Short answer: Money held in a bank account, card or RBI-authorised wallet is reasonably safe in 2026 because RBI rules limit your liability for unauthorised transactions and, from 1 April 2026, require strong authentication for most digital payments. Most losses happen when people are tricked into sharing an OTP or UPI PIN, or approving a payment themselves. Report any unauthorised debit to your bank immediately: reporting within three working days usually means zero liability if you were not at fault.
Last updated: 13 October 2026.
India now runs most everyday payments through UPI, cards and prepaid wallets. That convenience has also made “digital cash” a target. This guide explains where the real risks are, what protection the law already gives you, and the habits that keep your money safe.
Is digital money safer or riskier than cash?
Cash can be lost or stolen with no recourse. Digital money sits inside a regulated system: banks, card networks and payment apps must follow RBI rules on authentication, fraud monitoring and complaint handling. If someone steals your card details and uses them without your involvement, you usually get the money back.
The weak point is the person holding the phone. Fraudsters rarely “hack” UPI itself; they persuade users to enter a PIN, read out an OTP, scan a QR code to “receive” money, or install a screen-sharing app. When you authorise a payment yourself, the rules treat it very differently from a genuinely unauthorised one.
Where the risks are in 2026
| Channel | Typical risk | Main safeguard |
|---|---|---|
| UPI | Fake collect requests, QR codes that debit instead of credit, PIN shared with “support staff” | UPI PIN is needed only to pay, never to receive |
| Debit/credit cards | Skimming at ATMs/POS, card details saved on dodgy sites, phishing links | OTP or other second factor, card controls, transaction alerts |
| Net banking | Phishing sites that copy bank login pages | Type the bank’s address yourself; never log in via SMS links |
| Wallets (PPIs) | Account takeover through SIM swap or OTP sharing | KYC limits, device binding, app lock |
| Tap-and-pay | Small contactless payments without PIN if a card is lost | Low per-transaction limits; block the card immediately |
Two other risks are worth naming. Remote-access apps (screen-sharing tools a “bank officer” asks you to install) let a fraudster watch you type your PIN. Fake loan or investment apps collect your KYC and contacts and then misuse them. Before sharing documents with any lender, see our guide on why to borrow only from RBI-registered banks and NBFCs.
What the RBI rules protect
1. Limited liability for unauthorised transactions
Under RBI’s customer liability framework for unauthorised electronic banking transactions, your liability depends on who was at fault and how quickly you report:
| Situation | Your liability |
|---|---|
| Fraud or negligence by the bank (whether or not you report) | Zero |
| Third-party breach (neither you nor the bank at fault), reported within 3 working days | Zero |
| Third-party breach, reported in 4–7 working days | Limited: the transaction value or a cap of ₹5,000 to ₹25,000 per transaction depending on account type, whichever is lower |
| Third-party breach, reported after 7 working days | As per the bank’s Board-approved policy |
| Loss caused by your negligence (e.g. you shared your PIN or OTP) | You bear the loss until you report it; the bank bears losses after reporting |
The bank must credit the disputed amount to your account (a “shadow reversal”) within 10 working days of your report, and resolve the complaint within 90 days.
2. Two-factor authentication for digital payments from April 2026
RBI’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025 require at least two authentication factors for digital payments from 1 April 2026, with at least one factor generated dynamically. Banks may add risk-based checks (device, location, spending pattern) for unusual payments. A few low-risk cases, such as small-value contactless payments and repeat e-mandate debits, are exempt.
Importantly, if you lose money on a transaction the issuer processed without complying with these directions, the issuer must compensate you in full. SMS OTPs are still allowed, but many banks now also use app-based approvals, device binding and biometrics.
3. Complaint and ombudsman route
If the bank or payment app does not respond within 30 days, or you are unhappy with the reply, you can escalate to the RBI Ombudsman through RBI’s complaint management system. The Reserve Bank – Integrated Ombudsman Scheme, 2026 came into force on 1 July 2026. Our guide to RBI rules every borrower should know explains the steps.
Ten habits that keep your digital money safe
- Never share an OTP, UPI PIN, CVV or net-banking password — not with bank staff, courier agents or “customer care”. Genuine staff never ask.
- Remember: you never enter a PIN to receive money. If an app asks for your UPI PIN to “accept” a payment, it is a debit.
- Check QR codes before paying. Confirm the payee name shown in your UPI app matches the shop or person. See our explainer on the QR code scam.
- Turn on alerts for every debit by SMS and email, and read them.
- Use card controls in your bank app: switch off international, online or contactless use when you do not need it, and set daily limits.
- Do not install screen-sharing or remote-access apps at anyone’s request.
- Keep a separate, low-balance account or wallet for everyday UPI spends; keep savings in an account you rarely use for payments.
- Update your phone and apps, use a screen lock and app lock, and download banking apps only from official stores.
- Watch for SIM-swap signs: if your mobile network suddenly stops working, contact your operator and bank at once.
- Search customer care numbers on the official website or app, never on a search engine ad or social media.
What to do if money is taken from your account
- Block the card or UPI ID immediately through the bank app or the bank’s official helpline.
- Report the unauthorised transaction to your bank in writing (app, email or branch) and keep the complaint reference number. The clock for your liability starts from the bank’s alert, so act the same day.
- Report cyber fraud on the national cybercrime helpline 1930 or the National Cyber Crime Reporting Portal (cybercrime.gov.in). Quick reporting can help freeze money in the fraudster’s account.
- Change passwords and PINs, and check whether your email or phone has been compromised.
- If the bank does not resolve the complaint in 30 days, escalate to the RBI Ombudsman.
Worked example: why reporting time matters
Ravi’s debit card details are stolen in a data breach at an online merchant. Fraudsters make two ₹18,000 purchases. He gets SMS alerts but ignores them for a few days.
- If Ravi reports within 3 working days: his liability is zero; the bank must shadow-credit ₹36,000 within 10 working days.
- If he reports on the 5th working day: for a regular savings account, his liability is capped at ₹10,000 per transaction, so up to ₹20,000 of the ₹36,000.
- If he had shared the OTP with a caller: he bears the loss until he reports it.
The same ₹36,000 loss can cost nothing or a lot, depending on speed and whether he shared credentials.
The money angle: protecting savings and credit
Fraud does not only drain balances; it can also damage your credit. If a fraudster takes a loan or credit card in your name, it will show up on your credit report. Check your report at least twice a year and dispute anything you do not recognise. Our guides on reading credit reports from all four bureaus and raising a CIBIL dispute explain how.
Some people also buy personal cyber insurance, which can cover certain online fraud losses. Read the exclusions carefully; our article on whether you need personal cyber insurance covers the trade-offs. Finally, an emergency fund in a separate account means one fraud incident does not leave you without money for rent or EMIs.
Need funds and want to borrow only from RBI-regulated lenders? Compare offers on FundsTiger.
For more on spotting fake lenders and frauds, read 8 points to avoid financial frauds. You can also check whether an entity is registered with a regulator, or report an unauthorised deposit-taker, on RBI’s Sachet portal.
Frequently asked questions
Is UPI safe to use in 2026?
Yes, UPI is safe when used carefully. Payments need your UPI PIN, and from April 2026 RBI requires two-factor authentication for digital payments. Most UPI losses come from users being tricked into entering their PIN or approving collect requests.
Will my bank refund money lost in online fraud?
If the fraud was due to the bank’s fault, or a third-party breach reported within three working days, your liability is zero. If you shared your OTP or PIN, you may bear the loss until you report it.
Do I need to enter my UPI PIN to receive money?
No. A UPI PIN is only needed to send money. Any request to enter your PIN to receive money is a fraud.
Where do I report a cyber fraud?
Report it to your bank immediately, then call the cybercrime helpline 1930 or file on cybercrime.gov.in. If your bank does not resolve the complaint in 30 days, escalate to the RBI Ombudsman.
Can a fraud affect my CIBIL score?
Yes, if someone takes a loan or card in your name. Check your credit report regularly and raise a dispute with the bureau and lender for any account you did not open.
Sources
- RBI: Limiting liability of customers in unauthorised electronic banking transactions (6 July 2017)
- RBI: Authentication mechanisms for digital payment transactions Directions, 2025
- RBI press release: Integrated Ombudsman Scheme, 2026
- RBI Sachet portal
Disclosure: FundsTiger (Gatimaan Finance Advisors Pvt. Ltd.) is a loan marketplace and lending service provider for RBI-regulated lenders. Aparampaar Finance Pvt. Ltd. (Omozing), one of those lenders, is a related party of FundsTiger. This article is general information, not financial advice. Read your loan agreement and KFS before you decide.