Digital banking has rapidly expanded in India with the use of technologies such as internet banking, mobile banking and the Unified Payments Interface (UPI), making financial transactions faster and more convenient.

However, the growth of digital banking has also led to increased risks, including cyber fraud, phishing attacks, identity theft and unauthorised electronic transactions. To address these challenges, the Reserve Bank of India (RBI) has issued regulatory guidelines to regulate digital banking transactions and protect consumers.

RBI rules on digital banking fraud

Digital banking transactions in India are regulated by the Banking Regulation Act, 1949, the Payment and Settlement Structures Act, 2007, and the Information Technology (IT) Act, 2000, in addition to the penal laws of the country. On 6 July 2017, the RBI issued the circular titled Consumer Protection – Limiting Liability of Consumers in Unauthorised Electronic Banking Transactions. This establishes the following norms, effective since 1 July 2026.

(1) Zero liability of consumer. Financial institution consumers have zero liability when the unauthorised transaction occurs because of negligence of the bank; or there is a device breach within the bank’s infrastructure.

Additionally, the purchaser has to report the unauthorised transaction within three working days.

(2) Limited liability. If the fraud happens because of a third-party breach and the consumer reports it within four to seven days, the consumer might bear constrained liability concern to the transaction amount and financial institution policy.

(3) Consumer negligence. Where the loss occurs due to consumers’ negligence, such as: sharing passwords with unauthorised persons; disclosing OTPs to unauthorised persons; or disclosing banking credentials.

The consumer becomes exposed to grave losses until the financial institution is knowledgeable of the fraud. It is as if the consumer is handing the keys of his safe to an unknown individual who intends to steal from the consumer.

RBI proposes stronger digital fraud protection

Recently, the RBI has proposed additional measures to strengthen consumer protection in digital banking.

(a) Partial repayment for victims of digital fraud in small-value transactions mainly through the UPI, debit cards and mobile wallets;
(b) Mandatory evidence from banks before rejecting fraud claims; and
(c) Increased obligation of banks while managing fraud court cases, including OTP authentication logs, IP address and device statistics, SMS alerts and communication records, login records from net banking structures, transaction authorisation logs.

India unauthorised banking fraud case law

• In Suresh Chandra Singh Negi v Bank of Baroda, Allahabad High Court held that the burden of proving negligence lies on the bank when a consumer disputes an unauthorised transaction. However, where technical records show that the consumer authorised the transaction, the bank cannot be held liable.
• In Hare Ram Singh v Reserve Bank of India and Ors, the court emphasised that banks must exercise reasonable care and act promptly after cyber fraud is reported. Where a customer reports fraud immediately and there is no gross negligence on their part, the principle of zero consumer liability applies, requiring banks to reimburse the loss.
• In Paul Onyeji Atuh v State NCT of Delhi, Delhi High Court denied bail to an accused involved in an organised cyber-fraud network using fake online identities. The court highlighted the seriousness and transnational nature of cybercrime.

Bombay HC cyber fraud case

In March 2026, a sitting judge of Bombay High Court was reportedly defrauded of about INR600,000 (USD6,500) through credit card cyber fraud. A first information report was registered under provisions of the Information Technology Act, 2000 (Sections 66, 66C and 66D) and relevant offences under the Bharatiya Nyaya Sanhita, 2023, which is the successor statute of the Indian Penal Code, 1860.

Report cyber fraud via portal/helpline

Citizens can report cyber offences through the National Cyber Crime Reporting Portal or by calling the national cybercrime helpline 1930 for digital fraud, identity theft, phishing and unauthorised banking transactions.

Virtual banking has made monetary transactions comfortable and efficient for millions of consumers. However, the rise of cyber fraud and unauthorised digital transactions has created complicated legal problems regarding consumer liability.

Sana Khan is an Associate Partner and Bijal Parikh is an Associate at SNG & Partners