Lost Money to a Cyber Fraud? Your Bank May Have to Pay It Back

Short answer: Sometimes, yes, and soon possibly more often. On 29 October 2026 the Supreme Court told the RBI that its coming anti-fraud rules must make banks repay victims, no less than the amount lost, when the bank’s own checks failed. That is not law yet. But an RBI rule from 2017 already says that if the fraud was the bank’s lapse or a third-party breach and you report within three working days, you owe nothing, and the bank must put the money back within ten working days while it investigates.

The misconception: “once the money’s gone, it’s your problem”

Most victims hear some version of this at the branch: you were careless, we can’t help. Sometimes that’s true. Often it’s a bluff. Under the 2017 rule, it’s the bank that has to prove you were at fault, not you.

What the Supreme Court actually said

The bench was hearing the suo motu case on digital arrest scams, where a fake officer on a video call “arrests” you and makes you pay to make it go away. The court said the RBI’s draft rules should:

• make banks compensate victims where a failure of due diligence caused the loss;
• let banks temporarily hold transactions that don’t fit a customer’s usual pattern;
• add automated alerts and physical verification;
• have banks alert nearby police when a transfer looks like a digital arrest in progress.

Picture a pensioner whose account sees one withdrawal a month. One afternoon it sends ₹40 lakh to an account it has never paid before. The court’s point: a bank’s system can see that. If it waves the transfer through, it should share the cost.

The court will vet the RBI’s draft before it is notified. There is no date. Some reports mention possible prosecution of banks; that wording is unclear, so we’re leaving it out until the order is published.

The catch

If you shared your OTP or PIN yourself, the 2017 rule calls that negligence and you carry the loss until you report it. The new push is about the cases where the bank should have stopped the transfer even so. That’s a narrower door than the headlines suggest, but it’s a real one.

The rule nobody reads: 6 July 2017

You report within	Your liability
3 working days (bank lapse or third-party breach)	Zero
4–7 working days	Limited, capped
After 7 working days	As per the bank’s board-approved policy

The bank must credit the disputed amount within ten working days of your complaint. The fine print, in other words, is on your side. It just isn’t printed anywhere you’d look.

What to do if it happens

1. Block first. Call your bank’s helpline and block your card, UPI and net banking.
2. Call 1930, the national cyber-fraud helpline. Early calls can freeze money in transit.
3. Email the bank the same day. Write “RBI circular dated 6 July 2017” in the complaint and keep the acknowledgement number.
4. File at cybercrime.gov.in.
5. Escalate after 30 days. If the bank rejects the complaint or doesn’t reply, complain to the RBI Ombudsman at cms.rbi.org.in. It’s free.

The clock starts the moment the money leaves. Every day you wait, the rule protects you a little less.