What follows is a fictional, illustrative scenario intended only to demonstrate how the general rules above apply to a typical set of facts. It does not describe a real person, client, or case.
The illustrative scenario
A senior citizen is trying to understand reporting cyber fraud. How quickly you need to report an unauthorised transaction, and how the RBI's liability rules are set to change from 1 January 2027.
The question
A reader in this situation might ask:
How quickly do I need to report an unauthorised transaction to avoid liability?
How the general rule applies
For transactions before 1 January 2027, RBI's 2017 rules apply: zero liability for the customer if the unauthorised transaction is reported within 3 working days, and limited liability if reported within 4-7 working days.
As a general rule, for transactions from 1 January 2027, under RBI's Amendment Directions (24 Jun 2026), the customer has zero liability for bank negligence, or for a third-party breach reported within 5 calendar days. The exact treatment of a report made later than 5 days is not clearly specified in the new rules.
A one-year compensation pilot allows one-time compensation of 85% of the net loss, capped at ₹25,000, for losses up to ₹50,000, where the customer reports to NCRP/1930 and the bank within 5 days; the bank must prove negligence, and resolution should take 45 days (60 for cross-border transactions).
Under the rules current until 31 December 2026, reporting within 3 working days generally gives zero liability, and 4-7 working days gives limited liability. From 1 January 2027, the window for zero liability (for a third-party breach) is 5 calendar days under RBI's new Amendment Directions.
What often gets missed in situations like this
- Delaying a report because you are embarrassed or unsure what happened — the clock on your liability protection starts from when the fraud occurred, not when you report it.
- Reporting only to the bank and not to 1930/cybercrime.gov.in, or vice versa — both channels matter for different protections.
- Assuming the compensation pilot applies automatically — it is capped, time-limited, and conditional on timely reporting to both the bank and the cyber helpline.
As noted above, this scenario is a constructed illustration used to explain the general rule — it does not describe a real client, case, or outcome.
For the general rules, see Reporting Cyber Fraud: Timelines and Your Liability, Digital Arrest Scams: How They Work and What the Supreme Court Has Directed, and Where to Report Cyber Fraud: Portals, Helplines, and e-Zero FIR.
Where this applies to a live matter, it is usually worth discussing it in a consultation before acting.
The content above explains how the law generally works; it is not legal advice and should not be treated as a substitute for advice on your particular facts.
This page provides general information about the law in India and is not legal advice. For advice on your specific situation, please consult a qualified advocate.