Short answer: You may not need personal cyber insurance if you report fraud quickly, because RBI rules already limit your liability for unauthorised bank and card transactions that are not your fault. A policy is worth considering if you transact heavily online, keep large balances in linked accounts, or want cover for things banks do not refund: losses after you were tricked into sharing an OTP, identity theft clean-up, cyber extortion or legal costs. Read the exclusions carefully, because they decide whether the policy pays.
Last updated: 13 October 2026.
What your bank already covers (before you buy anything)
Under RBI’s limited liability rules for unauthorised electronic transactions, how much you lose depends on whose fault it was and how fast you report it:
| Situation | Your liability |
|---|---|
| Fraud or deficiency on the bank’s side | Zero, whether or not you reported it |
| Third-party breach (not your fault, not the bank’s), reported within 3 working days | Zero |
| Third-party breach reported in 4–7 working days | Lower of the transaction value or a cap of ₹5,000 to ₹25,000 depending on account type |
| Reported after 7 working days | As per your bank’s board-approved policy |
| Loss due to your negligence, e.g. sharing OTP or PIN | You bear the loss until you report it; the bank bears losses after reporting |
Banks must credit the disputed amount (as a provisional credit) within 10 working days of your report and resolve the complaint within 90 days. The bank has to prove any liability it puts on you. RBI’s card transaction FAQs explain the card side.
So for classic card skimming or a data leak at the bank, fast reporting is your best insurance. The gap is the last row: social engineering, where you were tricked into approving the payment yourself. That is the most common type of fraud today, and it is where cyber insurance can help.
What personal cyber insurance typically covers
Policies differ widely. Common covers include:
- Theft of funds: Unauthorised debits from bank accounts, cards, UPI or wallets, sometimes including phishing or SIM-swap losses.
- Identity theft: Costs of restoring your identity, correcting records and legal fees if someone takes loans or opens accounts in your name.
- Online shopping fraud: Paying a fake seller who never delivers.
- Cyber extortion and ransomware: Expert help, and sometimes costs, when your device or data is held to ransom.
- Data restoration: Recovering data after malware.
- Cyberbullying, stalking and reputation harm: Counselling, legal costs and help removing content.
- Legal costs: Defending or pursuing a case linked to a covered incident.
Common exclusions to check
- Losses your bank or card issuer has already reimbursed (you cannot be paid twice).
- Incidents not reported to the bank and police within the policy’s deadline, often a few days.
- Losses from investment schemes, crypto or trading platforms, or from lending money to someone.
- Business or professional accounts on a personal policy.
- Incidents that started before the policy began.
- Losses involving family members unless the policy covers the family.
- Deductibles or sub-limits that cap each type of loss well below the sum insured.
Do you need it? A quick self-check
| Your profile | Likely need |
|---|---|
| Few online transactions, small balances, alerts on, report fast | Low; RBI rules plus caution may be enough |
| Heavy UPI and card use, large savings balance in the same account | Moderate to high |
| Elderly parents using UPI or net banking | High; social engineering targets them often |
| Active on social media, public profile, or children online | Moderate; for identity, cyberbullying and legal cover |
| Frequent online shopping on new or unknown sites | Moderate; for shopping fraud cover |
Questions to ask before you buy
- Does it cover losses where I was tricked into sharing an OTP or approving a UPI request?
- What is the sub-limit for each type of loss, and is there a deductible?
- Does it cover my spouse, children and parents?
- How many days do I have to report to the bank, police and insurer?
- Does it cover all my bank accounts, cards and wallets, or only named ones?
Worked examples
Example 1 (illustrative): Kavita’s debit card is cloned at an ATM and ₹40,000 is withdrawn. She reports it the next day. This is a third-party breach reported within three working days, so her liability is zero and the bank must credit the amount within 10 working days. Insurance adds little here.
Example 2 (illustrative): Ramesh gets a call from a “bank executive”, shares an OTP and loses ₹60,000 via UPI. Because he shared the OTP, the bank may treat it as customer negligence. If his cyber policy covers phishing losses with a ₹1,00,000 sum insured and a ₹5,000 deductible, and he reported to the bank and police on time, he may recover ₹55,000. Without the policy, he relies on police recovery, which is uncertain.
Premiums for personal cyber covers are generally small next to health or motor insurance, but compare the sub-limits, not just the headline sum insured. Some banks and card issuers bundle limited cyber or card-fraud cover; check what you already have. Our insurance basics hub explains how to read a policy.
If fraud happens: the first hour matters
- Block the channel: Freeze your card, UPI or net banking from the app or helpline.
- Report to your bank in writing and keep the complaint number. This starts the RBI liability clock.
- Call 1930, the national cyber fraud helpline, or file on the National Cyber Crime Reporting Portal (cybercrime.gov.in). According to PIB, quick reports through this system have helped stop funds being moved out in many cases.
- Inform your insurer within the policy deadline, with the bank complaint, cyber complaint or FIR copy and statements.
- Check your credit report later for any loan taken in your name; see unknown lender in your CIBIL report and how to dispute it.
Prevention still beats any policy
- Never share OTPs, PINs or screen-sharing access. No bank or lender asks for them.
- Remember you never need to enter your UPI PIN to receive money; read our guide to the QR code scam.
- Keep a separate account with a small balance for UPI and online shopping.
- Turn on SMS and email alerts and set card limits for online and international use.
- Avoid loan apps that ask for contacts or gallery access; here is how to identify a fraudulent lending platform.
- Read more in how to avoid financial frauds and how safe is your digital cash.
Finally, an emergency fund protects you from the cash crunch a fraud can cause while you wait for a refund or claim. Size yours with the emergency fund calculator.
If a fraud has left you short while you wait for a refund, compare emergency loan offers from RBI-regulated lenders.
Frequently asked questions
Does my bank refund money lost to online fraud?
If the fraud was due to the bank’s fault, or a third-party breach that you reported within three working days, your liability is zero under RBI rules. If you shared your OTP or PIN, the bank may hold you liable for losses until you reported it.
What does personal cyber insurance not cover?
Common exclusions include losses already refunded by the bank, late reporting, investment or crypto scams, business accounts and incidents that began before the policy. Sub-limits and deductibles also cap what you get.
Is cyber insurance worth it for senior citizens?
It can be, because older users are frequent targets of phone and UPI scams that banks may treat as customer negligence. Choose a policy that clearly covers phishing and social engineering.
What should I do first after a UPI fraud?
Block UPI or the card in your bank app, report to the bank in writing, and call 1930 or file on the national cyber crime portal as soon as possible. Then inform your insurer within its deadline.
Can I claim insurance and a bank refund for the same loss?
No. Insurance pays only the part of the loss not recovered from the bank or other sources, after any deductible.
Sources
- RBI: Limiting liability of customers in unauthorised electronic banking transactions
- RBI: FAQs on card transactions
- PIB: National Cyber Crime Reporting Portal and helpline 1930
Disclosure: FundsTiger (Gatimaan Finance Advisors Pvt. Ltd.) is a loan marketplace and lending service provider for RBI-regulated lenders. Aparampaar Finance Pvt. Ltd. (Omozing), one of those lenders, is a related party of FundsTiger. This article is general information, not financial advice. Read your loan agreement and KFS before you decide.