RBI Proposes Targeted Account Blocking Framework to Combat Cyber Fraud Without Freezing Entire Accounts

RBI Proposes Framework to Revolutionize Cyber Fraud Response

The Reserve Bank of India has released draft directions that fundamentally reshape how banks handle suspected cyber fraud cases1

1

. Called the Reserve Bank of India (Know Your Customer) Amendment Directions, 2026, this RBI proposes framework introduces a targeted approach where banks will temporarily freeze only disputed transaction amounts rather than locking entire accounts2

2

. The draft directions are scheduled to take effect from April 1, 2027, though banks can adopt them earlier. This policy push responds directly to the Supreme Court's August 4, 2026, order directing the central bank to prescribe standard operating procedures for temporary debit holds on amounts linked to money-mule activity and cyber-enabled fraud1

1

.

AI-Based Transaction Monitoring Systems to Flag Suspicious Activity

Under the new framework, banks must deploy AI-based transaction monitoring systems, including machine learning systems, to identify unusual transfers of ₹1,000 or more2

2

. These automated tools will flag transactions that appear sudden, disproportionate to a customer's declared profile, or linked to known cyber-fraud networks and mule accounts1

1

. Once flagged, banks must immediately place temporary debit holds on the suspected amount and notify account holders digitally on the same day or physically by the next day2

2

. This standardize account blocking approach marks a significant departure from the previous practice of freezing entire accounts, which often left innocent customers without access to their funds during investigations.

Customer Rights and Timeline for Resolution in Suspected Cyber Fraud Cases

The draft framework establishes clear timelines that balance fraud prevention with customer rights. Account holders receive 20 calendar days to establish transaction legitimacy by providing proof of identity, context details, or documents showing the source of funds1

1

. Banks then have 10 calendar days to assess the explanation and supporting evidence. If the account holder's explanation satisfies the bank, the hold must be lifted immediately1

1

. However, if customers fail to respond within 20 days or provide unsatisfactory explanations, banks must refer the case to jurisdictional police through the NCRP/CFCFRMS portal. Law enforcement then has 30 days from referral to issue a formal statutory restraint order1

1

. The proposed rules impose a 60-day cap as the maximum duration for temporary debit holds without explicit statutory orders from courts or law enforcement2

2

.

Strengthened Grievance Redressal Mechanisms

The Reserve Bank of India framework mandates robust grievance redressal measures to protect customer interests. Banks must appoint designated nodal officers whose contact details must be displayed on websites and at all branches2

2

. These nodal officials bear responsibility for resolving customer grievances within 30 days. Nodal accounts, escrow accounts, and special-purpose accounts remain exempt from these measures2

2

. The RBI has invited public comments on the proposed rules until October 2, allowing stakeholders to provide input before implementation.

Rising Cyber Fraud Losses Drive Policy Action

This framework emerges against a backdrop of escalating cyber fraud in India. According to home ministry data, Indians lost at least ₹22,495 Cr to cyber fraud in 2025, compared to ₹22,845 Cr in 20242

2

. The National Human Rights Commission reported that Indians have lost around ₹52,976 Cr to cyber-enabled frauds over the past six years, with nearly 8% linked to "digital arrest" scams2

2

. Nearly 7.1% of attempted digital consumer transactions in India were suspected fraud in 2025, almost double the global rate of 3.8%2

2

. Union home minister Amit Shah directed officials earlier this year to improve the National Cybercrime Helpline using AI and address issues related to account blocking in cyber fraud investigations. In line with this, RBI earlier issued directives limiting customer liabilities, announcing that customers losing up to ₹50,000 in cybercrime cases would be eligible for compensation of up to 85% of the net loss amount or ₹25,000, whichever is lesser2

2

.