Fraud, Disputes, and Chargebacks
When fraud happens, two clocks start at once — the user's and the institution's. Both are watched.
Why this is on a data and AI site: a fraud dispute runs on personal data. Transaction logs, device details and identity checks are all personal data under the DPDP Act. From 13 May 2027 you must keep them secure (Section 8(5), Rule 6) and report a breach (Section 8(6), Rule 7). If you use AI to flag fraud, a regulated entity stays answerable for that tool's output.
If fraud hits a financial product, two speeds decide who bears the loss: how fast you reported it, and how fast the institution responded once you did. Delay on either side can shift where liability lands.
This structure comes from RBI's circular of 6 July 2017 on limiting customer liability in unauthorised electronic banking transactions (RBI/2017-18/15, DBR.No.Leg.BC.78/09.07.005/2017-18). A further circular dated 14 December 2017 extended it to co-operative banks.
How this rule has changed
- 6 July 2017 — RBI circular on limiting customer liability in unauthorised electronic banking transactions (RBI/2017-18/15, DBR.No.Leg.BC.78/09.07.005/2017-18); extended to co-operative banks by a further circular dated 14 December 2017.
- 28 November 2025 — consolidated into the RBI (Commercial Banks – Responsible Business Conduct) Directions, 2025, so cite the Directions, not the standing circular.
RBI has published a framework on fraudulent electronic banking transactions. We have not read the final text, so we do not state its start date, limits or compensation amounts. Primary source not yet confirmed.
When a payment fails, the bank owes you money automatically
Law: RBI's circular RBI/2019-20/67 (DPSS.CO.PD No.629/02.01.014/2019-20, 20 September 2019) sets a deadline to reverse a failed payment. It covers ATMs, cards, IMPS, UPI, Aadhaar payments and more, for payments inside India (Annex, general instruction 7). It came into effect on 15 October 2019 (paragraph 7).
- A failed payment is one that did not complete for a reason that is not your fault, such as a link failure or no cash in an ATM (Annex, general instruction 2).
- Each row of the Annex sets a reversal deadline, such as T + 1 day for a UPI or IMPS transfer and T + 5 days for an ATM. T is the day of the payment.
- If the reversal is late, the rows we read set compensation of ₹100 per day of delay beyond that deadline (Annex, rows 1 to 6).
- Compensation must be paid to your account "suo moto, without waiting for a complaint or claim from the customer" (paragraph 5).
- If you do not get it, you can complain under the RBI Integrated Ombudsman Scheme (paragraph 6).
We opened the circular on rbi.org.in on 6 October 2026. It is a web page with no page numbers, so we cite paragraphs and Annex rows. We have not checked whether RBI has amended it since.
Report fraud to your bank as soon as you can. How fast you report still affects who bears the loss under the 2017 framework above.
Report fraud to your bank and to the National Cyber Crime Reporting Portal, or call 1930.
Chargebacks on cards and disputes over UPI transactions follow fixed timelines under the payments framework. You cannot negotiate these timelines inside the product. They set the frame everything else has to fit into. RBI's Harmonisation of Turn Around Time circular of 20 September 2019 covers failed transactions (see above). We have not opened NPCI's UPI dispute guidelines, so we do not state UPI dispute timelines.
A dispute window is not a reason to keep data abroad. The payment data localisation rule runs on its own clock, separate from your chargeback and dispute clocks.
Official text — RBI FAQs on Storage of Payment System Data, 26 June 2019
Under RBI's FAQs of 26 June 2019, where processing happens outside India the data must be deleted from the overseas systems and brought back to India not later than one business day or 24 hours from payment processing, whichever is earlier.
You cannot park data on an overseas system for the length of a chargeback or dispute window. The copy that the investigation runs on has to be the one held in India.
Who else is now in the fraud picture. The Indian Digital Payment Intelligence Corporation (IDPIC) was incorporated as a Section 8 company on 16 October 2025. Its mandate: detect, prevent and analyse digital payments fraud in real time. It uses artificial intelligence, machine learning and big-data analytics.
IDPIC is not a regulator. It makes no rules and imposes no obligations on you. Nothing on this page changes because it exists. But if you build fraud tooling, expect a state-backed intelligence layer alongside the RBI framework, not in place of it.
Am I a Data Fiduciary?
Fraud-response duties intersect directly with breach notifications under DPDP — use the self-check to confirm the DPDP side of your obligations.
Run it nowFor teams, this turns fraud handling into a scheduling problem as well as an investigation problem. Build the workflow around the clock the regulator already runs, not around whatever ad-hoc timeline your ticketing tools happen to encourage.
This page summarises finance and fintech expectations for orientation. For binding rulings on your product, consult qualified counsel and the primary source below.
Consolidated text on India Code. Amendment currency not individually checked.
RBI/2017-18/15, DBR.No.Leg.BC.78/09.07.005/2017-18, 6 July 2017. Extended to co-operative banks by a further circular dated 14 December 2017. DBR is now the Department of Regulation, so this circular was inside the population withdrawn and consolidated on 28 November 2025, into the Responsible Business Conduct Directions, 2025. RBI has since published a framework on fraudulent electronic banking transactions; we have not read its final text, so no start date is stated. Kept unverified: neither the Directions nor their Third Amendment has been retrieved or opened by the site.
Status unverified — no status check recorded
RBI/2019-20/67, DPSS.CO.PD No.629/02.01.014/2019-20, 20 September 2019. Prescribes turn-around times for reversing funds on failed transactions and a compensation mechanism where the reversal is late. Issued by the Department of Payment and Settlement Systems, so outside the Department of Regulation consolidation of 28 November 2025. Opened on rbi.org.in on 6 Oct 2026: Rs 100 per day of delay in the Annex rows read, paid without a complaint (paragraph 5), in effect from 15 October 2019. Amendments since not checked.
28 November 2025. The consolidation vehicle into which the Department of Regulation's customer-protection circulars for commercial banks were folded on 28 November 2025. Made under Section 35A of the Banking Regulation Act, 1949. Cited by name and date only — no primary-source URL has been retrieved and the text has not been opened.
Primary source not yet confirmed. We have not opened the final text, so we do not state its issue date, start date, limits or compensation amounts.
6 March 2026. Press release, not a rule-making instrument — cited as reference material for the consultation on the fraudulent-transaction framework. No URL has been supplied to the site, so the release is cited by date only.
16 October 2025. Press release recording the incorporation of the Indian Digital Payment Intelligence Corporation as a Section 8 company on 16 October 2025, mandated to detect, prevent and analyse digital payments fraud in real time using AI, machine learning and big-data analytics. It is not a regulator and issues no binding rules. URL supplied by the editor and not opened by the site.
Status unverified — no status check recorded
26 June 2019. DPSS instrument. The FAQs enumerate the payment data covered as customer data, payment sensitive data, payment credentials and transaction data. They recognise that there is no bar on processing payment transactions outside India, subject to deletion from the overseas systems and return of the data to India not later than one business day or 24 hours from payment processing, whichever is earlier; sharing payments data with an overseas regulator requires RBI approval. Where cross-border transaction data consists of a foreign component and a domestic component, a copy of the domestic component may also be stored abroad if required. Applicability reaches all payment system operators authorised by RBI under the PSS Act and the entities in the payments ecosystem they engage — including intermediaries, third-party vendors and payment gateways — with compliance responsibility resting on the authorised payment system operator rather than the vendor.