Banks lose money to fraud in two very different ways. A few large borrowers divert loans worth thousands of crores, and many thousands of customers lose a few thousand or a few lakh rupees each to phishing calls, fake apps and "digital arrest" threats. The first kind dominates the amount of fraud in the RBI's data, and the second dominates the number of cases. This part covers both. It reads the latest fraud tables in the RBI Annual Report 2025-26, looks at the PNB and DHFL cases, and explains how a bank must classify and report a fraud under the RBI's July 2026 directions, including the Supreme Court's natural justice ruling. It then turns to cybersecurity rules, the main types of digital fraud, the customer liability rules that change on 1 January 2027, and the shared defences: the 1930 helpline, the bank.in domain, MuleHunter.AI and the Digital Payment Intelligence Platform. Part 20 covers the AI side of fraud detection in more depth.
In the news
- 11 Sep 2026: Draft rules on freezing mule money. The RBI issued a draft Know Your Customer (KYC) Amendment Directions, 2026, telling banks how to place temporary debit holds on amounts or accounts linked to money mules and cyber-enabled fraud. It follows a Supreme Court order of 4 August 2026 directing the RBI to issue a standard operating procedure. Comments were due by 2 October 2026. Why it matters for the exam: mule accounts are now handled through KYC rules, and the push came from the Supreme Court.
- 31 Jul 2026: New fraud and cyber directions for banks. As part of its consolidation of rules, the RBI issued the Commercial Banks – Fraud Risk Management Directions, 2026 and the Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, with separate versions for small finance banks and payments banks. They replace the July 2024 fraud directions and the earlier cyber circulars. Why it matters for the exam: questions on fraud reporting, the 21-day show cause notice and six-hour cyber incident reporting now refer to these 2026 directions.
- 24 Jun 2026: Customer protection rules rewritten. The RBI issued the Commercial Banks – Responsible Business Conduct Third Amendment Directions, 2026. For transactions from 1 January 2027, they replace the 2017 "limited liability" rules with a wider framework, including a one-time compensation of up to ₹25,000 for small-value frauds. Why it matters for the exam: this is the biggest change to customer liability rules since 2017.
- 29 May 2026: Fraud data for 2025-26. The RBI Annual Report showed 10,114 frauds of ₹1 lakh and above involving ₹48,021 crore in 2025-26, against 23,722 cases and ₹32,803 crore in 2024-25. Advances accounted for 85.5% of cases and 84.9% of the amount. Why it matters for the exam: these are the latest official fraud numbers.
- 10 Apr 2026: Discussion paper on payment safeguards. All India Radio reported an RBI discussion paper proposing, among other steps, a one-hour delay for digital payments above ₹10,000 that the payer could cancel, with whitelisting for trusted payees, and extra checks for vulnerable users such as senior citizens. It cited 28 lakh cyber frauds worth ₹22,931 crore reported on the national portal in 2025. Why it matters for the exam: it shows the RBI weighing friction in payments against fraud.
- 1 Apr 2026: New authentication rules in force. The RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025 (issued 25 September 2025) took effect. They keep two-factor authentication, require one factor to be dynamic for most transactions, and allow factors other than SMS OTP. Why it matters for the exam: SMS OTP is still allowed, but it is no longer the default.
- 17 Mar 2026: I4C numbers in Parliament. The Home Ministry told the Lok Sabha that the Citizen Financial Cyber Fraud Reporting and Management System had saved more than ₹8,690 crore in over 24.65 lakh complaints by 31 January 2026, and that over 12.94 lakh SIM cards had been blocked. Why it matters for the exam: these are the latest official figures on the 1930 system.
What counts as bank fraud
The RBI does not use one short definition of fraud. Its directions list the categories a bank must use when it reports a fraud. In the 2026 directions for commercial banks there are 11:
- Misappropriation of funds and criminal breach of trust
- Fraudulent encashment through forged instruments
- Manipulation of books of accounts, fictitious accounts and conversion of property
- Cheating by concealment of facts and cheating by impersonation
- Forgery to commit fraud, including false electronic records
- Wilful falsification or destruction of records to defraud
- Fraudulent credit facilities extended for illegal gratification
- Cash shortages due to frauds
- Fraudulent foreign exchange transactions
- Fraudulent electronic banking or digital payment transactions committed on banks
- Other frauds not covered above
Two distinctions matter for exams.
- Fraud vs NPA. A loan becomes a non-performing asset when it stops being repaid (see Part 25). It is a fraud only if there was deceit, such as fake documents, diversion of funds or round-tripping. Many large frauds are first seen as NPAs.
- Fraud on the bank vs fraud on the customer. In a loan fraud, the bank is the victim. In most digital scams, the customer is the victim. The customer liability rules decide how much of that loss the bank must bear.
What the fraud data show
The RBI Annual Report gives frauds of ₹1 lakh and above reported by banks and financial institutions, by area of operation. Read three notes with the numbers: the year is the year of reporting, not when the fraud happened; the "amount involved" is not the final loss, because recoveries reduce it; and the 2025-26 total includes 314 older cases worth ₹30,199 crore that were reported again after banks re-examined them to comply with the Supreme Court's March 2023 judgment.
| Area | 2023-24 cases | 2023-24 ₹ crore | 2024-25 cases | 2024-25 ₹ crore | 2025-26 cases | 2025-26 ₹ crore |
|---|---|---|---|---|---|---|
| Advances | 4,105 | 8,917 | 7,924 | 30,367 | 8,640 | 40,774 |
| Card/internet/digital payments | 28,836 | 1,452 | 13,332 | 517 | 293 | 29 |
| Deposits | 2,002 | 240 | 1,207 | 521 | 407 | 377 |
| Cash | 484 | 78 | 306 | 39 | 181 | 35 |
| Others (off-balance sheet, forex, cheques, inter-branch, clearing, other) | 373 | 326 | 953 | 1,359 | 593 | 6,806 |
| Total | 35,800 | 11,013 | 23,722 | 32,803 | 10,114 | 48,021 |
Source: RBI Annual Report 2025-26, Table VI.3. The "Others" row adds six smaller categories from the same table.
By bank group, public sector banks reported 5,418 cases worth ₹35,709 crore in 2025-26 (74.5% of the amount), and private banks 3,956 cases worth ₹11,399 crore. In 2023-24 private banks had the most cases (23,965, mostly small card and digital frauds) while public sector banks had the most money (73.5%). The RBI's own summary: the number of frauds was highest in card/internet/digital payments in 2023-24 and 2024-25, advances had the largest share of cases in 2025-26, and in value terms frauds were concentrated in advances in all three years.
Worked example: reading the fraud table
- Average size of a fraud, 2025-26. Advances: ₹40,774 crore ÷ 8,640 = ₹4.72 crore per case. Card/internet/digital: ₹29 crore ÷ 293 = ₹0.099 crore, or about ₹9.9 lakh. A loan fraud is on average almost 48 times larger.
- Average digital fraud, 2023-24. ₹1,452 crore ÷ 28,836 = ₹0.0504 crore, or about ₹5 lakh per case.
- Stripping out the re-reported cases. In 2025-26, new reporting excluding the 314 re-examined cases was 10,114 − 314 = 9,800 cases and ₹48,021 − ₹30,199 = ₹17,822 crore. So most of the jump in value over 2024-25 came from old cases, not new ones.
- Change in total amount. ₹48,021 ÷ ₹11,013 = 4.36, so the amount involved rose about 4.4 times in two years while the number of cases fell by 72% ((35,800 − 10,114) ÷ 35,800 = 0.717).
A caution on digital fraud: these tables count only frauds of ₹1 lakh and above that banks report as frauds on themselves. Most small UPI and card scams go to the police through the 1930 helpline and the National Cyber Crime Reporting Portal, which logged about 28 lakh cyber frauds worth ₹22,931 crore in 2025, according to the figures in the RBI discussion paper of April 2026. The Annual Report does not explain the fall in reported digital bank frauds to 293 in 2025-26, so do not read it as proof that digital fraud has ended.
Big frauds that changed the rules
Punjab National Bank and Nirav Modi (2018)
On 14 February 2018, Punjab National Bank (PNB) told the stock exchanges it had found "fraudulent and unauthorised" transactions of about $1.77 billion at its Brady House branch in Mumbai, for the benefit of a few account holders. The groups of jeweller Nirav Modi and his uncle Mehul Choksi were at the centre. Bank staff had issued Letters of Undertaking (LoUs) through the SWIFT messaging system without recording them in the bank's core banking system. Overseas branches of other Indian banks lent against these LoUs, so the exposure was hidden for years. PNB later put the total at about ₹13,000 crore.
The case exposed two weaknesses: SWIFT was not linked to core banking, and LoUs could be issued without proper limits. On 13 March 2018 the RBI stopped banks from issuing LoUs and Letters of Comfort for trade credit for imports. Letters of credit and bank guarantees were still allowed.
DHFL (2022)
In June 2022 the CBI registered what it called its biggest bank fraud case, against Dewan Housing Finance Corporation Ltd (DHFL) and its promoters Kapil and Dheeraj Wadhawan. The complaint came from Union Bank of India, which led a consortium of 17 banks that had lent ₹42,871 crore. The alleged fraud was ₹34,615 crore, through diversion of funds and fabricated books. DHFL itself went through insolvency resolution (see Part 26). Earlier in 2022, the CBI had booked ABG Shipyard for a ₹22,842 crore fraud on a consortium of 28 banks.
The lesson. Large frauds are mostly loan frauds: diversion of funds, fake collateral, related-party transactions. They are found late, often after the account has turned bad. That is why the RBI's rules focus on early warning signals and red-flagging (below) and why advances dominate the fraud amount.
How banks classify and report fraud
From 2024 to 2026
On 15 July 2024 the RBI replaced its 2016 fraud directions with three Master Directions on fraud risk management: for commercial banks (including RRBs) and AIFIs, for co-operative banks, and for NBFCs. On 31 July 2026, as part of its consolidation into entity-wise directions, it issued the Reserve Bank of India (Commercial Banks – Fraud Risk Management) Directions, 2026, effective at once. Small finance banks, payments banks and AIFIs got their own versions. The substance of the 2024 rules carries over.
Natural justice: SBI v Rajesh Agarwal (2023)
Under the old 2016 rules, banks could classify a borrower as a fraud without hearing him. The consequences were severe: the borrower was barred from bank credit, reported to investigators and named on caution lists. In State Bank of India v Rajesh Agarwal, decided on 27 March 2023, the Supreme Court held that the principles of natural justice, especially audi alteram partem ("hear the other side"), must be read into the fraud rules. A borrower must get notice and a chance to reply, and the bank must pass a reasoned order. The Court did not require a personal hearing.
The 2026 directions build this in. The bank's board-approved policy must provide for:
- a detailed show cause notice (SCN) to the persons, entities, promoters and whole-time or executive directors being examined, giving full details of the transactions relied on;
- at least 21 days to reply;
- a system to examine the replies; and
- a reasoned order stating the facts, the reply and the reasons.
The directions add that natural justice applies in every fraud classification with civil consequences. This is why the 2025-26 data include 314 old cases: banks re-examined earlier classifications and reported them afresh after following the new process.
Early warning and red flags
Loan fraud is caught through an Early Warning Signals (EWS) and Red Flagging of Accounts (RFA) framework, overseen by the board's Risk Management Committee.
- EWS alerts (for example, unusual transactions, poor financial performance, market intelligence) should be examined within a turnaround time of preferably not more than 30 days.
- A red-flagged account with an aggregate exposure of ₹3 crore and above must be reported on the RBI's CRILC platform within 7 days.
- The bank then uses an external or internal audit, and must decide whether the account is a fraud or remove the red flag within 180 days of first reporting it on CRILC. Cases beyond 180 days go to the board's fraud committee.
- Banks must also set up a Data Analytics and Market Intelligence Unit and monitor non-credit transactions, including mule accounts, in real time or near real time.
Reporting and penalties
- To the RBI: a Fraud Monitoring Return (FMR) for every fraud, whatever the amount, within 14 days of classification. FMR data flow into the Central Fraud Registry (CFR), a searchable database the RBI maintains so that banks can check borrowers before lending. Payment-system frauds go first to the separate Central Payments Fraud Information Registry (CPFIR).
- To law enforcement: banks are advised to report all frauds of ₹1 lakh or more. Private and foreign banks report frauds below ₹1 crore to the state police; at ₹1 crore and above they also report to the Serious Fraud Investigation Office (SFIO). Public sector banks report frauds below ₹6 crore to the state police and ₹6 crore and above to the CBI. (The CBI threshold was ₹3 crore until 2024; the RBI raised it for inflation.)
- Governance: a Special Committee of the Board for Monitoring and Follow-up of Frauds (SCBMF) with at least three directors, headed by an independent or non-executive director. Public sector banks refer frauds of ₹3 crore and above to the CVC's Advisory Board for Banking and Financial Frauds to examine staff accountability.
- Penalty: borrowers classified as fraud, and their associated entities, are barred for five years from raising funds from RBI-regulated entities, counted from full repayment of the defrauded amount.
Worked example: where does the complaint go?
A public sector bank classifies a ₹9 crore loan fraud. It must file an FMR within 14 days and report to the CBI (₹9 crore is above ₹6 crore). A private bank with a ₹2 crore fraud reports to the state police and the SFIO, using the FMR format for the SFIO. A private bank with a ₹40 lakh fraud reports to the state police only.
Digital fraud: how the scams work
Most digital frauds have the same shape: get access or get the victim to pay, then move the money out quickly through accounts the criminal controls.
Stealing credentials
- Phishing: fake emails or websites that copy a bank's look to capture log-in details or card numbers. Smishing does the same by SMS, often with a link to "update KYC" or "avoid account blocking".
- Vishing: voice calls from someone posing as a bank officer, card team or customer care, asking for an OTP, PIN or CVV.
- SIM swap: the fraudster gets a duplicate SIM for the victim's mobile number, usually with forged documents, and then receives the victim's OTPs.
- Remote-access and malicious apps: the victim is persuaded to install a screen-sharing or fake app that reads SMS or takes control of the phone.
Tricking the victim into paying
In these frauds the victim makes the payment, so two-factor authentication does not stop it. The RBI's discussion paper calls them authorised push-payment frauds.
- "Digital arrest": callers pose as police, CBI, customs or court officials, often on video calls with fake uniforms and documents. They claim the victim is linked to a crime and keep him "under arrest" online until he transfers money to "verify" it. No Indian law allows arrest by video call. The RBI's awareness campaigns for 2025-26 covered digital arrest prevention, the 1930 helpline and the risk of renting out bank accounts.
- Investment and task scams: promises of high returns on shares, crypto or online "tasks", with small early payouts to build trust.
- Fake customer care and UPI collect requests: fake helpline numbers on search engines, and payment requests that the victim approves with a UPI PIN believing he is receiving money.
Cashing out: mule accounts
A money mule account is a bank account, often rented, bought or opened with someone else's papers, through which stolen money is moved and withdrawn. The I4C's Suspect Registry, launched with banks on 10 September 2024, had shared data on 27.37 lakh first-layer mule accounts and helped decline transactions worth more than ₹9,518 crore by 31 January 2026. The RBI's MuleHunter.AI, built by the Reserve Bank Innovation Hub, was in 26 banks by 31 March 2026 (see Part 20). The September 2026 KYC draft gives banks a standard way to freeze such money temporarily.
Cybersecurity rules for banks
Cyber attacks on the bank itself (ransomware, data theft, attacks on payment systems) are a separate risk from frauds on customers, though they often meet. The RBI treats cyber risk as a form of operational risk (see Part 40).
The 2016 framework
The RBI's circular of 2 June 2016, Cyber Security Framework in Banks, was the starting point. It required:
- a board-approved cyber security policy, separate from the general IT policy;
- a Security Operations Centre (SOC) for continuous surveillance;
- a Cyber Crisis Management Plan covering detection, response, recovery and containment; and
- reporting of all unusual cyber incidents, successful or attempted, to the RBI.
Later rules added a Master Direction on IT governance (November 2023) and the 2025 inter-regulatory baseline. On 31 July 2026 these were consolidated into the Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026. Key points for commercial banks:
- a Chief Information Security Officer (CISO), preferably at General Manager rank, who does not report to the head of IT and has no business targets;
- a SOC managed by the CISO's office;
- cyber incidents reported within six hours of detection on the RBI's DAKSH supervisory platform, with the bank also notifying CERT-In.
CERT-In's six-hour rule
The Indian Computer Emergency Response Team (CERT-In), under the Ministry of Electronics and IT, issued directions on 28 April 2022 under Section 70B(6) of the IT Act, 2000. They require service providers, intermediaries, data centres and corporate bodies, including banks, to report specified cyber incidents within six hours of noticing them, and to keep ICT system logs for 180 days in India. Before 2022 there was no fixed time limit.
Payment security and authentication
- Two-factor authentication is required for domestic digital payments, with at least one dynamic factor (unique to the transaction) for transactions other than card-present ones. Under the 2025 directions, effective 1 April 2026, issuers can use passwords, PINs, device tokens or biometrics as well as SMS OTP, and can add risk-based checks using location, device and behaviour. If a loss arises from a transaction that did not follow the rules, the issuer must compensate the customer in full.
- By 1 October 2026, card issuers had to put in place a way to validate cross-border card-not-present transactions when an overseas merchant asks.
- Alerts: from 2027, banks must send an instant SMS alert for every electronic transaction above ₹500, and an email alert where an email is registered. Alerts must carry a way to object at once. Banks cannot charge for regulatory SMS alerts.
Who pays when a customer is defrauded?
The 2017 rules (in force until 31 December 2026)
The RBI's circular of 6 July 2017 on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions set out who bears the loss.
| Situation | Customer liability |
|---|---|
| Bank's fault (negligence or deficiency) | Zero, whether or not reported |
| Third-party breach, reported within 3 working days | Zero |
| Third-party breach, reported in 4–7 working days | Transaction value or a cap, whichever is lower |
| Third-party breach, reported after 7 working days | As per the bank's board-approved policy |
| Customer's negligence (e.g. sharing OTP or PIN) | Full loss until reported; bank bears loss after that |
The caps for the 4–7 day window were ₹5,000 for basic savings (BSBD) accounts; ₹10,000 for other savings accounts, prepaid instruments, MSME current accounts, individuals' current accounts up to ₹25 lakh and credit cards with limits up to ₹5 lakh; and ₹25,000 for all other current and overdraft accounts and credit cards above ₹5 lakh. Banks had to credit the amount (a shadow reversal) within 10 working days of notice, and resolve the complaint within 90 days.
The 2026 directions (for transactions from 1 January 2027)
The Third Amendment Directions of 24 June 2026 (RBI/2026-27/167) apply to commercial banks other than small finance banks, payments banks, RRBs and local area banks. They cover not only unauthorised transactions but also payments the customer makes under coercion or duress, which brings digital arrest-style frauds into scope. The main rules:
- Bank negligence: zero liability. Negligence now includes not sending mandatory alerts, not offering 24x7 reporting, and system failures or internal frauds.
- Third-party breach (a fault elsewhere in the system, such as a payment app, payment gateway or telecom provider): zero liability if reported within 5 calendar days; after that, as per bank policy.
- Customer negligence (sharing credentials, downloading malicious apps, ignoring clear scam warnings, not updating a mobile number): the customer bears the loss until reporting, except the part covered by compensation.
- Burden of proof is on the bank. Complaints must be decided within 45 calendar days (domestic) or 60 days (cross-border). Credit card frauds get a shadow reversal within 5 calendar days.
- Small-value compensation: an individual who loses up to ₹50,000 through customer negligence, and reports it to the bank and to 1930 or the national portal within 5 calendar days, gets 85% of the net loss or ₹25,000, whichever is less, once in a lifetime. The RBI pays 65 percentage points, and the customer's bank and the beneficiary bank (where the money first landed) 10 each. The scheme covers frauds in the first year after 1 January 2027.
Making the beneficiary bank pay is deliberate: it gives the bank that opened the mule account a direct cost.
Worked example: compensation
- Small loss. A customer is tricked into sharing an OTP and loses ₹20,000; nothing is recovered. Compensation = 85% × 20,000 = ₹17,000. RBI pays 65% × 20,000 = ₹13,000; customer's bank ₹2,000; beneficiary bank ₹2,000. The customer bears ₹3,000.
- Larger loss. The loss is ₹40,000. 85% would be ₹34,000, so the cap applies: ₹25,000. The cap starts to bind at a loss of 25,000 ÷ 0.85 = ₹29,412, which is why the directions use that figure. RBI pays ₹19,118 (65/85 of ₹25,000), and each bank ₹2,941.
- Old vs new for a third-party breach. A ₹40,000 fraud from a payment-app breach on a savings account is reported on the sixth working day. Under the 2017 rules the customer bears the lower of ₹40,000 and ₹10,000, so ₹10,000. If it happens in 2027 and is reported within 5 calendar days, liability is zero; if reported later, it depends on the bank's policy.
The shared defences
1930 and the I4C
The Indian Cyber Crime Coordination Centre (I4C) was set up by the Home Ministry as a scheme in 2018 and became an attached office of the ministry on 1 July 2024. Its Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS), launched in 2021, links police, banks and payment firms. A victim calls the toll-free 1930 helpline or files on cybercrime.gov.in. The complaint is passed to the banks and wallets that received the money, so they can hold it before it is withdrawn. By 31 January 2026 this had saved more than ₹8,690 crore in over 24.65 lakh complaints. Other I4C tools include the Suspect Registry, the Samanvaya data platform and blocking of SIM cards and handsets (12.94 lakh SIMs and 3.03 lakh IMEIs by January 2026).
bank.in
To make fake bank websites easier to spot, the RBI announced exclusive internet domains on 7 February 2025: bank.in for banks and fin.in for other financial entities. Its circular of 22 April 2025 named the Institute for Development and Research in Banking Technology (IDRBT) as the sole registrar, authorised by NIXI under MeitY, and asked all commercial and co-operative banks to migrate by 31 October 2025. A customer can treat any banking site not ending in bank.in as suspect.
Data-sharing platforms
- Central Fraud Registry (RBI): frauds reported by banks, for credit and fraud checks.
- CPFIR (RBI): payment-system frauds, including disputed and attempted ones.
- Digital Payment Intelligence Platform (DPIP), built by the Reserve Bank Innovation Hub: phase 1 is a smart registry of suspicious and fraudulent transactions reported by banks, to stop bad actors opening accounts; phase 2 will give a real-time risk score for each transaction. Seven banks had joined the phase 1 pilot by 31 March 2026.
- MuleHunter.AI and the planned Mule Registry (see Part 20).
Proposals under discussion
The April 2026 discussion paper suggested a one-hour cooling period for transfers above ₹10,000, a trusted-person approval for large payments by senior citizens, customer-set limits and on/off switches for payment modes, and extra scrutiny before large credits reach an account. These were proposals, not rules, as of October 2026.
Common exam traps
Which year's rules? The 2017 liability circular counts working days (3 and 7). The 2026 directions count calendar days (5) and apply only to transactions from 1 January 2027. Until then, the 2017 rules apply.
Fraud data measure reporting, not occurrence. A fraud reported in 2025-26 may have happened years earlier. The ₹48,021 crore for 2025-26 includes ₹30,199 crore from 314 re-examined old cases.
Number vs amount. Digital frauds led by number in 2023-24 and 2024-25; advances led by amount in all three years. Advances also led by number in 2025-26.
CBI threshold. For public sector banks it is ₹6 crore now, not ₹3 crore. The ₹3 crore figure is still used for CRILC red-flag reporting and for referrals to the CVC's advisory board.
Natural justice does not mean a personal hearing. The Supreme Court required notice, a chance to reply and a reasoned order. The rules give at least 21 days to reply.
Six hours, two regulators. Banks report cyber incidents to the RBI (DAKSH) within six hours and must also notify CERT-In, whose own 2022 rule is also six hours.
1930 vs 112. 1930 is the national cyber fraud helpline. Do not confuse it with the general emergency number 112.
Compensation is once in a lifetime and only for losses up to ₹50,000, reported within 5 calendar days to both the bank and 1930 or the portal.
Key facts at a glance
| Frauds 2025-26 (₹1 lakh+) | 10,114 cases, ₹48,021 crore (RBI Annual Report 2025-26) |
| Frauds 2024-25 | 23,722 cases, ₹32,803 crore |
| Frauds 2023-24 | 35,800 cases, ₹11,013 crore |
| Advances share, 2025-26 | 85.5% of cases, 84.9% of amount |
| Current fraud directions | Commercial Banks – Fraud Risk Management Directions, 2026 (31 Jul 2026) |
| Previous directions | Master Directions on Fraud Risk Management, 15 Jul 2024 |
| Natural justice case | SBI v Rajesh Agarwal, Supreme Court, 27 Mar 2023 |
| Show cause notice | At least 21 days to reply; reasoned order |
| Red-flag reporting | ₹3 crore+ on CRILC within 7 days; decide within 180 days |
| FMR to RBI | Within 14 days of classification; feeds the Central Fraud Registry |
| CBI referral (PSBs) | ₹6 crore and above |
| Debarment | 5 years from full repayment |
| RBI cyber framework | Circular of 2 Jun 2016; consolidated directions 31 Jul 2026 |
| Cyber incident reporting | Within 6 hours to RBI (DAKSH); CERT-In rule of 28 Apr 2022 also 6 hours |
| Old liability rules | 6 Jul 2017: zero within 3 working days; caps ₹5,000/₹10,000/₹25,000 for 4–7 days |
| New liability rules | 24 Jun 2026 directions, for transactions from 1 Jan 2027: zero within 5 calendar days |
| Small-value compensation | 85% of net loss or ₹25,000 (lower), loss up to ₹50,000, once in a lifetime |
| 1930 / CFCFRMS | Launched 2021; over ₹8,690 crore saved by 31 Jan 2026 |
| bank.in | Announced 7 Feb 2025; IDRBT registrar; migration by 31 Oct 2025 |
| PNB fraud | Disclosed 14 Feb 2018, about $1.77 billion; LoUs banned 13 Mar 2018 |
| DHFL | CBI case June 2022, ₹34,615 crore, 17-bank consortium led by Union Bank |
Exam corner: what to remember
- Advances dominate fraud value; digital frauds dominated numbers until 2024-25.
- 2025-26: 10,114 frauds, ₹48,021 crore; ₹30,199 crore of that from 314 re-examined cases.
- SBI v Rajesh Agarwal (27 March 2023): hear the borrower before classifying fraud. Rules now give 21 days to reply to the SCN.
- Red flag → CRILC in 7 days (₹3 crore+) → decide in 180 days → FMR in 14 days → CFR.
- Law enforcement: PSBs ₹6 crore+ to CBI; private banks ₹1 crore+ also to SFIO. Penalty: 5-year ban on fresh funding.
- Cyber: 2 June 2016 framework (board policy, SOC, crisis plan); CISO; incidents within 6 hours to RBI and CERT-In.
- Liability: 2017 rule (3 / 4–7 / beyond 7 working days) until end-2026; 2027 rule (5 calendar days, ₹25,000 compensation, 45-day resolution).
- 1930, cybercrime.gov.in, I4C (attached office since 1 July 2024), Suspect Registry (10 September 2024).
- bank.in for banks, fin.in for other financial entities; IDRBT is the registrar.
- PNB 2018 led to the end of LoUs for import credit; DHFL is the CBI's biggest bank fraud case.
For exam-specific syllabus and pattern details, see our pages for RBI Grade B, SBI PO and IBPS PO.
Test yourself
According to the RBI Annual Report 2025-26, which area accounted for the largest share of the amount involved in bank frauds in 2023-24, 2024-25 and 2025-26?
Show answer
Answer: (c) Advances had 81.0%, 92.6% and 84.9% of the amount in the three years.
In which case did the Supreme Court hold in March 2023 that borrowers must be heard before their accounts are classified as fraud?
Show answer
Answer: (b) The judgment of 27 March 2023 read natural justice into the RBI's fraud directions.
Under the RBI's fraud directions, how long must a borrower be given to reply to a show cause notice?
Show answer
Answer: (c) The directions require "not less than 21 days". 14 days is the deadline for filing an FMR after classification.
A public sector bank classifies a loan fraud of ₹8 crore. To which agency must it report?
Show answer
Answer: (c) Public sector banks report frauds of ₹6 crore and above to the CBI.
Under the RBI directions of 24 June 2026, from which date do the new customer protection rules for fraudulent electronic banking transactions apply?
Show answer
Answer: (d) They apply to electronic banking transactions on or after 1 January 2027.
A customer loses ₹40,000 to a fraud caused by his own negligence, reports it to the bank and to 1930 within 5 calendar days, and nothing is recovered. How much compensation will he get under the 2027 rules?
Show answer
Answer: (b) 85% of ₹40,000 is ₹34,000, but the cap is ₹25,000, whichever is less.
Under the RBI's 2017 rules, a savings account holder reports a ₹15,000 third-party breach fraud on the fifth working day. What is the maximum customer liability?
Show answer
Answer: (c) For 4–7 working days, liability is the lower of the transaction value and the cap, which is ₹10,000 for ordinary savings accounts.
In September 2026, after a Supreme Court order, the RBI issued draft amendments to which directions to deal with temporary debit holds on mule accounts?
Show answer
Answer: (b) The draft KYC Amendment Directions, 2026 were issued on 11 September 2026 after the Supreme Court's order of 4 August 2026.
Which institution is the exclusive registrar for the bank.in domain?
Show answer
Answer: (c) IDRBT, Hyderabad, authorised by NIXI under MeitY.
Within how many hours must a commercial bank report a cyber incident to the RBI under the 2026 cybersecurity directions?
Show answer
Answer: (b) Within six hours of detection on the DAKSH platform, and the bank must also notify CERT-In.
Further reading
- RBI Annual Report 2025-26, Chapter VI: the fraud tables by bank group and area, MuleHunter, DPIP and Box VI.3 on cyber-enabled fraud and money mules.
- RBI (Commercial Banks – Fraud Risk Management) Directions, 2026: the current rulebook for classifying, reporting and following up frauds. Read Chapters II to VI.
- RBI (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026: the new customer liability and compensation rules, with worked illustrations.
- RBI circular on Limiting Liability of Customers, 6 July 2017: the rules still in force until the end of 2026, short and often examined.
- RBI (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026: the consolidated cyber rules, including the CISO, SOC and six-hour reporting.
- RBI circular on Cyber Security Framework in Banks, 2 June 2016: the original framework, useful for its plain statement of principles.
- PIB, Update on I4C, 17 March 2026: official figures on 1930, the Suspect Registry and SIM blocking.
Sources
- RBI Annual Report 2025-26, Chapter VI: Tables VI.2 and VI.3 and notes (₹1 lakh threshold, year of reporting, 314 cases worth ₹30,199 crore), para VI.76 on fraud trends, MuleHunter in 26 banks, DPIP phases and seven pilot banks, draft liability instructions of 6 March 2026, Box VI.3 (KYC Directions 2025, bank.in, awareness on digital arrest and 1930, coordination with I4C) (accessed 24 October 2026)
- RBI, Commercial Banks – Fraud Risk Management Directions, 2026 (RBI/DoS/2026-27/412, 31 July 2026): SCN and 21 days, reasoned order, explanation citing SBI v Rajesh Agarwal, SCBMF, EWS turnaround of 30 days, CRILC reporting in 7 days for ₹3 crore+, 180 days, LEA reporting table, ₹1 lakh advice, 11 fraud categories, CFR, CPFIR, FMR in 14 days, five-year debarment, repeal of earlier directions (accessed 24 October 2026)
- RBI, Master Directions on Fraud Risk Management in Commercial Banks (including RRBs) and AIFIs, 15 July 2024: 2024 framework, CBI threshold raised from ₹3 crore to ₹6 crore, CFR description (accessed 24 October 2026)
- Mondaq, RBI consolidates and notifies Fraud Risk Management Directions, 2026: summary of changes from the 2024 directions and applicability (accessed 24 October 2026)
- RBI, Responsible Business Conduct Third Amendment Directions, 2026 (RBI/2026-27/167, 24 June 2026): effective for transactions from 1 January 2027, definitions of fraudulent EBT and negligence, 5-day zero liability, 45/60-day resolution, shadow reversal in 5 days, SMS alerts above ₹500, compensation rules and illustrations, one-year coverage (accessed 24 October 2026)
- RBI circular on Customer Protection – Limiting Liability of Customers, 6 July 2017: 3 and 4–7 working day rules, caps of ₹5,000, ₹10,000 and ₹25,000, shadow reversal in 10 working days, 90-day resolution (accessed 24 October 2026)
- RBI circular on Cyber Security Framework in Banks, 2 June 2016: board-approved cyber policy, SOC, Cyber Crisis Management Plan, incident reporting (accessed 24 October 2026)
- RBI, Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (RBI/DoS/2026-27/410, 31 July 2026): CISO, SOC, six-hour reporting on DAKSH, CERT-In notification, repeal of earlier cyber instructions (accessed 24 October 2026)
- KPMG India, RBI's technology-focused master directions issued on 31 July 2026: summary of the July 2026 cyber and payment security directions (accessed 24 October 2026)
- Trilegal, 2022 CERT-In directions on reporting cyber incidents: 28 April 2022, Section 70B(6), six-hour reporting, 180-day logs, 60-day effective period (accessed 24 October 2026)
- RBI, Authentication Mechanisms for Digital Payment Transactions Directions, 2025: 25 September 2025, effective 1 April 2026, two factors with one dynamic, risk-based checks, issuer compensation, cross-border CNP by 1 October 2026 (accessed 24 October 2026)
- RBI press release on the draft KYC Amendment Directions, 11 September 2026: Supreme Court order of 4 August 2026, temporary debit holds on mule-linked amounts, comments by 2 October 2026 (accessed 24 October 2026)
- All India Radio News, 10 April 2026: RBI discussion paper, one-hour delay above ₹10,000, 28 lakh cyber frauds worth ₹22,931 crore in 2025 (accessed 24 October 2026)
- Vision IAS summary of the RBI discussion paper: title "Exploring Safeguards in Digital Payments to Curb Frauds", proposals on whitelisting, trusted-person approval and large credits (accessed 24 October 2026)
- PIB, Update on I4C, 17 March 2026: I4C set up 2018, attached office from 1 July 2024, CFCFRMS launched 2021, ₹8,690 crore saved, 24.65 lakh complaints, 12.94 lakh SIMs and 3.03 lakh IMEIs blocked, Suspect Registry of 10 September 2024 with 27.37 lakh mule accounts and ₹9,518 crore declined, Samanvaya (accessed 24 October 2026)
- RBI circular on Migration to '.bank.in' domain, 22 April 2025: announcement of 7 February 2025, bank.in and fin.in, IDRBT as registrar under NIXI and MeitY, deadline of 31 October 2025 (accessed 24 October 2026)
- Business Standard (Reuters), 14 February 2018: PNB's disclosure of about $1.77 billion of fraudulent transactions at a Mumbai branch (accessed 24 October 2026)
- Business Standard, 13 March 2018: RBI bars LoUs and LoCs for import trade credit; PNB's total of ₹12,967.86 crore (accessed 24 October 2026)
- The Week (PTI), 23 June 2022: CBI case against DHFL, ₹34,615 crore, 17 banks led by Union Bank, ₹42,871 crore of credit (accessed 24 October 2026)
- Scroll, 22 June 2022: DHFL case and earlier ABG Shipyard case of ₹22,842 crore on 28 banks (accessed 24 October 2026)