Your phone buzzes while you're standing in a queue. A debit alert. An amount you don't recognise, to a name you've never seen.

For a few seconds, most people do the same thing: they stare at it. They re-read it. They open the app, close it, and wonder if they forgot something. That moment is understandable. It's also the moment to get past as quickly as you can.

No rule says you have exactly one hour. That's our shorthand for acting now. But the Reserve Bank of India is blunt about delay: the longer you take to notify your bank, the higher the risk of loss.

Here's what to do, in order.

The next hour

1. Tell your bank first. Use the official app, the helpline printed on your card, or your bank's website. Don't search for a number online, and don't use one from the message. Once told, banks must take immediate steps to prevent further unauthorised transactions. Ask for a complaint number.

2. Report nationally. RBI's newest directions tell banks to advise customers to report to the bank and also through the National Cyber Crime Reporting Portal or helpline 1930. So do both. Call 1930, and file at cybercrime.gov.in.

3. Cut off access. If you shared your UPI PIN, a password, or an OTP, change what you can and tell your bank exactly what happened.

4. Save everything. Transaction ID, screenshots, the number or UPI ID involved, the message that started it, and the time it all happened.

5. Put it in writing. Follow up with your bank by email or through its complaint channel. Timing can decide who pays, and banks are required to keep a record of when you reported.

Beware of the second scam, too. Someone may contact you claiming they can recover the money for a fee. Our advice: treat anyone who contacts you first as a suspect.

Who bears the loss?

This is where most guides stop, and where the rules are changing. The circular from 2017 covers transactions up to the end of this year. New directions issued in June 2026 apply to transactions on or after January 1, 2027.

Until December 31, 2026 From January 1, 2027
Fault lies elsewhere in the system: zero liability if you report within 3 working days of the bank's communication 5 calendar days of the transaction
Bank must settle your complaint within 90 days 45 calendar days, or 60 if cross-border
You shared credentials You bear the loss until you report Same, with possible small compensation

Notice the clock changes. Today's window starts when your bank tells you. The new one starts when the transaction happens. That's another reason to read your alerts.

The question most victims have

Most fraud victims aren't hacked in the movie sense. They are talked into it. Someone persuades them to approve a request, or read out an OTP. Does that count?

The 2017 circular speaks of unauthorised transactions, and a payment you approved yourself may be disputed under it. Ask your bank for its position in writing.

The new directions go further. They cover payments approved under coercion or duress, as well as transactions made with credentials obtained by fraud. But they also treat giving your credentials to another person, intentionally or otherwise, as customer negligence. So expect arguments about which applies, and keep your evidence.

There's a smaller safety net for that second case. From 2027, a genuine individual victim with a loss up to ₹50,000 can receive 85 per cent of the net loss or ₹25,000, whichever is less, once in a lifetime. It applies only if you reported to both the national portal or helpline and your bank within five calendar days.

One rule is simple in both versions: losses after you report are the bank's to bear. Every minute you wait is a minute that protection hasn't started.

What to expect afterwards

Under the current rules, a bank must credit the amount within 10 working days of your notification where the rules make it liable. Recovery isn't guaranteed, and it can be slow. Keep your complaint numbers and chase in writing. The government reported more than ₹4,386 crore saved across more than 13.36 lakh complaints as of March 2025, through its fast-reporting system. Reporting quickly gives that system a chance to work.

The directions we read are addressed to commercial banks, so if you use another type of bank, ask how its rules apply. This is general information rather than legal advice.

Sources

Updates and corrections

  • 2026-11-03: Rewritten and expanded. Added the RBI directions issued in June 2026, which apply from January 1, 2027. The earlier version covered only the 2017 circular.