Reporting Cyber Fraud: Timelines and Your Liability: An Illustrative Scenario

To make the general position concrete, here is an illustrative, hypothetical situation (not a real case) that raises this question.

The illustrative scenario

The question

This raises an obvious question:

How the general rule applies

For transactions before 1 January 2027, RBI's 2017 rules apply: zero liability for the customer if the unauthorised transaction is reported within 3 working days, and limited liability if reported within 4-7 working days.

As a general rule, for transactions from 1 January 2027, under RBI's Amendment Directions (24 Jun 2026), the customer has zero liability for bank negligence, or for a third-party breach reported within 5 calendar days. The exact treatment of a report made later than 5 days is not clearly specified in the new rules.

A one-year compensation pilot allows one-time compensation of 85% of the net loss, capped at ₹25,000, for losses up to ₹50,000, where the customer reports to NCRP/1930 and the bank within 5 days; the bank must prove negligence, and resolution should take 45 days (60 for cross-border transactions).

Under the rules current until 31 December 2026, reporting within 3 working days generally gives zero liability, and 4-7 working days gives limited liability. From 1 January 2027, the window for zero liability (for a third-party breach) is 5 calendar days under RBI's new Amendment Directions.

What often gets missed in situations like this

• Delaying a report because you are embarrassed or unsure what happened — the clock on your liability protection starts from when the fraud occurred, not when you report it.
• Reporting only to the bank and not to 1930/cybercrime.gov.in, or vice versa — both channels matter for different protections.
• Assuming the compensation pilot applies automatically — it is capped, time-limited, and conditional on timely reporting to both the bank and the cyber helpline.

As noted above, this scenario is a constructed illustration used to explain the general rule — it does not describe a real client, case, or outcome.

For the general rules, see Reporting Cyber Fraud: Timelines and Your Liability, Digital Arrest Scams: How They Work and What the Supreme Court Has Directed, and Where to Report Cyber Fraud: Portals, Helplines, and e-Zero FIR.

If this touches a situation you are dealing with, you are welcome to discuss it in a consultation.

This overview is general information, not legal advice. Procedures and local practice can differ, so a specific review of your matter is advisable before acting.