If you have lost money through UPI, net banking, a card transaction or a digital-arrest scam, bank compensation for digital fraud in India does not mean an automatic refund in every case. Report the incident to your bank immediately, call 1930, preserve evidence and ask for a written decision. The RBI’s 6 July 2017 liability directions apply to scheduled commercial banks, including regional rural banks, as well as small finance banks and payments banks. A co-operative bank account or a non-bank wallet may instead be governed by the RBI directions and issuer policy applicable to that institution or product. For example, the RBI’s Master Directions on Prepaid Payment Instruments set out separate customer-liability provisions for non-bank PPI issuers.

If the fraud has just happened: Block the affected payment channel, call your bank using a verified number, call 1930, and change compromised credentials. The Ministry of Home Affairs describes 1930 and the Citizen Financial Cyber Fraud Reporting and Management System as channels for immediate financial-fraud reporting and coordination with financial institutions in its 28 July 2026 release.

What the Supreme Court decision could mean after digital fraud

Bar and Bench reported on 29 October 2026 that the Supreme Court said it would examine proposed RBI anti-cyber-fraud regulations before notification. The report said the Court discussed safeguards for unusual transactions and compensation where a financial institution had failed in its due diligence. This was not a final rule requiring a bank to reimburse every digital-fraud loss.

The proceeding, In Re: Victims of Digital Arrest Related to Forged Documents, followed allegations that impersonators used forged judicial documents and threats to induce a senior-citizen couple to transfer ₹1.055 crore through multiple bank transactions between 3 September and 16 September 2025. The Supreme Court’s order dated 17 October 2025 records that the suo motu matter concerns a wider pattern of organised digital-arrest fraud.

For your own complaint, the immediate question is narrower: what happened, when did you report it, and is there evidence of a failure in the bank’s service or safeguards? Records showing that the bank did not act after your report, did not provide a required reporting channel, or did not deal with an identified security issue may support your complaint. Whether this establishes a service deficiency depends on the transaction, the evidence and the rules that apply to your provider.

Bank compensation for digital fraud in India: when can you get it?

The RBI circular dated 6 July 2017 is the main framework for unauthorised electronic banking transactions at scheduled commercial banks, including regional rural banks, small finance banks and payments banks. It covers remote or online payments, such as internet banking, mobile banking and card-not-present payments, as well as ATM and point-of-sale transactions. Do not assume that its caps apply unchanged to every UPI-linked account, co-operative bank account, wallet or prepaid instrument. The applicable provider and product matter.

For non-bank wallets and other prepaid payment instruments, the RBI’s PPI Master Directions prescribe their own customer-liability framework for unauthorised electronic payment transactions. They require a non-bank PPI issuer to publish a board-approved customer-liability and grievance-handling policy. Bank-issued PPIs follow the applicable bank directions referred to in those Master Directions.

For a bank within the scope of the 6 July 2017 circular:

  • Bank fraud, negligence or deficiency: You have zero liability when an unauthorised transaction resulted from contributory fraud, negligence or deficiency by the bank, regardless of when you report it.
  • Third-party breach reported within three working days: You have zero liability where neither you nor the bank was at fault and you notify the bank within three working days of receiving the transaction communication.
  • Third-party breach reported in four to seven working days: This is when the RBI’s category-specific caps apply. Your liability is limited to the transaction value or the applicable cap, whichever is lower. The cap is ₹5,000 for a Basic Savings Bank Deposit Account; ₹10,000 for the account and card categories specified in Table 1, including other savings accounts and certain lower-limit credit and overdraft accounts; and ₹25,000 for the remaining current, cash-credit and overdraft accounts and credit cards. Table 1 of the RBI circular sets out the precise categories and caps.
  • Customer negligence: If you shared payment credentials, you generally bear losses until you report the unauthorised transaction. The bank bears unauthorised losses that occur after your report.
  • Reporting after seven working days: Your liability is decided under the bank’s board-approved customer-protection policy.

The same RBI circular requires a covered bank to provide a shadow reversal within 10 working days after notification of an unauthorised electronic transaction, without waiting for an insurance claim to settle. It also requires the bank to resolve customer liability within the time in its board-approved policy, which cannot exceed 90 days, and places the burden of proving customer liability on the bank.

A key distinction is between an unauthorised transaction and a payment that you personally confirmed after deception, impersonation or threats. A bank may treat a transfer confirmed with a UPI PIN or other credential as customer-authorised. You should still make a digital payment fraud bank complaint and ask the bank to examine its response and safeguards, but the RBI’s zero-liability provisions may not by themselves settle that dispute.

When a bank’s negligence may be relevant to your complaint

For the banks covered by the 6 July 2017 RBI directions, the required controls include security systems, a robust fraud-detection and prevention mechanism, transaction alerts and round-the-clock channels for reporting unauthorised transactions. After receiving a report, the bank must take immediate steps to prevent further unauthorised transactions.

Where your records support it, ask the bank to address whether:

  • transaction alerts were not sent or arrived unusually late;
  • its fraud-reporting channel was unavailable or did not acknowledge your complaint;
  • further transactions occurred after it recorded your fraud report;
  • it did not block a compromised card, account or payment facility after notification;
  • it considered an abrupt transaction that differed sharply from your past account activity;
  • its reply explains the evidence used to classify the payment as authorised; or
  • it applied the customer-liability policy that governs your account or payment product.

An unusual transaction does not itself prove a bank-side failure. Use timestamps, statements and complaint records to ask focused questions, and request written findings rather than relying only on a telephone conversation.

What to do immediately: report the transaction and preserve evidence

1. Tell the bank at once

Use the bank’s verified fraud-reporting number, mobile application or website. Ask it to block the affected card or payment facility, secure the account, attempt a recall or beneficiary freeze where possible, and prevent further debits. Save the complaint number and the exact time you reported the incident.

2. Call 1930 and file a cybercrime report

The Ministry of Home Affairs states that the Citizen Financial Cyber Fraud Reporting and Management System is intended for immediate reporting of financial cyber fraud and for action to stop funds moving further through the system. Its 28 July 2026 release confirms that 1930 is operational for assistance with online cyber complaints.

Complete your complaint on the National Cyber Crime Reporting Portal and keep the acknowledgement. A report does not assure recovery, but reporting promptly can help authorities and financial institutions act while funds may still be traceable.

3. Build your evidence file

Useful evidence for bank fraud compensation includes:

  • account or card statements showing each disputed debit;
  • UTR or transaction ID, date, time, amount and recipient details;
  • screenshots of payment confirmations and error messages;
  • SMS and email alerts, including their delivery times;
  • chats, emails, call logs, phone numbers, profiles and website addresses used by the fraudster;
  • the bank complaint and acknowledgement number;
  • the 1930 acknowledgement, cybercrime complaint and FIR, if registered;
  • proof of when you blocked the card, changed credentials or requested an account freeze;
  • earlier statements that help show why the disputed transaction was unusual; and
  • every bank reply, along with notes of phone conversations.

The National Cyber Crime Reporting Portal checklist asks you to keep the incident date and time, bank, wallet or merchant name, transaction or UTR number, transaction date, fraud amount and relevant evidence ready before filing a financial-fraud complaint. The portal’s FAQ guidance also asks complainants to provide accurate and complete information to help police authorities act on the complaint.

Preserve original files where possible. Do not edit screenshots, delete chats or reset the affected phone until you have saved the material you need and considered whether investigators may require the device.

How to escalate a digital-fraud complaint if the bank does not resolve it

If you are wondering how to complain to a bank after online fraud, use a written sequence:

  1. Submit the initial fraud report through an official bank channel.
  2. Send a detailed written complaint to the bank’s customer-care or grievance team.
  3. Escalate it to the bank’s grievance redressal or nodal officer using the procedure the bank publishes.
  4. Ask for a reasoned decision addressing the disputed transactions, reporting time, alerts, authentication records and the customer-liability framework that applies to your account or payment product.
  5. Keep every acknowledgement and response.

The Reserve Bank - Integrated Ombudsman Scheme, 2026 took effect on 1 July 2026 and replaced the 2021 Scheme for complaints received from that date. The RBI’s guidance on the 2026 Scheme says you must first make a written complaint to the regulated entity. You may then approach the RBI Ombudsman if the bank or other covered entity rejects the complaint wholly or partly and you are dissatisfied, or if it does not reply within 30 days or within a longer timeline specified in applicable RBI, NPCI or card-network guidance, whichever is higher. File the Ombudsman complaint within 90 days from the end of that response period or the regulated entity’s last communication, whichever is later.

The 2026 Scheme does not cover every provider or every type of dispute. The same RBI guidance lists banks, certain NBFCs, non-bank PPI issuers and credit information companies among the covered categories. Check whether your provider is a covered regulated entity before relying on the Ombudsman route.

Your Ombudsman complaint should state:

  • what happened and how the fraud was carried out;
  • when you discovered and reported each transaction;
  • why you dispute the bank’s assessment of your liability;
  • the bank process or safeguard you believe may have failed;
  • what the bank said in response;
  • the remedy you seek; and
  • the document supporting each point.

A police or cybercrime complaint and a bank-service complaint have different purposes. Continue cooperating with investigators while you pursue the bank’s grievance process.

Where personal cyber insurance may help, and where policy terms may limit cover

A bank complaint and a claim under cyber insurance for online fraud in India are separate processes. Your complaint to the bank concerns the transaction, the bank’s systems and the applicable customer-protection framework. An insurance claim concerns whether the loss falls within the cover you bought.

Notify the insurer promptly if your personal cyber policy was in force on the incident date. Check the policy schedule and wording for the reporting method, required documents, deductible, sum insured, sub-limits and exclusions. Reporting rules vary by product. For example, the Bajaj General Individual Cyber Safe policy wording requires covered events to be reported within the reporting period in the policy schedule and sets conditions for theft-of-funds claims.

Cover depends on the exact policy wording. Some policies may cover losses from unauthorised access, phishing or email spoofing, but only within the stated sum insured or sub-limit and subject to the listed conditions and exclusions. The same Bajaj General policy wording illustrates how a policy can distinguish between defined covered events, reporting requirements and exclusions. A transfer you approved, even after deception, may therefore be assessed differently from an unauthorised debit.

Give the insurer your core evidence file, policy number, claim form and any other documents it requests. Tell it about money later reversed, recovered or paid through another process. If you need help making sense of the paperwork, you can seek support with understanding your claim documents. Claim outcomes remain subject to policy terms and the insurer’s decision.

FAQ: Can you seek bank compensation after sharing an OTP or authorising a payment?

Can I seek compensation if I shared an OTP?

You can still complain and ask the bank to investigate. For banks covered by the RBI’s 6 July 2017 circular, where customer negligence, such as sharing payment credentials, caused an unauthorised transaction, the customer bears losses before notifying the bank. Unauthorised losses after notification are to be borne by the bank. That is why the exact reporting time matters.

Sharing an OTP does not prevent you from presenting evidence of a separate bank-side failure. It does make the facts, sequence of events and evidence especially important.

What if I entered my UPI PIN or personally transferred the money?

The bank may classify the payment as customer-authorised even where a fraudster obtained that approval through deception or threats. Report it immediately, explain the impersonation or coercion clearly, and ask the bank to investigate its safeguards and response. The 29 October 2026 Bar and Bench report on the Supreme Court proceedings does not create an automatic compensation entitlement for such payments.

Does cyber insurance pay if the bank refuses compensation?

Not automatically. The insurer will assess the policy definitions, covered event, exclusions, sub-limits and reporting conditions. A bank’s rejection may be relevant to the insurer’s assessment, but it does not itself establish whether the policy covers the loss. The Bajaj General policy wording shows how a personal cyber policy can make cover conditional on defined events, documentation and reporting requirements. Likewise, an insurance decision does not settle whether a bank met its obligations.

Talk to a Mitra to review whether personal cyber insurance may suit your household and to understand the documents typically needed when making an insurance claim. Bank compensation and claim outcomes remain subject to the relevant process and policy terms.

Frequently asked questions

Can I seek bank compensation if I shared an OTP?

You can still complain. For banks covered by the RBI’s 6 July 2017 customer-protection directions, where customer negligence, such as sharing payment credentials, caused an unauthorised transaction, the customer generally bears the loss until reporting it. The bank bears unauthorised losses occurring after the report. The exact facts, timestamps and any bank-side failure still matter.

What if I personally authorised the payment because a fraudster threatened or deceived me?

Report the transaction immediately, but do not assume that the RBI framework for unauthorised transactions automatically applies. Ask the bank to investigate its safeguards and response. Bar and Bench reported on 29 October 2026 that the Supreme Court would examine proposed RBI anti-cyber-fraud regulations before notification.

Can I approach the RBI Ombudsman immediately?

No. You must first complain in writing to the bank or other regulated entity. Under the RBI’s Integrated Ombudsman Scheme, 2026 FAQ, effective 1 July 2026, you may approach the RBI Ombudsman if you are dissatisfied with the reply, or if there is no reply after 30 days or a longer period specified in applicable RBI, NPCI or card-network guidance. The complaint must generally be filed within 90 days after that period ends or the regulated entity’s last communication, whichever is later.

Sources