RBI’s Fraud Relief Scheme Raises Hard Questions

The Reserve Bank of India’s announcement of a one-time digital fraud compensation scheme, capped at ₹25,000, is being projected as a customer-friendly intervention in an era of rampant cybercrime. Yet, beneath the reassuring language of “immediate relief” and “shared responsibility”, the framework raises serious legal, regulatory and enforcement questions that the central bank has chosen not to address—at least for now.

What the RBI Has Announced

Under the proposed framework, customers who suffer small-value unintended digital frauds will be eligible for compensation capped at the lower of ₹25,000 or 85% of the loss. The remaining loss will be shared between the customer and the bank, while the RBI proposes to fund its share through its Deposits Education and Awareness Fund, not unclaimed deposits.

The compensation is strictly once in a lifetime, applicable only if no mala fide intent is established. While the RBI has suggested a “no questions asked” approach for smaller frauds, it has simultaneously underlined that claims will be scrutinised to rule out fraudulent or collusive behaviour—without explaining how such scrutiny will be conducted, or by whom.

Once in a Lifetime: Relief or Warning?

The phrase “once in a lifetime” stands out for its severity. In regulatory terms, it implies that a victim of cyber fraud is presumed to have learnt their lesson after the first incident. This assumption is problematic in a digital ecosystem where fraud is often systemic rather than behavioural.

Frauds increasingly exploit SIM swaps, leaked databases, compromised payment gateways and mule accounts, factors largely beyond a consumer’s control. Treating repeat victims as careless participants rather than potential targets of organised crime risks penalising the wrong stakeholder.

The Missing Enforcement Link

What is striking is not what the RBI announced, but what it chose not to announce.

Despite acknowledging the scale of the problem, there was no parallel declaration of coercive or time-bound enforcement measures involving the Department of Telecommunications, the Ministry of Home Affairs, or banks—all critical nodes in the fraud chain.

If SIM cards were not issued on fake or loosely verified identities, a significant percentage of UPI and OTP-based frauds would simply not occur. Yet, fraudulent SIM issuance continues, despite mandatory KYC norms. The blocking of over 9.42 lakh SIM cards and 2.63 lakh IMEIs only underlines how deep the rot already is.

Multiple Bank Accounts, Zero Accountability

Equally troubling is the ease with which fraudsters operate multiple bank accounts, often across states and institutions. These accounts function as temporary parking hubs for stolen funds, sometimes remaining active long after being flagged.

The scheme is silent on why real-time inter-bank alerts, tighter account opening norms, and accountability for lax KYC compliance are still not enforced uniformly. Without addressing this, compensation risks becoming a band-aid over a haemorrhage.

A Numbers Game That Doesn’t Add Up

India lost over ₹23,000 crore to cyber fraud in 2024, a 206% jump from the previous year. Cybercrime incidents surged from 10.29 lakh in 2022 to 22.68 lakh in 2024, with 22 lakh cases registered last year alone. Against this backdrop, a ₹25,000 cap appears symbolic rather than proportionate.

Even the Union Budget’s ₹782 crore allocation for cybersecurity pales in comparison to the scale of financial damage. While helpline 1930 and improved reporting mechanisms are welcome, post-facto relief cannot substitute prevention.

Shared Skin, But Unequal Stakes

The RBI’s formulation of “skin in the game” for customers, banks and the regulator sounds equitable in theory. In practice, the customer remains the weakest party, lacking investigative tools, legal expertise or institutional leverage.

Banks and telecom operators, on the other hand, possess both data visibility and control mechanisms. Yet, the scheme stops short of imposing penal consequences for repeated institutional failures, focusing instead on consumer caution.

What Needs to Change

If digital trust is to be restored, compensation must be the last line of defence, not the first. What is urgently required is:

• Zero-tolerance SIM issuance norms with criminal liability

• Centralised tracking of mule accounts across banks

• Mandatory liability sharing skewed towards institutions

• Time-bound freezing of suspicious accounts and numbers

Without these, the scheme risks being seen as a face-saving exercise, offering limited relief while sidestepping the hard structural reforms that cyber fraud demands.

The RBI has promised a discussion paper on enhancing digital payment safety. The real test will be whether that paper confronts these uncomfortable questions—or merely reframes them.