Cardholders and UPI users who lose money to authorised push payment scams will get a narrow, one-time reimbursement window from 1 January 2027 under revised Reserve Bank of India directions, capping lifetime relief at ₹25,000 for verified individual victims who report quickly enough.
The framework covers fraudulent electronic banking transactions, including UPI, debit-card and net-banking debits executed after a customer is tricked into approving a collect request or entering a PIN under duress. It does not reward negligence: ignoring fraud warnings on payment screens can disqualify a claim, and losses above ₹50,000 fall outside the small-value compensation pool entirely.
How much money is on the table
For gross losses up to ₹50,000, eligible individuals can receive 85% of the net loss or ₹25,000, whichever is lower, once in a lifetime. Net loss is calculated after any recovery the bank achieves from beneficiary accounts. Joint-account holders may claim only once across the account, and a claimant who uses the joint route cannot later claim as a sole account holder.
Funding is split among the RBI, the victim's bank and the beneficiary bank for domestic fraud. For example, on a ₹40,000 loss where the ₹25,000 cap applies, the central bank contributes ₹19,118, while the customer's bank and the beneficiary bank each pay ₹2,941, according to the published directions.
The reporting clock that starts now
Even though payouts begin only for transactions from January 2027, the five-calendar-day reporting requirement is the operational habit banks want customers to adopt immediately. Victims must lodge complaints on the National Cyber Crime Reporting Portal or the 1930 helpline and notify their bank within that window.
That timeline is tighter than some older zero-liability cases tied to third-party breaches, but looser than the three working-day window in the 2017 circular for certain unauthorised transactions. Consumer groups say the real test will be whether call-centre staff know to register a cybercrime reference number before the clock expires.
What issuers must build
Banks must publish board-approved policies, run 24×7 fraud reporting channels and send transaction alerts on SMS and email. They bear the burden of proving customer negligence if they reject a claim. Shadow reversal rules also require lenders to trace mule accounts quickly, because compensation math depends on recoveries from beneficiary banks.
For credit-card users, the same electronic banking transaction definition can cover card-not-present fraud where credentials were phished, but chargeback rights on international networks still run in parallel. Issuers are expected to harmonise dispute forms so customers are not bounced between card networks and the cybercrime portal.
Why the cap frustrates some victims
Parliamentary answers in March 2026 noted rising UPI fraud counts and amounts, with lawmakers asking whether a ₹25,000 ceiling matches real losses on jewellery or rent scams. The RBI has argued the mechanism is a targeted relief valve for small-value fraud, not full insurance for every digital payment.
Until January, existing limited-liability rules still apply. That makes the current festive season — when Home Ministry advisories already warn about fake welfare ads — a practical moment to enable transaction limits, disable international UPI where unused, and treat any collect request from an unknown handle as hostile until verified.