In the last few years, digital payments have become the backbone of India's daily economy. Over 700 million people now transact via UPI. Hundreds of millions more use internet banking, mobile wallets, and net banking daily. And with that extraordinary scale has come an equally extraordinary fraud problem — one that the Reserve Bank of India has now decided to tackle head-on with its most comprehensive consumer protection framework in the history of Indian digital payments.
The rules are not proposals. The first set landed on April 1, 2026. The full framework goes live on July 1, 2026 — and it fundamentally rewrites what banks owe you when fraud happens on your account.
Why the RBI Had to Act Now
Digital fraud in India has been growing faster than digital payments themselves. Scammers have evolved from crude phishing emails to sophisticated SIM-swap attacks, social engineering schemes, and a vast underground economy of mule accounts — bank accounts operated by unwitting or complicit third parties used to launder stolen funds across dozens of transactions before the money disappears.
The existing framework placed most of the burden on the victim — to report promptly, to prove negligence was not theirs, and to wait months for a resolution that often delivered nothing. The new rules fundamentally reverse that burden. Banks must now demonstrate they met their security obligations, or they bear the financial liability.
⚠️ Critical Deadline: If you have not updated your bank's two-factor authentication settings since April 1, 2026, some new protections may not apply to your account until your bank notifies you of the upgrade. Check your banking app for a security settings update notification this week.
The 7 New Rules — What Each One Does
Rule 1: ₹25,000 Fraud Compensation
If your bank fails to detect or prevent an unauthorised transaction and you report it within the prescribed window, you are entitled to compensation of up to ₹25,000 per incident — paid by the bank, not the payment network.
Rule 2: The Payment Kill-Switch
Every bank and UPI app must now offer a single-button "kill-switch" that instantly suspends all outgoing transactions from your account — accessible within 3 taps from the app home screen, 24 hours a day.
Rule 3: High-Value Transaction Delay
For first-time UPI transfers above a threshold to new beneficiaries, banks must implement a mandatory processing delay — giving users a window to reverse suspicious transactions before funds clear.
Rule 4: End of OTP-Only Authentication
OTP alone is no longer sufficient for high-risk transactions. Banks must implement device binding, behavioural biometrics, or a second independent channel — reducing SIM-swap fraud which OTP-only systems cannot stop.
Rule 5: Mule Account Ceiling
Accounts identified as mule accounts — used to pass stolen funds — now face a hard transaction ceiling of ₹25 lakh per month and automatic flagging after 3 unusual inflows.
Rule 6: 24-Hour Fraud Response SLA
Banks must acknowledge fraud complaints within 1 hour and provide a resolution or interim credit within 24 hours — previously, resolution stretched weeks with no guaranteed interim relief.
Rule 7: Cross-Bank Fraud Intelligence Sharing
All scheduled commercial banks must now share fraud patterns and flagged account identifiers on a centralised RBI platform in real time.
What's Already Live vs. What's Coming on July 1
| Protection Measure | Status | What It Means for You |
|---|---|---|
| Two-Factor Authentication upgrade (beyond OTP) | Live — Apr 1 | Your bank app may prompt device binding or biometric verification |
| New beneficiary payment delay window | Live — Apr 1 | First payment to a new account may show a short, intentional delay |
| ₹25,000 fraud compensation right | Jul 1, 2026 | Banks must set up compensation infrastructure and publish their claims process |
| Payment kill-switch mandate | Jul 1, 2026 | All banking apps must add the single-button suspend feature |
| 24-hour fraud resolution SLA | Jul 1, 2026 | Banks must have staffed 24/7 fraud response teams operational |
| Mule account ceiling (₹25 lakh/month) | Jul 1, 2026 | Automated detection systems must be live and reporting to RBI |
| Cross-bank fraud intelligence sharing | Jul 1, 2026 | Centralised RBI fraud database goes live across all banks |
The Implementation Timeline
RBI Circular Published
RBI formally issued the framework, giving banks a phased implementation window with April 1 and July 1 as the two key milestones.
Phase 1: Authentication Upgrades + Delay Window — Now Live
All scheduled banks must now require something beyond OTP for high-value transactions, plus the new beneficiary delay window.
Banks Must Publish Compensation Process
Each bank must publish the exact procedure for filing a fraud compensation claim, ahead of the July 1 rights activation.
Phase 2: Full Framework Live
All seven protections fully active. ₹25,000 compensation right enforceable. Kill-switch mandatory. 24-hour SLA begins.
What This Means for Your Investments and Savings
The immediate impact is on everyday digital transactions. But there is a broader financial planning dimension worth understanding — especially for investors with mutual fund folios, brokerage accounts, and savings linked to digital platforms.
Many digital investment platforms — including those used for SIP mandates, redemption requests, and portfolio rebalancing — operate through the same UPI and net banking rails that these new rules cover. However, they will also introduce occasional short delays on first-time beneficiary additions — for example, the first time you add a new bank account for SIP debits or redemption credits.
📋 Your 8-Point Digital Safety Checklist — Do This This Week
- Update your banking app to the latest version — banks are pushing the Phase 1 authentication upgrade via app updates
- Enable device binding or biometric login if your bank has offered it — do not skip this prompt
- Note your bank's fraud helpline — the new 1-hour acknowledgement SLA starts from the moment you call
- Check your UPI app settings for a "pause payments" or "lock account" option
- Review all standing instructions — confirm SIP mandates and regular transfers are linked to verified beneficiaries
- Never share OTPs, CVVs, or PINs — zero-liability covers only bank-side failures, not voluntary disclosure
- Screenshot the compensation process once your bank publishes it in June
- Set up transaction alerts for every debit above ₹1,000
The Limits of the Rules — What They Don't Cover
The new framework is significant but not unlimited. Three critical exclusions every user must understand:
- Voluntary disclosure is not covered. If you share your OTP, PIN, or password with a fraudster — even under social engineering pressure — the zero-liability and compensation framework does not apply.
- The ₹25,000 ceiling is per incident, not per account. For high-value fraud, the compensation is only a partial remedy. Civil and police proceedings remain the path to full recovery for larger amounts.
- The 24-hour SLA applies to acknowledgement and interim credit, not final resolution. Complex cases may take longer to fully investigate.
How NovaRock Advisory Clients Are Protected
For clients of NovaRock Advisory, the new RBI framework adds an important additional layer to the security infrastructure that already governs your mutual fund and investment portfolio. All investment transactions through our advisory — SIP initiations, redemption requests, portfolio rebalancing — are processed through AMFI-compliant, SEBI-regulated channels with their own independent security frameworks. The RBI's new rules augment — rather than replace — the investor protection mechanisms already embedded through AMFI and the RTAs (Registrar and Transfer Agents).
If you have any questions about the security of your investment transactions, reach out to our team directly. A 30-minute review costs nothing and could prevent a significant loss.
Protect Your Financial Future — Talk to an Expert
Stay ahead of regulatory changes with SEBI-compliant, AMFI-registered advisory from NovaRock. One consultation. Zero obligations.