The Reserve Bank of India (RBI) on Wednesday widened customer protection against payment scams, including being tricked into transferring money to fraudsters posing as legitimate recipients.

The revised framework on limiting customer liability in digital transactions introduced compensation mechanism for small-value digital frauds and also covered credit card transactions.

In case of fraudulent transactions involving credit cards, banks will be required to provide shadow reversal or provisional credit of the disputed amount within five days from the date of customer notification. 

On compensation, the RBI said bona fide victims suffering losses of up to Rs 50,000 due to fraudulent electronic banking transactions (EBTs) will be eligible for compensation of 85% of the net loss amount or Rs 25,000, whichever is less, once during their lifetime.

The new RBI rules include cases where a third party uses credentials obtained fraudulently to carry out transactions and situations where customers approve transactions under coercion or duress.

Banks will need to examine complaints and establish liability within 45 calendar days in cases involving domestic fraudulent electronic banking transactions and within 60 calendar days for cross-border cases. In cases where these timelines are not met, banks will have to communicate the reasons to customers.

Banks are required to send instant SMS alerts to their customers for electronic transactions above Rs 500. “For EBTs of value up to Rs 500, a bank may decide to send instant SMS as per its internal policy but without any charge to the customer," the RBI said.

The amended guidelines will come into effect from 1 January 2027.

"A customer shall be entitled to zero liability and reversal of the transaction in cases where the fraudulent EBT occurs due to negligence / deficiency on the part of the bank, irrespective of whether the transaction is reported by the customer or not," the RBI said.

A customer should be entitled to "zero liability and reversal of the transaction" in cases of third-party breach where the customer reports the unauthorised fraudulent EBT to the bank within five calendar days from the date of its occurrence, it added.

In cases of third-party breach reported to the bank after five calendar days, the customer's liability shall be determined as per the bank's policy.