such banks lie outside India’s jurisdiction. Instead, the RBI will bear 65% of the compensation burden, with the remitting bank absorbing 20%, reflecting the practical difficulty of recovering funds internationally. Procedural requirements for customers have, however, been tightened.Claimants now must submit a copy of their complaint lodged on the National Cyber Crime Reporting Portal and accept liability to refund compensation if claims are later found to be false or duplicative.