5 Days That Decide Your Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions

 March 26,2026

The Reserve Bank of India has released its draft “Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026” for public comments, inviting feedback on updated customer protection norms in electronic banking transactions.

The draft builds on earlier directions and reflects evolving realities of digital payments and fraud risks.

Those interested can review the draft and share their inputs via the RBI website: https://www.rbi.org.in → Notifications section, or directly explore the draft document here: https://www.rbi.org.in/Scripts/NotificationUser.aspx (navigate to latest draft directions).

For broader context on cyber fraud reporting, the National Cyber Crime Portal (https://cybercrime.gov.in) and helpline 1930 also continue to play an important role alongside these proposed changes.

 

Last week, while going through the Reserve Bank of India’s draft on customer protection in digital banking, one idea stayed with me.

Not a definition.
Not a compensation rule.

But a simple window of time.

A Personal Pause at the 5-Day Rule (Para DA.4 - 76L.)

 

Within the draft, there is a clear reference:

👉 Reporting within 5 calendar days plays a key role in determining customer protection in fraud cases.

At first, it feels procedural.

But on reflection, it feels decisive.

---

From Awareness to Timing

In the earlier post, I reflected on how reporting is becoming immediate—
how action is now built into the transaction alert itself.

Link to my earlier post @ https://prashantnepayments.blogspot.com/2026/03/rbi-draft-2026-fraud-reporting-instant-76g2.html

 

But this takes it one step further.

It quietly tells us:

It is not just about reporting
It is about when you report

---

The Human Reality

In real life, fraud is rarely identified instantly.

Sometimes:

• the message is ignored
• the doubt comes later
• the realization happens after a few hours… or days

And that delay—very human, very natural—
now begins to shape the outcome.

---

What These 5 Days Mean

Within this window:

• customer protection is stronger
• outcomes are more favourable
• the system responds with greater support

Beyond this window:

• the nature of protection begins to change

It is a simple boundary.
But it carries weight.

5 Days means 5 Days – Nothing More, Nothing Less

---

A Subtle Shift in Responsibility

What stood out to me is this:

The system is evolving to support the customer—
but it is also asking the customer to act within time.

There is a balance emerging:

👉 System enables action
👉 Customer enables timing

---

Connecting the Dots

If I step back and look at the flow:

• Alerts are becoming actionable
• Reporting is becoming immediate
• And now, timing is becoming decisive

It feels like a sequence, not isolated rules.

---

Final Reflection

In digital transactions, protection is not only about preventing fraud.

It is also about:

• how quickly it is noticed
• how quickly it is reported

These 5 days are not just a timeline.

They are a window of protection.

And sometimes,
a small window is what makes the biggest difference.

---

Disclaimer

This post is a personal reflection on a draft regulatory document released for public comments.
The observations are interpretative in nature and intended for general awareness.

---

The Joy of Digital Transactions
Nayakanti Prashant
Citizen Advocate – Digital Transactions Day (Proposed) April 11

Series archive:
https://movethebarrier.blogspot.com/April11SafeePayDay

---

Author’s blogs
https://prashantrandomthoughts.blogspot.com
https://prashantnepayments.blogspot.com
https://innovationinbanking.blogspot.com

A Small Line in RBI’s Draft That Could Make Fraud Reporting Instant - Limiting Liability of Customers in Unauthorized Electronic Banking Transactions

 March 22, 2026

The Reserve Bank of India has released its draft “Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026” for public comments, inviting feedback on updated customer protection norms in electronic banking transactions. 

The draft builds on earlier directions and reflects evolving realities of digital payments and fraud risks. 

Those interested can review the draft and share their inputs via the RBI website: https://www.rbi.org.in → Notifications section, or directly explore the draft document here: https://www.rbi.org.in/Scripts/NotificationUser.aspx (navigate to latest draft directions). For broader context on cyber fraud reporting, the National Cyber Crime Portal (https://cybercrime.gov.in) and helpline 1930 also continue to play an important role alongside these proposed changes.

Recently, the Reserve Bank of India invited public comments on its draft update to customer protection rules in digital banking.

At the heart of this draft is a familiar concern—
what happens when a customer loses money in an electronic transaction?

The draft revisits and strengthens the framework around limiting customer liability in unauthorised electronic banking transactions, building on earlier directions and adapting them to today’s realities.

While reading through the document, one section quietly stood out to me.

Not because it was long.
Not because it was complex.

But because it felt… practical.

Yes, practical, and once the Go Live Date is announced, there will be more learnings flyers from the stakeholders.

 A Personal Pause at DA.3

The section is:

👉 DA.3 – Reporting of fraudulent electronic banking transactions by customers to banks
👉 And within it, Para 76G(2)

At first glance, it looks like a routine instruction.

But when I paused and read it again, it felt different.

It was not just about reporting fraud.

It was about how quickly and easily a person can respond in that moment of doubt.

 

 

---

From “Inform the Bank” to “Act Immediately”

For a long time, the messaging around fraud has been simple:

Inform the bank.
Report the transaction.

But in reality, that moment is never so simple.

When a suspicious debit message comes:

• there is confusion
• there is hesitation
• there is often a few minutes lost just figuring out what to do

This draft seems to recognise that gap.

And instead of just advising faster reporting,
it quietly redesigns the experience.

The draft guidelines mention as to how the responses should flow to the financial institutions.

---

76G (2): Bringing Action into the Same Moment

Para 76G (2) requires that the transaction alert SMS itself should carry a number, allowing the customer to immediately respond via SMS if they notice something wrong.

This may look like a small addition.

But to me, it changes the flow completely.

Because now:

• the alert is not just information
• it becomes the starting point of action

There is no need to search.
No need to remember a helpline.
No need to navigate an app in panic.

The response is right there, in the same message.

---

Thinking About the Human Moment

Fraud is not just a system event.

It is a very human moment.

A message appears.
For a second, it doesn’t feel right.
There is a pause.

In that pause, the system either:

• supports the customer
  or
• leaves the customer to figure things out

What I felt while reading 76G (2) is that it tries to support that exact moment.

It reduces thinking.
It reduces delay.
It reduces friction.

---

A Quiet but Meaningful Alignment

Across the broader framework, one idea is clear:

👉 Faster reporting leads to better protection.

Seen in that light, this provision does something thoughtful.

It does not just say:

“Report quickly”

It makes it easier to actually do so.

That alignment—between expectation and enablement—
is what gives this clause its real value.

---

A Subtle Shift in Direction

Reading DA.3 along with 76G (2), I felt there is a shift happening.

From:

• alerts as passive messages

To:

• alerts as interactive safety points

From:

• customer responsibility

To:

• system-supported customer action

It is not a loud change.

But it is a meaningful one.

---

Final Reflection

In a document filled with definitions, timelines, and liability structures,
this one line stays with me.

Because it is simple.

And sometimes, in systems like banking,
simple changes make the biggest difference.

A transaction alert SMS,
which we usually just read and move on from,

now has the potential to become
the first step of protection.

---

Disclaimer

This post is a personal reflection on a draft regulatory document released for public comments.
The observations are interpretative in nature and intended for general awareness and discussion.

---

Closing Note

The Joy of Digital Transactions
Nayakanti Prashant
Citizen Advocate – Digital Transactions Day (Proposed)

Series archive:
https://movethebarrier.blogspot.com/April11SafeePayDay

---

Author’s blogs
https://prashantrandomthoughts.blogspot.com
https://prashantnepayments.blogspot.com
https://innovationinbanking.blogspot.com