Who pays after UPI fraud is decided by a timetable, not by arguing. Under the Reserve Bank of India's customer-protection circular, an unauthorised transaction reported within 3 working days of the bank's message carries zero liability for you; reported on days 4–7, your share is capped by account type; after that, your bank's policy decides. Enter the two dates below and this checker counts the working days, names your band, and shows the deadlines your bank owes you — the shadow reversal within 10 working days and resolution within 90.
Framework checked October 25, 2026 — the RBI circular of 6 July 2017, still the table banks decide under today. RBI amendment directions of 24 June 2026 widen this protection from 1 January 2027; the transition note is printed with every result so nobody mistakes the 2017 table for permanent law.
Your two dates — and two honest answers
Dates are counted in your browser and never sent anywhere. The count treats Monday–Saturday as working days; your bank's count is the one that decides, and the result says so.
The date of the SMS or email alert, or the statement entry, that first showed the transaction. The RBI clock starts from the bank's communication — not from the day you happened to notice.
Advertisement
The rule underneath
The RBI table, in one view
The Reserve Bank of India's circular "Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions" (6 July 2017) fixes the split by reporting speed. Where the loss is due to a third-party breach and it is neither the bank's fault nor the customer's, this is the table your bank must apply:
When you report (from the bank's communication)
Your maximum liability
Within 3 working days
Zero. The bank bears the entire loss.
Within 4–7 working days
Capped: ₹5,000 for BSBD / basic accounts · ₹10,000 for regular savings and most other accounts · ₹25,000 for current accounts and high-limit cards. The bank bears everything above the cap.
After 7 working days
Decided by your bank's board-approved policy — weaker ground, but the bank must follow its own published policy and still owes you the deadlines below.
Two companion duties run from the day you report, whichever band you are in: the bank must credit the amount (a shadow reversal) within 10 working days, and resolve the complaint within 90 days. And one hard exception overrides the table: where the customer themselves shared the payment credentials, the loss rests with the customer until the sharing is reported — which is why "not yet reported" is the most expensive answer on this page, in every scenario.
Bank already rejected you?
A rejected chargeback or a liability decision you believe is wrong is not the end of the road in India — it is the first rung of a ladder that ends at the RBI Ombudsman. Our guide to the RBI escalation path walks the rungs in order, and the companion article to this checker, UPI fraud: who pays — you or your bank?, works through the table with examples.
The Reserve Bank of India's circular counts in the bank's working days, starting from the date the bank communicated the transaction to you — the SMS, email or statement entry. This checker estimates them as Monday to Saturday, skipping Sundays only. Real bank holidays differ by state and by bank, so a count near a boundary can differ from your bank's — which is exactly why the safe move is to report on the earliest day you can rather than plan around the last day of a window. The bank's own count is the one that decides the case; this page's count tells you which band you are very likely in and how much urgency you need.
Not nothing — but the honest position is harder. Under the RBI framework, where a customer has shared payment credentials — a PIN, an OTP, a password — the loss generally sits with the customer until the moment the sharing is reported to the bank; losses from transactions after that report are the bank's. So the report still matters enormously: it stops the next transaction from also being yours, and it starts the written record the nodal officer and the RBI Ombudsman work from. If the bank's own systems failed as well — alerts that arrived late, security it ignored — put that in the complaint too. The shared-credential rule is about the credential; it is not a pardon for everything the bank did or didn't do.
The circular gives the bank 10 working days from your report to credit the amount — the shadow reversal — and 90 days to resolve the complaint. A missed shadow-reversal date is not something you have to accept silently: write to the bank quoting your complaint number and the missed date, escalate to its nodal officer, and if the complaint is still unresolved 30 days after you filed it — or the bank rejects it at any stage — take it to the RBI Ombudsman through the Complaint Management System at cms.rbi.org.in. Filing there is free, and the missed deadline is itself a fact in your favour.
Yes. The Reserve Bank issued amendment directions on 24 June 2026 that widen this customer protection with effect from 1 January 2027. This checker applies the framework in force on its stamp date — the 2017 circular's table — because that is the framework banks are deciding cases under today. If your fraud happens after the change takes effect, check the current position rather than relying on this table: the direction of the change is more protection for customers, not less, but the details will matter and they are the bank's and the RBI's to set.
Sources (checked October 25, 2026): Reserve Bank of India, "Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions" (circular, 6 July 2017) — the zero/capped/policy table, the shared-credential rule, the 10-working-day shadow reversal and 90-day resolution duties; RBI Complaint Management System (cms.rbi.org.in) for the Ombudsman route, with the 30-day unresolved-complaint condition; RBI amendment directions of 24 June 2026 (wider protection from 1 January 2027) as the transition note. Reported scale: 10.64 lakh UPI fraud cases and ₹805 crore in losses in the first eight months of FY26 (industry-reported figures).
General information only — not legal or financial advice. Liability is decided by your bank under the RBI framework on the facts of your case. This checker's working-day count is an estimate — it skips Sundays only, real bank holidays vary, and your bank's count is the one that decides.
Chargeback Clock