The Reserve Bank of India (RBI) plays a central role in making digital payments safer and protecting banking customers in India. It regulates payment systems, issues security directions, supervises regulated institutions and establishes rules for handling unauthorised transactions, failed payments and customer complaints.
Whether someone pays through UPI, uses a debit or credit card, transfers money through NEFT or IMPS, or accesses a bank account through mobile banking, RBI's regulatory framework influences how these services operate. It requires banks and payment service providers to maintain appropriate security arrangements and take responsibility for the services they offer.
RBI's consumer-protection framework also explains when a customer may have limited or zero liability for an unauthorised electronic transaction, how banks should handle delayed reversals, and where customers can escalate unresolved complaints.
This guide explains RBI's responsibilities, important digital payment rules, customer rights and the steps users should take when they experience payment fraud or a banking service problem.
What Is RBI's Role in Protecting Digital Payment Users?
The Reserve Bank of India is the country's central bank and the principal regulator of banking and payment systems. Its responsibilities extend beyond monetary policy. It also establishes the regulatory framework that governs how authorised payment systems operate and how regulated institutions protect their customers.
The Payment and Settlement Systems Act, 2007 provides the legal framework for regulating and supervising payment systems in India. Under this law, RBI acts as the designated authority for payment-system regulation and supervision.
The Act covers payment arrangements that enable money transfers between a payer and a beneficiary. These include systems involving card payments, electronic funds transfers and other payment services. RBI can prescribe conditions, issue directions and oversee entities operating payment systems under the applicable legal framework.
RBI's official overview of payment and settlement systems explains its role in developing safe, secure, sound, efficient, accessible and authorised payment systems.
For customers, this regulatory role has practical importance. It helps establish:
- Security requirements for digital banking and payment services.
- Authentication standards for electronic transactions.
- Responsibilities of banks and payment system participants.
- Rules for handling unauthorised electronic banking transactions.
- Time limits and compensation for specified failed transactions.
- Grievance redress mechanisms for unresolved banking complaints.
- Requirements for customer awareness, transparency and fair treatment.
RBI performs these functions through different departments, regulatory directions, supervisory arrangements and statutory powers. Its official departmental information explains the responsibilities of its various departments, including the Department of Payment and Settlement Systems and the Consumer Education and Protection Department.
How Does RBI Set Digital Payment Security Standards?
Digital payment security requires more than a password or one-time password. Banks and payment operators must protect their applications, networks, customer information, transaction-processing systems and communication channels.
RBI issues regulatory directions that establish security expectations for different categories of institutions. These directions cover governance, authentication, fraud monitoring, incident response, customer protection and other technical controls.
1. Setting Security Requirements for Banks and Payment Operators
RBI requires regulated institutions to establish appropriate security arrangements for their digital payment products and services. These requirements help ensure that banks do not treat cybersecurity as merely a technical issue but include it in their management, risk assessment and operational responsibilities.
A major regulatory development is the Reserve Bank of India (Commercial Banks - Digital Payment Security Controls) Directions, 2026, issued on 31 July 2026 and updated on 1 October 2026.
These directions apply to the commercial banks specified in the framework and cover digital payment products and services, including internet banking, mobile banking and card-related services. They address the following areas:
- Board-level oversight and approved security policies.
- Governance and management of digital payment security risks.
- Security controls for applications and technology infrastructure.
- Authentication frameworks for digital transactions.
- Fraud-risk monitoring and management.
- Transaction reconciliation mechanisms.
- Customer protection, awareness and grievance redressal.
- Specific security controls for internet banking, mobile applications and card payments.
Customers do not need to understand every technical requirement. However, these directions establish that banks must maintain appropriate safeguards and take responsibility for the security of their digital payment services.
Read the official RBI Digital Payment Security Controls Directions, 2026.
2. Strengthening Cybersecurity for Non-Bank Payment System Operators
Digital payments also depend on non-bank payment system operators. These entities provide or operate payment infrastructure and services that support transactions between customers, merchants and financial institutions.
RBI issued consolidated Master Directions on Cyber Resilience and Digital Payment Security Controls for Non-Bank Payment System Operators on 5 November 2026.
The directions bring relevant cybersecurity and payment-security instructions into a consolidated framework. They cover governance, cybersecurity preparedness, risk assessment, access management, network security, application security, security testing, vendor risk, data protection, incident response and business continuity.
They also contain specific digital payment security measures for mobile payments, card payments and prepaid payment instruments.
This is important because the security of a digital transaction depends on several participants, not just the bank holding the customer's account. RBI's framework addresses the responsibilities of authorised non-bank payment system operators as well.
Read the RBI directions dated 5 November 2026 for non-bank Payment System Operators.
3. Strengthening Payment Authentication and Transaction Security
Authentication is the process of verifying the credentials of the customer who initiates a payment instruction. It helps establish whether the person attempting to make a transaction has the required authority.
RBI has issued the Authentication Mechanisms for Digital Payment Transactions Directions, 2025 to provide a framework for secure authentication across domestic digital payments.
The directions recognise the existing requirement for two-factor authentication in digital payment transactions while allowing the payment ecosystem to use different authentication technologies. They do not prescribe SMS OTP as the only acceptable second factor for every transaction.
The framework applies to payment system providers and participants, including banks and non-bank entities, subject to the specified exemptions. The compliance deadline was 1 April 2026.
Under the framework, authentication mechanisms must follow principles relating to reliability, security, risk assessment and responsibility of the issuer. This allows payment providers to adopt suitable technologies while maintaining the required level of transaction security.
For customers, the practical point is that RBI does not require every digital payment to use SMS OTP specifically. The applicable authentication requirements depend on the transaction and the framework governing it.
Read the Authentication Mechanisms for Digital Payment Transactions Directions, 2025.
4. Requiring Fraud Monitoring and Risk Management
Even a transaction that passes authentication checks may involve suspicious activity. For this reason, RBI also focuses on fraud monitoring and risk management.
Its digital payment security directions require covered banks to maintain arrangements for identifying, assessing and managing fraud risks. These arrangements may include monitoring transaction patterns, analysing suspicious activity, reviewing unusual behaviour and strengthening controls when new risks emerge.
For example, a bank may need to examine unusual transaction frequency, activity that differs from a customer's normal behaviour or suspicious transactions involving newly activated digital services.
RBI's framework also addresses reconciliation, which helps institutions identify differences between transaction records and payment-system information. Proper reconciliation is important when a payment is debited but the beneficiary does not receive the money or when the transaction status remains unclear.
These requirements encourage banks to identify and respond to payment risks rather than relying only on customers to report problems after money has been lost.
5. Improving Cyber Resilience and Incident Preparedness
Cyber resilience means an institution's ability to prepare for, withstand, respond to and recover from cyber incidents or technology disruptions.
RBI's cybersecurity framework addresses risk assessment, security testing, third-party dependencies, incident response, business continuity and recovery arrangements. These controls help payment institutions prepare for incidents that could disrupt services or compromise customer information.
The November 2026 directions for non-bank Payment System Operators include requirements covering cybersecurity preparedness, incident response, business continuity, cloud security and other security measures.
For customers, these arrangements are important because a payment service must remain secure and reliable even when an institution faces a cyberattack, system failure or other operational disruption.
6. Protecting Customer Data and Payment Credentials
Digital banking involves sensitive information, including account details, card information, mobile numbers, passwords, PINs and transaction records. Protecting this information is an essential part of payment security.
RBI's security directions address access controls, application security, data protection, technology risk and the responsibilities of institutions using third-party service providers.
Its authentication framework also addresses the responsibility of issuers and compliance with applicable data-protection requirements.
However, customers should understand that payment security and data privacy involve more than one law or regulator. RBI's directions operate alongside other applicable legal requirements, including the Ministry of Electronics and Information Technology's framework for digital personal data protection.
How Does RBI Protect Banking Consumers?
RBI's consumer-protection framework focuses on fair treatment, transparent banking practices, customer privacy, suitable services and effective grievance redressal.
These principles apply to the broader banking relationship and are particularly important when customers use digital payment services, open accounts, obtain cards or raise transaction disputes.
1. Promoting Fair Treatment, Transparency and Customer Choice
RBI formulated the Charter of Customer Rights to establish broad principles for protecting bank customers. It identifies five basic rights:
- Right to Fair Treatment: Banks should treat customers fairly and without discrimination.
- Right to Transparency, Fair and Honest Dealing: Customers should receive clear and understandable information about banking products, services, charges and risks.
- Right to Suitability: Banks should offer products and services that are appropriate to the customer's needs and circumstances.
- Right to Privacy: Banks should protect customer information and handle it responsibly.
- Right to Grievance Redress and Compensation: Customers should have access to effective complaint-handling arrangements and eligible compensation.
RBI has advised banks to incorporate these rights into their board-approved customer-rights policies and establish arrangements to monitor compliance.
The Charter provides overarching principles. Specific RBI directions translate these principles into operational requirements for banks and other regulated institutions.
Read RBI's official consumer education and protection overview and its Charter of Customer Rights announcement.
2. Explaining Customer Rights and Responsibilities in Digital Payments
Customers should know how a payment service works before using it. RBI's digital payment security directions require covered banks to address customer protection, awareness and grievance redressal as part of their security arrangements.
This includes explaining important risks, providing relevant information about digital services and maintaining channels through which customers can report problems.
For example, customers should be able to understand how to report a suspicious transaction, block or protect a compromised payment instrument, raise a dispute and obtain information about the status of a complaint.
These requirements also reinforce the importance of customer awareness. Users must protect their PINs, passwords and OTPs and avoid approving payment requests that they do not understand.
3. Defining Responsibilities for Unauthorised and Fraudulent Transactions
One of RBI's most important consumer-protection measures is its framework for limiting customer liability in unauthorised electronic banking transactions.
An unauthorised transaction generally involves an electronic banking transaction that the customer did not authorise. The applicable framework examines the circumstances of the transaction, the responsibility of the bank or other parties, the customer's conduct and how quickly the customer reported the incident.
Under the existing customer-liability framework, a customer may receive zero liability in specified circumstances, including:
- When the unauthorised transaction results from fraud, negligence or deficiency on the part of the bank, irrespective of when the customer reports it.
- When the breach occurs elsewhere in the system, neither the bank nor the customer is responsible, and the customer reports the transaction within three working days of receiving the bank's communication about it.
Where the customer is responsible for sharing payment credentials or other negligent conduct, the customer may bear the loss until reporting the unauthorised transaction. The bank bears losses occurring after the customer reports the incident, subject to the applicable framework.
For certain third-party breaches reported after three working days but within seven working days, the customer's liability is limited according to the applicable category and prescribed limits.
These rules make the reporting time extremely important. Customers should inform their bank immediately after noticing an unauthorised transaction rather than waiting for the next statement.
RBI's existing framework is available in its Responsible Business Conduct Directions and the original 2017 customer-liability notification.
Important Change from 1 January 2027: Revised Customer Liability Rules
RBI issued revised instructions on limiting customer liability in unauthorised electronic banking transactions on 24 June 2026. These instructions apply to transactions undertaken on or after 1 January 2027.
As of 9 November 2026, the revised instructions have been issued but have not yet become applicable to transactions made before their commencement date.
The revised framework introduces clearer definitions and responsibilities relating to fraudulent electronic banking transactions, bank negligence, customer negligence and third-party breaches. It also provides for a provisional credit mechanism known as shadow reversal in specified circumstances.
Under shadow reversal, a bank may provide a temporary or provisional credit for the amount involved in a fraudulent electronic banking transaction after receiving the customer's notification, before completing its internal investigation or related settlement process. The customer cannot use this temporary amount while it remains provisional, and the framework provides that the customer should not bear an additional interest or charge burden on it.
The revised directions also specify circumstances that may constitute bank negligence, such as failure to provide mandatory transaction alerts, lack of 24-hour reporting channels or failure to act diligently after receiving a customer's notification.
They also describe customer negligence, including sharing payment credentials, failing to report fraud promptly, ignoring clear bank warnings about a suspected scam or downloading malicious applications.
Customers should therefore distinguish the existing framework from the revised provisions that will apply from 1 January 2027.
Read the RBI Commercial Banks - Responsible Business Conduct Third Amendment Directions, 2026.
4. Setting Reversal and Compensation Rules for Failed Payments
A failed transaction is different from a fraudulent transaction. A payment may fail because of a communication problem, technical timeout, system disruption or other reason not attributable to the customer.
For example, a UPI or IMPS transaction may debit the sender's bank account even though the beneficiary does not receive the money. Similarly, an ATM may debit an account without dispensing cash.
To address these problems, RBI introduced a harmonised Turnaround Time (TAT) and customer compensation framework for specified failed transactions using authorised payment systems.
The framework establishes outer limits for resolving different types of failed transactions. Where compensation is payable, the bank or payment system participant must credit it automatically without waiting for the customer to submit a separate compensation claim.
Some important examples under the framework are:
| Type of failed transaction | Prescribed resolution period | Compensation for applicable delay |
|---|---|---|
| ATM transaction: account debited but cash not dispensed | Maximum T+5 days | ₹100 per day beyond the prescribed period. |
| IMPS transfer: sender debited but beneficiary not credited | Maximum T+1 day | ₹100 per day beyond the prescribed period. |
| UPI fund transfer: account debited but beneficiary not credited | Maximum T+1 day | ₹100 per day beyond the prescribed period. |
| UPI merchant payment: account debited but merchant confirmation not received | Maximum T+5 days | ₹100 per day beyond the prescribed period. |
| Specified card payment and transfer failures | Depends on the transaction category | ₹100 per day for the applicable delay under the framework. |
T means the calendar date of the transaction. The applicable turnaround period depends on the type of payment failure. The table provides common examples, not a complete list of every category covered by the framework.
Customers should first raise a complaint through their bank or payment provider and retain the transaction reference number. If the specified reversal or compensation does not take place, they can use the applicable grievance redress mechanism.
Read RBI's official FAQ on turnaround time and compensation for failed transactions.
5. Protecting Customers Using Recurring Digital Payments
Many customers use recurring payments for subscriptions, insurance premiums, utility bills, loan instalments and other regular services. These payments may be processed through cards, prepaid payment instruments or UPI mandates.
RBI regulates these arrangements through its Digital Payments - E-mandate Framework, 2026, issued on 21 April 2026.
The framework requires customers to complete a registration process before using an e-mandate. The registration must include additional factor authentication as prescribed by the directions.
It also establishes important customer protections:
- Customers must be able to view the validity period of a registered e-mandate.
- Issuers must provide a facility to modify or withdraw an e-mandate.
- Customers must receive information about the available notification arrangements.
- A pre-transaction notification must generally be sent at least 24 hours before the scheduled debit.
- Customers must receive post-transaction information as specified in the framework.
- Applicable transaction limits and dispute-resolution arrangements must be followed.
These requirements help customers remain informed about recurring debits and retain control over their registered mandates.
For example, if a customer has authorised a recurring payment for a subscription, the applicable notification framework helps them know about the upcoming debit. If they no longer want the service, they can use the prescribed mandate withdrawal facility.
What Should Customers Do If They Experience Digital Payment Fraud?
RBI's customer-liability framework makes timely reporting important. If a customer notices an unauthorised debit, suspicious card transaction or fraudulent electronic payment, they should contact the bank immediately.
Do not wait for the bank statement or assume that the money will automatically return. Quick reporting helps the bank take steps to prevent further unauthorised transactions and creates an official record of the complaint.
Steps to Follow After an Unauthorised Transaction
- Contact your bank immediately: Use the bank's official helpline, mobile application, internet banking facility or branch to report the transaction.
- Request blocking of the affected payment instrument: If your debit card, credit card, mobile banking access or other payment credential is compromised, ask the bank to block or secure it.
- Register an official complaint: Obtain a complaint or service-request number and retain the acknowledgement.
- Record transaction details: Note the amount, date, time, transaction reference number and any relevant communication.
- Change compromised credentials: If you suspect that your password, PIN or other credentials have been exposed, change them through official banking channels using a trusted device.
- Report cyber financial fraud: For online financial fraud, immediately contact the national cybercrime helpline at 1930 and submit the complaint through the National Cyber Crime Reporting Portal.
- Follow up with the bank: Keep the complaint acknowledgement and request an update on the investigation, liability assessment and applicable refund or compensation.
Reporting the incident to the bank and reporting it through the national cybercrime system serve different purposes. The bank handles the banking complaint and applicable customer-liability assessment, while the police and cybercrime authorities deal with the criminal aspect.
Why Is Immediate Reporting Important?
Under RBI's customer-liability framework, the time taken to notify the bank can affect how responsibility for an unauthorised transaction is determined.
In specified third-party breach cases, reporting within three working days of receiving the bank's communication can support zero customer liability. Delayed reporting may lead to a different liability assessment under the applicable rules.
Therefore, customers should report suspicious transactions as soon as they notice them, even if they are not yet certain how the fraud occurred.
How Does RBI Strengthen Grievance Redress and Institutional Accountability?
RBI requires regulated institutions to maintain customer grievance arrangements and provide appropriate channels for resolving complaints. A customer should generally approach the bank or payment service provider first before escalating an unresolved service complaint to RBI.
These arrangements help customers raise issues such as unauthorised transactions, delayed reversals, incorrect charges, failed payments, service deficiencies and other banking-related problems.
1. Internal Bank Complaint Mechanism
Every bank should provide a mechanism through which customers can submit complaints and track their resolution. Customers can normally use the following channels:
- Customer care or the bank's official helpline.
- Mobile banking or internet banking complaint facilities.
- Official email or online grievance forms.
- Bank branch complaint desks.
- The bank's designated grievance redressal or nodal officer.
When raising a complaint, customers should provide the transaction reference, date, amount, account details required by the bank and a clear description of the issue. They should avoid sending passwords, PINs or OTPs in complaint messages.
Customers should retain the complaint acknowledgement because it may be required when escalating the matter to RBI.
2. Reserve Bank - Integrated Ombudsman Scheme, 2026
The Reserve Bank - Integrated Ombudsman Scheme, 2026 (RB-IOS, 2026) provides a cost-free alternate grievance redress mechanism for eligible complaints involving deficiency in service by regulated entities covered under the Scheme.
The Scheme came into effect on 1 July 2026, replacing the Reserve Bank - Integrated Ombudsman Scheme, 2021. It follows a unified complaint-handling approach and provides a common platform for eligible customers to seek redress.
Its major features include:
- Cost-free grievance redress for eligible customers.
- A centralised complaint lodging portal.
- Jurisdiction-neutral complaint handling.
- Online tracking of complaint status.
- A structured settlement process.
- Power to pass awards in eligible cases, including compensation within the prescribed limits.
- Provision for appeal under the Scheme.
The Scheme does not cover every financial dispute or every regulated entity automatically. Its applicability depends on the entity and complaint category specified in the Scheme.
Customers can read the official RBI Integrated Ombudsman Scheme, 2026 FAQs.
3. When Can a Customer File a Complaint with the RBI Ombudsman?
A customer should first submit a complaint to the concerned bank or regulated entity. They can approach the RBI Ombudsman when:
- The regulated entity rejects the complaint wholly or partly and the customer is not satisfied with the response.
- The customer does not receive a reply within 30 days of the regulated entity receiving the complaint, or within the applicable period specified by RBI, NPCI or the relevant card network guidelines, whichever is higher.
Customers should also check the Scheme's other admissibility conditions before filing. A complaint may not be maintainable if it falls outside the Scheme's coverage or relates to an excluded matter.
4. How to File a Complaint Through RBI's CMS Portal
Eligible customers can submit their complaints through the RBI Complaint Management System (CMS). The portal provides a centralised facility for lodging and tracking complaints.
- Visit the official RBI Complaint Management System.
- Select the option to lodge a complaint under the applicable RBI grievance redress framework.
- Enter the required personal and contact information.
- Provide the name of the bank or regulated entity against which the complaint is being filed.
- Enter the details of the original complaint submitted to the institution.
- Explain the issue and the resolution you are seeking.
- Upload relevant supporting documents, such as complaint acknowledgements, bank responses and transaction records.
- Submit the complaint and save the acknowledgement or reference number.
Customers can also submit complaints through email at [email protected] or through the prescribed physical complaint process at the Centralised Receipt and Processing Centre.
RBI's Contact Centre provides assistance regarding the grievance redress process. Customers can call the toll-free number 14448 for information and guidance. The contact centre does not itself register an Ombudsman complaint; customers must use the prescribed complaint channels.
For complete instructions, read the RBI Ombudsman Scheme, 2026 FAQs.
How Does RBI Monitor Compliance and Take Enforcement Action?
Issuing directions is only one part of RBI's regulatory work. The Reserve Bank also supervises regulated institutions to examine whether they follow applicable laws, directions and regulatory requirements.
Its supervisory activities may examine areas such as digital payment security, customer service, fraud-risk management, transaction monitoring, grievance handling and compliance with customer-protection rules.
Where RBI identifies regulatory violations, it may take appropriate action under its statutory powers. Depending on the circumstances, this can include directions, restrictions or monetary penalties.
For example, RBI has issued penalty announcements concerning failures to comply with customer-protection requirements relating to unauthorised electronic transactions and compensation obligations.
Read RBI's official regulatory penalty announcement for an example of enforcement action involving customer-protection requirements.
Regulatory Penalty and Customer Compensation Are Different
A regulatory penalty and customer compensation serve different purposes.
- Regulatory penalty: RBI imposes a penalty on an institution for a regulatory violation or failure to comply with applicable requirements.
- Customer compensation: The bank or responsible institution pays an eligible customer according to the applicable compensation, liability or grievance-redress framework.
Therefore, an RBI penalty does not automatically mean that every affected customer will receive a refund. Individual claims must be assessed under the applicable rules and circumstances.
How Does RBI Promote Fraud Awareness and Safer Banking?
Customer awareness is an important part of RBI's digital payment safety approach. Even when banks maintain security controls, customers can face risks from phishing, fake customer-care numbers, remote-access applications, fraudulent payment requests and social engineering.
RBI publishes awareness material to help people understand common fraud techniques and adopt safer banking practices. Its consumer education activities include publications, awareness campaigns and information about customer rights and responsibilities.
BE(A)WARE and Other Financial Awareness Material
RBI's BE(A)WARE booklet explains common financial fraud methods and provides practical precautions for customers. It helps readers understand how fraudsters use digital channels, impersonation and misleading communication to obtain money or confidential information.
RBI also publishes other awareness resources, including The Alert Family, to explain financial risks and encourage safer banking behaviour.
Customers can explore RBI's Consumer Education and Protection resources and its consumer protection publications.
Important Safety Practices for Digital Payment Users
Customers can reduce common digital payment risks by following a few essential precautions:
- Never share an OTP, UPI PIN, ATM PIN, CVV or internet banking password with another person.
- Do not approve a UPI collect request or payment request unless you understand why the other party is asking for it.
- Remember that entering a UPI PIN generally authorises a payment; it is not required merely to receive money.
- Do not install unknown applications or grant remote access to people claiming to be bank officials.
- Use only official bank applications and websites.
- Check the beneficiary name and payment amount before confirming a transfer.
- Enable transaction alerts and check account statements regularly.
- Contact the bank immediately if you notice an unknown transaction.
- Use official customer-care numbers rather than numbers found in random search results or social media posts.
- Keep your mobile operating system, banking applications and security software updated.
These precautions complement RBI's regulatory framework. Banks and payment providers must maintain appropriate safeguards, while customers should protect their credentials and report suspicious activity without delay.
How Does RBI's Role Differ from Banks, NPCI and Cyber Crime Police?
Several institutions contribute to the safety and operation of India's digital payment ecosystem. Their responsibilities are connected, but they are not interchangeable.
| Organisation | Primary role in digital payment safety |
|---|---|
| Reserve Bank of India (RBI) | Regulates and supervises payment systems, issues security directions, establishes customer-protection rules and oversees eligible grievance redress mechanisms. |
| Banks | Provide banking services, maintain required security controls, monitor transactions, handle customer complaints and fulfil applicable refund, reversal and compensation obligations. |
| National Payments Corporation of India (NPCI) | Develops and operates retail payment infrastructure and systems such as UPI, IMPS and other payment services within the applicable regulatory framework. |
| Cyber Crime Police | Receive and investigate cybercrime complaints, collect evidence and take legal action against suspected offenders under applicable laws. |
| National Cyber Crime Reporting Portal | Provides a government facility for reporting cybercrime, including online financial fraud. |
RBI vs Banks
RBI establishes the regulatory requirements, while banks implement them in their banking services. For example, RBI prescribes applicable security and customer-liability requirements, but the customer's bank receives the transaction complaint, examines the account records and takes the required action.
RBI vs NPCI
RBI regulates and supervises payment systems, while NPCI provides and operates important retail payment infrastructure. UPI is one of the payment systems developed by NPCI.
Customers can read the official NPCI UPI FAQs to understand UPI services and common transaction-related questions.
RBI also operates certain payment infrastructure itself, including NEFT and RTGS. Its official information about Centralised Payment Systems explains the systems operated by the Reserve Bank.
RBI vs Cyber Crime Police
RBI deals with regulatory supervision, banking customer protection and payment-system requirements. Police and competent law enforcement agencies investigate criminal cyber fraud.
For example, if someone loses money through a fake UPI payment request, they should report the incident to their bank and immediately use the national cybercrime reporting channels. The bank handles the banking complaint and applicable liability assessment, while law enforcement agencies investigate the criminal activity.
The Government explains the responsibility of State and Union Territory law enforcement agencies for cybercrime investigation and related legal action.
Frequently Asked Questions About RBI and Digital Payment Safety
Does RBI Regulate Digital Payments in India?
Yes. RBI is the designated authority for regulating and supervising payment systems under the Payment and Settlement Systems Act, 2007. It issues directions and oversees authorised payment system operators and participants.
What Is RBI's Role in Digital Payment Safety?
RBI establishes security requirements for regulated banks and payment operators, prescribes authentication principles, oversees fraud-risk management and creates customer-protection and grievance-redress frameworks.
Does RBI Regulate UPI Transactions?
RBI regulates and supervises payment systems under the applicable legal framework. NPCI develops and operates UPI as a retail payment system. Banks and other participants provide services and handle customer issues according to applicable rules.
Does RBI Require OTP for Every Digital Payment?
No. RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025 provide principles for authentication and recognise different authentication technologies. They do not make SMS OTP the only acceptable authentication method for every transaction.
What Is RBI's Two-Factor Authentication Rule?
RBI's authentication framework requires applicable digital payment transactions to follow the prescribed authentication requirements. Two-factor authentication remains the general norm, subject to specified exemptions and the applicable directions.
What Is the RBI Rule for Unauthorised Digital Transactions?
RBI has established a customer-liability framework that determines whether a customer has zero, limited or other liability for an unauthorised electronic banking transaction. The assessment depends on factors such as bank negligence, third-party breach, customer negligence and the time taken to report the incident.
How Quickly Should I Report an Unauthorised Bank Transaction?
Report it to your bank immediately after noticing it. Under the existing framework, the reporting period can affect customer liability, particularly in specified third-party breach cases where notification within three working days may support zero liability.
Will RBI Refund Money Lost Through Online Payment Fraud?
RBI does not automatically refund every amount lost through online fraud. The bank and other responsible institutions must assess the transaction under the applicable customer-liability rules. The customer should report the incident immediately to the bank and the appropriate cybercrime authorities.
What Is the RBI Rule for a Failed UPI Transaction?
For a UPI fund transfer where the sender's account is debited but the beneficiary does not receive the money, the applicable failed-transaction framework generally provides for auto-reversal within T+1 day. Compensation of ₹100 per day applies for delays beyond the prescribed period, subject to the framework's conditions.
What If Money Is Debited but the Merchant Does Not Receive a UPI Payment?
This is treated differently from a failed person-to-person fund transfer. Under the applicable RBI framework, a UPI merchant payment where the account is debited but confirmation is not received at the merchant location has an auto-reversal period of T+5 days, with applicable compensation for delays beyond the prescribed period.
Is RBI Compensation for Failed Transactions Automatic?
Where compensation is payable under the specified failed-transaction framework, it should be credited automatically without waiting for a separate customer claim. Customers should still contact their bank if the reversal or compensation does not take place within the applicable period.
What Is the RBI E-mandate Rule for Recurring Payments?
RBI's Digital Payments - E-mandate Framework, 2026 governs recurring payments made through cards, prepaid payment instruments and UPI. It includes registration, authentication, notification, transaction-limit and mandate-withdrawal requirements.
What Is the Reserve Bank - Integrated Ombudsman Scheme, 2026?
It is RBI's cost-free alternate grievance redress mechanism for eligible complaints involving deficiency in service by regulated entities covered under the Scheme. It came into effect on 1 July 2026 and replaced the 2021 Scheme.
When Can I Complain to the RBI Ombudsman?
You should first complain to the concerned bank or regulated entity. You can approach the RBI Ombudsman if the institution rejects your complaint wholly or partly and you are dissatisfied, or if it does not provide a reply within 30 days or the applicable higher period specified under relevant guidelines.
How Can I File a Complaint with RBI Online?
You can submit an eligible complaint through the official RBI Complaint Management System (CMS). The portal allows customers to lodge complaints and track their status.
What Is RBI's Complaint Helpline Number?
RBI's Contact Centre can be reached through the toll-free number 14448 for information and assistance regarding the grievance redress mechanism. Customers must still submit their complaints through the prescribed channels.
Should I Contact RBI or the Cybercrime Helpline for Online Financial Fraud?
If you have lost money through online financial fraud, immediately contact the national cybercrime helpline at 1930 and report the incident through the National Cyber Crime Reporting Portal. You should also report the unauthorised transaction to your bank. RBI's Ombudsman mechanism is for eligible unresolved service complaints, not a substitute for immediate cybercrime reporting.
Does RBI Take Action Against Banks That Violate Customer-Protection Rules?
Yes. RBI can take supervisory and enforcement action under its statutory powers when it identifies violations of applicable regulatory requirements. Depending on the circumstances, this may include monetary penalties or other regulatory measures.
Conclusion
The Reserve Bank of India plays a major role in making India's digital payment ecosystem safer and strengthening banking consumer protection. Through the Payment and Settlement Systems Act, banking regulations and digital payment security directions, RBI establishes the requirements that banks and authorised payment operators must follow.
Its customer-protection framework also provides important safeguards relating to unauthorised electronic transactions, failed-payment reversals, recurring payment mandates, transparency and grievance redressal. The Integrated Ombudsman Scheme, 2026 gives eligible customers an additional route when a regulated institution does not resolve a service complaint satisfactorily.
However, customers should also understand their responsibilities. Protecting payment credentials, checking transaction details and reporting suspicious activity immediately can make a significant difference when fraud occurs.
For the latest regulatory directions, consumer-protection information and complaint facilities, always refer to the official Reserve Bank of India website.