Digital Payment Fraud: Bank Liability and Victim Recovery in India, UK and Singapore

Summary: This comparative doctrinal research examines the recovery of funds lost through digital payment fraud in India, the United Kingdom and Singapore. It distinguishes unauthorised electronic transactions, authorised push payment scams and phishing-related account compromise, emphasising that technical authentication alone does not always settle questions of informed consent or institutional responsibility. The paper evaluates the RBI’s 2017 customer-liability framework and its June 2026 amendment directions, scheduled to apply to transactions from 1 January 2027, alongside the UK’s mandatory reimbursement mechanism for eligible Faster Payments APP scams and Singapore’s Shared Responsibility Framework for defined phishing scams. It analyses the duties of sending banks, beneficiary banks, payment intermediaries and telecommunications providers; the differences between fund recovery, reimbursement and compensation; and the availability of reporting, investigation and dispute resolution mechanisms. The study highlights limitations in scope, reporting requirements and victim access to effective remedies, and cautions against treating three distinct regulatory systems as equivalent. It proposes a Digital Fraud Victim Recovery and Shared Liability Model for India involving interoperable reporting, timely preservation and tracing of funds, tiered liability allocation, beneficiary-bank accountability, proportionate reimbursement, independent review, data transparency and privacy safeguards. The central recommendation is that compensation and criminal investigation should be complementary rather than making relief dependent on identifying or prosecuting fraudsters.

Digital Payment Fraud and Victim Recovery
The Right To Recover Stolen Digital Money
A Comparative Legal Analysis of Fraudulent Electronic Transactions, Bank
Liability and Victim Compensation in India, the United Kingdom and Singapore

Abstract

The expansion of instant payments, mobile banking and digital wallets has increased the speed and convenience of financial transactions while creating new opportunities for fraudsters to obtain and transfer victims’ funds. A central legal difficulty concerns the boundary between an unauthorised payment and a payment that the customer technically authorises after being deceived, manipulated or coerced. The distinction matters because conventional payment law often provides clearer refund rights for unauthorised transactions than for authorised push payment (APP) scams. This paper compares the legal and regulatory approaches of India, the United Kingdom and Singapore to the recovery of money lost through fraudulent electronic transactions. It examines customer liability, payment-service-provider obligations, beneficiary-bank responsibilities, reimbursement and compensation, complaint handling, and the role of telecommunications or other intermediaries. The analysis is doctrinal and comparative, drawing on legislation, regulatory directions and official policy materials. The United Kingdom’s mandatory reimbursement regime for eligible Faster Payments APP scams, effective from 7 October 2024, is contrasted with Singapore’s Shared Responsibility Framework for defined phishing scams, effective from 16 December 2024, and India’s existing customer-protection rules together with its 2026 amendment directions scheduled to apply from 1 January 2027. The paper argues that the three systems address different categories of fraud and should not be treated as equivalent. It proposes a victim-centred recovery framework for India built around rapid reporting, preservation and tracing of funds, reasoned liability allocation, proportionate reimbursement, and independent dispute resolution. The paper concludes that criminal prosecution and victim compensation should operate as complementary, rather than mutually dependent, responses to digital financial crime.

Keywords: Digital payment fraud; authorised push payment fraud; unauthorised transactions; bank liability; victim compensation; payment services; comparative law; India; United Kingdom; Singapore.

1. Introduction

Digital payment infrastructure has become an essential part of modern financial life. Account-to-account transfers, instant payment rails, mobile banking applications and electronic wallets allow consumers and businesses to move funds with minimal delay. The same speed, however, can make fraud losses difficult to contain. A victim may be persuaded to disclose credentials, approve a payment, install a malicious application, transfer funds to a supposed safe account, or respond to an impersonation message. Once funds enter an account controlled by a fraudster, they may be moved through several accounts or jurisdictions before the victim or bank can intervene.

The expression ‘stolen digital money’ is used in this paper as a practical description of funds lost through fraudulent electronic transactions. It is not a single legal category. The relevant legal classification may be an unauthorised transaction, an incorrectly executed transaction, a transaction induced by deception, a phishing-related account takeover, or another form of fraud. The legal consequences differ according to the applicable statute, regulatory scheme, payment instrument and factual circumstances.

The central issue is whether the fact that a payment was authenticated or initiated using the customer’s device should determine the allocation of loss. It does not necessarily resolve whether the customer gave legally meaningful consent, whether the bank complied with its duties, or whether the payment provider should bear some loss because of deficient fraud controls. The UK Payment Services Regulations 2017 distinguish authorisation from authentication and provide that recorded use of a payment instrument is not, by itself, necessarily sufficient proof of authorisation or customer fraud or gross negligence.¹

The comparative jurisdictions provide three different regulatory approaches. India’s Reserve Bank of India (RBI) has historically focused on limiting customer liability for unauthorised electronic banking transactions. Its 2026 amendment directions broaden the framework to defined fraudulent electronic banking transactions, prescribe bank duties and introduce a limited compensation mechanism, but their commencement is deferred to 1 January 2027.² The UK has created a mandatory reimbursement regime for eligible APP scams sent through Faster Payments, with loss shared between sending and receiving payment service providers subject to scheme rules and limits.³ Singapore’s Shared Responsibility Framework (SRF) allocates defined anti-scam duties to financial institutions and telecommunications companies in relation to a specified class of phishing scams, with payouts expected where relevant duties are breached.⁴

This paper asks what lessons India can draw from the UK and Singapore while recognising that the legal schemes have different scopes.

2. Statement Of The Research Problem

Victims of digital payment fraud often face multiple barriers: rapid onward transfer of funds, uncertainty about which institution must act, disputes over whether the transaction was authorised, fragmented complaint channels, and delays in obtaining a reasoned decision. Where the customer personally initiates a transfer after deception, a bank may argue that the payment was authorised. The victim may then be left to pursue the fraudster through criminal proceedings, even though the fraudster may be unidentified, insolvent or outside the jurisdiction.

The problem is not simply the absence of criminal prohibitions. India has criminal-law provisions addressing cheating, personation and related conduct, as well as regulatory obligations for banks and payment systems. The more specific issue is whether the civil and regulatory framework provides a clear, accessible and timely path to preserve, trace and restore funds, and whether it allocates responsibility fairly among customers, sending banks, beneficiary banks and payment intermediaries.

Accordingly, the research problem is: whether the legal and regulatory framework governing fraudulent electronic transactions in India provides adequate and effective recovery and compensation remedies, particularly when a customer is induced by deception to initiate or approve a payment, and what lessons can be drawn from the UK and Singapore.

3. Scope, Definitions And Conceptual Distinctions

3.1 Unauthorised transactions

An unauthorised transaction is generally one for which the payer has not given consent in the manner recognised by the applicable payment law. The precise statutory test varies. In the UK, regulations 67 and 76 of the Payment Services Regulations 2017 govern consent and the provider’s liability for unauthorised payment transactions. Regulation 76 ordinarily requires refund and restoration of the account, subject to the regulations’ conditions and exceptions.⁵

3.2 Authorised push payment scams

An APP scam occurs when a customer is deceived into instructing their bank or payment provider to transfer money to an account controlled by a fraudster. The customer may have authenticated and technically authorised the payment, although the instruction was induced by fraud. The UK reimbursement regime addresses eligible APP scams within the scope of Faster Payments rules. It should not be confused with the statutory refund regime for unauthorised transactions.

3.3 Phishing-related seemingly authorised transactions

Singapore’s SRF addresses a defined scope of phishing scams in which consumers are deceived into disclosing credentials to scammers impersonating legitimate entities, resulting in unauthorised transactions. The SRF is not a general reimbursement guarantee for every scam, investment fraud, romance scam or payment voluntarily made to a fraudster. Its coverage depends on the framework’s definitions and the breach of specified duties.⁶

3.4 Recovery, reimbursement and compensation

These concepts should be distinguished. Recovery refers to locating, freezing, reversing or returning the original funds. Reimbursement refers to a payment made to the victim under a legal or regulatory scheme, whether or not the original funds are recovered. Compensation may address a defined portion of loss under a statutory or regulatory mechanism. A victim may receive reimbursement even where the fraudster’s funds cannot be recovered; conversely, a successful freeze or recovery may reduce the net amount payable under a compensation scheme.

4. Research Questions And Objectives

4.1 Research questions

1. How do India, the United Kingdom and Singapore distinguish unauthorised transactions from payments

induced by deception?

2. To what extent are sending banks, beneficiary banks and payment intermediaries legally responsible for

losses arising from digital payment fraud?

3. What legal and regulatory mechanisms are available to victims for reporting fraud, freezing funds,

tracing transfers and obtaining reimbursement?

4. How effective are the UK APP reimbursement regime and Singapore’s SRF in allocating responsibility

and incentivising fraud prevention?

5. Does India’s 2026 RBI amendment directions framework provide a sufficiently comprehensive response

to fraudulent electronic banking transactions, and what are its limitations?

6. What elements of a time-bound, shared-responsibility recovery framework could appropriately be

adapted for India?

4.2 Research objectives

7. To examine the legal nature and classification of fraudulent electronic payment transactions.

8. To analyse the relevant statutory and regulatory framework in India, the UK and Singapore.

9. To evaluate the legal duties of sending banks, beneficiary banks and payment intermediaries.

10. To compare recovery, reimbursement, compensation and grievance-redressal mechanisms. 11. To identify gaps in the Indian framework, including the scope and commencement of the 2026 RBI amendment directions. 12. To propose a victim-centred framework for timely fund preservation, fair liability allocation and effective remedies.

5. Research Methodology

The paper adopts qualitative doctrinal legal research combined with functional comparative analysis. The primary method is the interpretation of legislation, regulatory directions, official guidelines and policy instruments. The comparative method examines how each jurisdiction responds to similar functional problems: payment authorisation, customer negligence, institutional fraud controls, reimbursement, fund recovery and dispute resolution.

The principal jurisdictions are India, the United Kingdom and Singapore. India is the primary jurisdiction for the reform recommendations. The UK is selected because it has introduced a mandatory APP reimbursement regime for eligible Faster Payments scams. Singapore is selected because its SRF expressly allocates defined duties across financial institutions and telecommunications providers in a specified phishing context.

Primary materials include RBI directions and circulars; the Payment and Settlement Systems Act 2007; the Information Technology Act 2000; the Bharatiya Nyaya Sanhita 2023; the UK Payment Services Regulations 2017; instruments issued by the Payment Systems Regulator (PSR); Singapore’s Payment Services Act 2019; and the MAS–IMDA SRF Guidelines. Secondary materials should include peer-reviewed articles, books, law commission or government reports, regulator evaluations and relevant judicial decisions. The present draft is principally based on primary sources and should be supplemented with a systematic academic literature review before journal submission.

The analysis is limited by the different scope of the three regimes and by the absence of a uniform dataset measuring comparable recovery rates across all three jurisdictions. Accordingly, the paper evaluates legal design and institutional duties rather than claiming a statistically proven ranking of national performance. The legal position is considered as at 10 November 2026, with future commencement dates expressly identified.

6. India: Legal Framework For Digital Payment Fraud

6.1 RBI’s 2017 customer-protection framework

The RBI circular of 6 July 2017, ‘Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions’, established a framework for allocating customer liability in unauthorised electronic banking transactions. It distinguishes circumstances involving bank negligence, third-party breaches and customer negligence, and emphasises prompt reporting, transaction alerts and systems designed to protect customers.⁷ The framework is important but its original focus was unauthorised transactions. That focus left difficult questions where the customer personally initiated a transfer after being deceived.

6.2 Statutory and regulatory context

The Payment and Settlement Systems Act 2007 provides the statutory framework for the regulation and supervision of payment systems in India. The Information Technology Act 2000 contains provisions relevant to identity theft, cheating by personation using computer resources and other computer-related offences. The Bharatiya Nyaya Sanhita 2023 provides general criminal offences, including cheating and cheating by personation. These laws support investigation and prosecution, but criminal liability does not by itself establish a complete civil reimbursement route against a bank or payment intermediary.

The RBI Integrated Ombudsman Scheme 2021 provides a complaint-resolution avenue for eligible complaints against regulated entities, subject to its scope and procedural requirements. The National Cyber Crime Reporting Portal and helpline 1930 are important reporting channels. Reporting and law-enforcement intervention may assist in attempts to prevent onward movement of funds, but the availability of a reporting channel should not be confused with a guaranteed recovery or compensation entitlement.

6.3 RBI 2026 amendment directions: an important forthcoming change

On 24 June 2026, the RBI issued the Commercial Banks – Responsible Business Conduct Third Amendment Directions, 2026. The instrument states that it applies to electronic banking transactions undertaken by customers on or after 1 January 2027. It therefore had been issued but was not yet operative for transactions as at 10 November 2026.⁸

The Directions define a ‘fraudulent electronic banking transaction’ to include an electronic banking transaction executed by a third-party using credentials obtained from the customer through fraudulent means, a transaction executed by the customer under coercion or duress from a third party, and an unauthorised

electronic banking transaction. They also define bank negligence and customer negligence, and recognise third-party breaches involving intermediaries such as third-party application providers, payment aggregators, payment gateways and telecom service providers.⁹

The Directions place the burden of proving customer liability on the bank. They provide for zero liability and reversal where the fraud results from bank negligence or deficiency. They also provide zero liability in specified third-party-breach cases where the customer reports the unauthorised fraudulent transaction to the bank within five calendar days. Where customer negligence is established, the customer may bear loss until reporting, subject to the compensation mechanism. Banks must provide 24-hour reporting channels, send transaction alerts, take steps to prevent further unauthorised transactions and resolve complaints within a maximum of 45 calendar days for domestic cases and 60 calendar days for cross-border cases.¹⁰

The Directions also introduce a limited compensation mechanism for bona fide individual victims, including sole proprietors, where gross loss is up to ₹50,000 and the transaction falls within the specified third-partybreach category under paragraph 76N. Subject to the stated conditions, compensation is 85 per cent of net loss or ₹25,000, whichever is lower, once during the victim’s lifetime. The victim must report to the bank and to the National Cyber Crime Reporting Portal or helpline 1930 within five calendar days. The mechanism is limited to losses incurred during the one-year period from the Directions’ effective date.¹¹

This is a significant reform, but it should not be overstated. The compensation mechanism is not a universal guarantee for all APP scams or all customer-authorised transfers. The operative definitions and eligibility conditions must be applied carefully. In particular, the text defines fraudulent EBTs to include third-party credential misuse and customer approval under coercion or duress; it does not expressly state that every customer who is deceived into voluntarily paying a fraudulent recipient automatically qualifies for the same treatment. The paper therefore treats the 2026 Directions as an important but bounded reform, not as a complete APP reimbursement regime.

6.4 Implications for beneficiary banks and intermediaries

The RBI Directions expressly recognise a beneficiary bank as the bank holding the account into which the fraudulently debited amount is first credited for the purpose of the compensation contribution mechanism. In domestic cases, the beneficiary bank bears a defined share of compensation under paragraph 76T. This

creates a regulatory incentive to examine beneficiary-account controls, while leaving broader questions about the standard of care, causation and liability for individual account-opening or monitoring failures to be analysed under the applicable rules and facts.¹²

A key question for further research is whether the framework’s treatment of beneficiary banks and non-bank intermediaries is sufficient for multi-hop transactions. Fraud proceeds may move through multiple accounts and service providers. A practical recovery system requires timely information-sharing and preservation duties, lawful access to account data, clear escalation channels and procedures for resolving conflicts between institutions.

7. United Kingdom: App Reimbursement And Payment

7.1 Unauthorised payment transactions

The Payment Services Regulations 2017 establish a statutory framework for payment services. Regulation 74 requires a payment service user to notify the provider without undue delay and generally no later than 13 months after the debit date, subject to the regulation’s terms. Regulation 75 addresses evidence of authentication and execution. It provides that the provider must prove authentication, accurate recording and absence of technical breakdown or service deficiency, and that use of a payment instrument is not necessarily sufficient by itself to prove authorisation or customer fraud or gross negligence. Regulation 76 requires refund and restoration for an unauthorised transaction, subject to the Regulations.¹³

These provisions are important for disputes about unauthorised transactions. They do not, by themselves, provide a complete answer for an APP scam in which the customer has instructed the transfer after deception. That gap is addressed in part by the separate reimbursement framework.

7.2 Mandatory APP reimbursement

The PSR’s Faster Payments APP scam reimbursement requirement took effect on 7 October 2024. It applies to eligible APP scam payments within the scope of the rules and requires payment service providers participating in Faster Payments and providing relevant accounts to comply. The PSR confirmed a maximum reimbursement level of £85,000 per claim. Its policy allocates reimbursement costs between the sending and receiving payment service providers, generally on a 50:50 basis, subject to the detailed rules.¹⁴

The consumer-facing PSR guidance states that eligible claims should generally be reimbursed within five business days, although a provider may stop the clock in specified circumstances while gathering information; an outcome must generally be reached within 35 business days. The framework includes an optional excess of up to £100, which cannot be applied to vulnerable consumers. It covers individuals, microenterprises and charities within the relevant rules.¹⁵

The scheme is significant because it treats APP scams as a payment-system risk requiring institutional incentives, rather than leaving the loss solely to the customer. By including receiving providers, it creates incentives to prevent fraudsters from using accounts within the regulated payment system. It also offers a relatively clear claim route, subject to eligibility, exclusions, cooperation requirements and the reimbursement cap.

7.3 Limits and critical issues

The UK regime is not universal. It is tied to eligible payments and the specified Faster Payments reimbursement rules, and the £85,000 cap leaves some high-value losses outside mandatory reimbursement. Eligibility and exclusions matter, including the treatment of first-party fraud and claims that fall outside the definition of an APP scam. The PSR has also issued guidance to help providers distinguish APP scams from civil disputes.¹⁶

The regime therefore offers a useful model of shared institutional responsibility, but its effectiveness depends on consistent claim assessment, transparent reasons for rejection, quality data and accessible dispute resolution. A comparative study should avoid treating the 50:50 allocation as a complete statement of all liability in every factual scenario; the detailed PSR instruments and rules govern the actual operation.

8. Singapore: Shared Responsibility Framework

8.1 Regulatory background

Singapore’s Payment Services Act 2019 provides for the licensing and regulation of payment service providers and oversight of payment systems. The broader anti-scam framework combines regulatory requirements, public education, technical safeguards and operational coordination. The MAS and IMDA introduced the SRF for phishing scams with effect from 16 December 2024.¹⁷

8.2 Scope and allocation of responsibility

The SRF Guidelines apply to responsible financial institutions that issue protected accounts and responsible telecommunications companies providing cellular mobile telephone services. They clarify the roles and accountabilities of account users, financial institutions and telcos in mitigating the risk of seemingly authorised transactions. The framework is focused on a defined class of phishing scams involving impersonation and disclosure of account credentials, rather than every type of scam or every voluntary payment to a fraudster.¹⁸

The framework allocates duties to financial institutions and telcos. Financial institutions are the primary custodians of customer funds and are expected to implement specified anti-scam measures. Telcos have a supporting role in securing the SMS channel and implementing measures such as scam filtering. Where a responsible entity fails to discharge a relevant duty and the case falls within the framework, the entity may be expected to make a payout to the affected consumer. The framework uses a structured allocation approach, with financial institutions having the primary role and telcos a secondary role.¹⁹

The SRF is notable for recognising that digital payment security depends on a wider ecosystem. A scam may begin with an impersonation message or compromised communication channel, proceed through credential disclosure, and culminate in an account drain. Assigning specific duties to more than one sector acknowledges that fraud prevention is not exclusively a bank-customer relationship.

8.3 Limits and critical assessment

The SRF is narrower than a general APP reimbursement scheme. It focuses on specified phishing scams and defined duties. It does not automatically cover every investment scam, romance scam, malware-enabled scam or customer-initiated transfer. MAS has explained that the SRF forms part of a broader set of anti-scam measures and that existing avenues of recourse remain relevant for cases outside its scope or where no prescribed duty has been breached.²⁰

This limited scope is both a strength and a weakness. Defined duties make it easier to identify institutional failures and avoid imposing open-ended liability. However, scams evolve quickly and may migrate from SMS to messaging platforms, social media, malicious applications or other channels. The regulatory framework must therefore be reviewed as the fraud ecosystem changes.

9. Comparative Analysis

9.1 Different legal problems, different regulatory responses

The three jurisdictions do not regulate an identical problem. India’s 2026 Directions cover specified fraudulent electronic banking transactions, including certain third-party credential misuse, coercion or duress and unauthorised transactions. The UK APP reimbursement scheme focuses on eligible customer-authorised transfers induced by scams within the Faster Payments rules. Singapore’s SRF focuses on a defined class of phishing scams that result in unauthorised transactions and arise within the framework’s specified scope. Any comparison must therefore be functional rather than based on superficial labels.

9.2 Comparative matrix

Issue	India	United Kingdom	Singapore
Primary instrument	RBI 2017 circular; 2026 amendment directions effective 1 Jan 2027	PSR APP reimbursement rules; Payment Services Regulations 2017	MAS–IMDA Shared Responsibility Framework Guidelines
Core scope	Specified fraudulent and unauthorised electronic banking transactions	Eligible APP scams through Faster Payments	Defined phishing scams resulting in seemingly authorised/unauthorised transactions
Customer protection	Zero liability in specified bank-negligence and timely third-party-breach cases; limited small-loss compensation	Mandatory reimbursement for eligible APP scam claims, subject to cap and rules	Payout expectation where relevant FI or telco duties are breached
Institutional allocation	Bank liability and defined RBI/bank/beneficiary-bank contribution for limited compensation	Generally shared 50:50 between sending and receiving PSPs under scheme rules	FI primary duties; telco supporting duties under waterfall approach
Key limit	Narrow eligibility and reporting conditions; 2026 directions commence 2027	Scope, exclusions, cap and claim conditions	Limited to defined phishing scenarios and prescribed duties

The matrix shows that India’s forthcoming mechanism is distinct from the UK’s mandatory APP reimbursement model. India’s limited compensation scheme is directed at qualifying fraudulent EBTs under the relevant RBI paragraph and has a low-value ceiling. The UK scheme is designed specifically to reimburse eligible APP scam payments and divides the cost between sending and receiving providers. Singapore’s SRF is a duty-based model focused on a defined phishing pathway and includes telecommunications companies.

9.3 Customer consent and the meaning of authorisation

The most important conceptual issue is the difference between technical authentication and legally effective consent. A customer may enter a one-time password, approve a payment request or use biometric authentication because a fraudster has misrepresented the transaction. A purely technical test risks treating the victim’s action as conclusive, even where the payment instruction was induced by deception. The UK’s regulation 75 is relevant because it cautions against treating recorded use of a payment instrument as necessarily sufficient proof of authorisation.²¹

India’s 2026 Directions recognise certain cases in which a customer executes a transaction under coercion or duress, but the text should be analysed carefully in relation to deception-induced voluntary transfers. Singapore’s SRF focuses on phishing and credential compromise rather than all APP scams. The comparative lesson is that legal frameworks should clearly define which forms of deception, coercion and credential misuse trigger reimbursement or institutional liability.

9.4 Beneficiary-bank accountability

Fraudulent funds commonly enter a receiving account before being moved onward. The receiving institution may hold information about account opening, transaction patterns, suspicious activity and rapid withdrawals. The UK model’s shared reimbursement structure creates a direct financial incentive for both sending and receiving providers. India’s 2026 Directions also assign a defined contribution to beneficiary banks in the limited compensation mechanism for domestic cases. Singapore’s framework focuses on specified duties of responsible financial institutions and telcos. These approaches support the principle that the receiving side should not be ignored, although the precise legal standard and scope differ.

9.5 Recovery is not the same as compensation

All three jurisdictions illustrate the need to separate immediate fund preservation from later allocation of loss. A bank may be able to place a hold or issue an interbank alert before it can determine whether reimbursement is legally due. Conversely, a victim may have a valid compensation claim even where the original funds have already been dissipated. A complete legal framework should therefore provide both (a) an urgent operational track for preserving and tracing funds and (b) a separate adjudicative track for determining liability and compensation.

10. Findings

• Digital payment fraud cannot be analysed as a single legal category. Unauthorised transactions, APP

scams, phishing-related credential compromise and coercion-induced payments raise different legal questions.

• Technical authentication should not automatically be treated as conclusive proof of informed consent or

as a complete defence to institutional liability.

• The UK model demonstrates the potential of mandatory reimbursement and shared provider

responsibility for eligible APP scams, but its scope, cap and exclusions must be recognised.

• Singapore’s SRF demonstrates the value of assigning clear anti-scam duties across the financial and

telecommunications ecosystem, while its defined phishing scope limits its application to other scam types.

• India’s 2026 RBI amendment directions are a material development, but they are not effective until 1

January 2027 and the small-value compensation mechanism is subject to specific eligibility, reporting and duration conditions.

• Victim recovery requires coordinated action by sending banks, beneficiary banks, payment

intermediaries, telecommunications providers and law-enforcement authorities.

• Criminal prosecution alone is not an adequate substitute for accessible and timely victim compensation.

11. Recommendations: A Proposed Indian Recovery

FRAMEWORK

The paper proposes a Digital Fraud Victim Recovery and Shared Liability Model (DFVR-SLM). This is an original policy proposal developed for this study, not an existing statutory scheme.

11.1 A single, interoperable reporting pathway

A victim should be able to report a fraudulent payment through the sending bank, the payment application or a central reporting interface. The report should generate a unique reference number and be transmitted promptly to relevant banks and competent authorities. Existing channels such as the National Cyber Crime Reporting Portal and helpline 1930 should be integrated operationally with bank complaint systems, subject to lawful data-sharing safeguards.

11.2 Immediate preservation and tracing

Banks and payment intermediaries should be subject to clear, time-bound duties to acknowledge a fraud report, assess the possibility of onward transfers, preserve relevant transaction records and communicate with beneficiary institutions. Any freeze or restriction must be based on lawful authority, proportionate to the risk and accompanied by a review process to protect innocent account holders.

11.3 A tiered liability framework

Liability should be assessed using a transparent matrix that distinguishes: (a) bank negligence or security failure; (b) third-party or intermediary breach; (c) customer negligence; (d) deception-induced authorised payment; and (e) deliberate customer participation in fraud. A bank should provide a reasoned decision identifying the evidence relied upon. The customer should not be treated as negligent merely because a payment was authenticated.

11.4 Beneficiary-bank duties

The regulatory framework should clarify beneficiary-bank obligations concerning risk-based account monitoring, response to credible fraud alerts, preservation of transaction records and cooperation with lawful tracing requests. Liability should depend on breach of a defined duty and a defensible causal connection to the loss, rather than strict liability for every fraudulent credit.

11.5 A proportionate reimbursement mechanism

India should evaluate whether a broader reimbursement scheme is appropriate for defined categories of APP scams. A workable model could begin with eligible retail payment transactions, transparent exclusions, a fair standard for customer conduct, a reimbursement cap subject to periodic review, and shared contributions from sending and receiving institutions. The scheme should avoid making the victim’s recovery wholly dependent on identifying or prosecuting the fraudster.

11.6 Independent dispute resolution

A victim whose claim is rejected should receive the reasons, relevant evidence and information about review and escalation. An independent dispute-resolution mechanism should be able to examine whether the bank applied the correct legal test, assessed vulnerability fairly and complied with its reporting and preservation duties.

11.7 Data transparency and periodic review

Regulators should publish comparable data on reported fraud, claim volumes, acceptance and rejection rates, time to decision, amounts reimbursed, amounts recovered, repeat beneficiary accounts and reasons for rejection. Such data should be anonymised and disaggregated by payment channel and fraud type. Periodic review would allow the regulator to identify whether the framework is improving prevention and victim outcomes.

11.8 Consumer protection and privacy safeguards

Fraud detection and information-sharing should be subject to data minimisation, purpose limitation, security controls, retention limits and avenues to correct inaccurate fraud flags. A person whose account is frozen as a

suspected mule account should have access to a prompt review, especially where the person may be an unwitting account holder.

12. Limitations And Future Research

This paper is doctrinal and does not include interviews with victims, bank officials, regulators or lawenforcement agencies. It does not statistically compare recovery outcomes across the three jurisdictions. The legal schemes also differ in scope and legal form: the UK APP reimbursement rules are not identical to Singapore’s duty-based SRF or India’s RBI customer-liability directions. Further research should examine judicial decisions on customer consent and bank negligence, conduct interviews with relevant stakeholders, analyse anonymised complaint data, and assess the operation of India’s 2026 Directions after they commence on 1 January 2027.

A further research question concerns the relationship between fraud reimbursement and criminal asset recovery. Future work could examine how compensation paid by a bank or regulatory fund should interact with later recovery from the fraudster, subrogation, restitution orders and interbank settlement.

13. Conclusion

The right to recover money lost through digital payment fraud is increasingly central to trust in electronic banking. The legal challenge is not confined to determining whether a payment was technically authenticated. It requires a broader assessment of customer consent, the nature of deception, the duties of payment providers, the role of beneficiary institutions and the availability of timely remedies.

The comparative analysis demonstrates three distinct approaches. The UK has adopted mandatory reimbursement for eligible APP scams within the Faster Payments framework. Singapore has created a defined shared-responsibility model for phishing scams that assigns duties to financial institutions and telecommunications providers. India has historically focused on unauthorised electronic banking transactions and has issued 2026 amendment directions that broaden protection for defined fraudulent electronic banking transactions, with effect from 1 January 2027. These frameworks are not interchangeable, and each has limitations.

For India, the next step should be to connect the regulatory recognition of fraud with a practical recovery system. Such a system should enable rapid reporting, lawful preservation of funds, transparent liability assessment, fair treatment of customers, beneficiary-bank accountability and independent review. Reimbursement should complement criminal investigation rather than depend entirely upon its success. A victim-centred approach can strengthen financial inclusion and public confidence while creating incentives for banks and payment intermediaries to prevent fraud at the point where it can most effectively be stopped.

Notes

¹ Evidence on authentication and execution of payment transactions

² of 2019 (Sing.), https://sso.agc.gov.sg/Act/PSA2019.

³ eligible APP scams sent through Faster Payments

⁴ Singapore’s Shared Responsibility Framework (SRF)

⁵ Regulation 76

⁶ Phishing-related seemingly authorised transactions

⁷ RBI’s 2017 customer-protection framework

⁸ Monetary Authority of Singapore & Infocomm Media Development Authority, Guidelines on Shared Responsibility Framework (Oct. 24, 2024), https://www.imda.gov.sg/-/media/imda/files/regulations-and-licensing/regulations/consultations/2024/shared-responsibility-framework-for-phishing-scams/guidelines-on-shared-responsibility-framework.pdf.

⁹ Monetary Authority of Singapore, Combatting Scams: Shared Responsibility Framework, https://www.mas.gov.sg/regulation/combatting-scams (last visited Nov. 10, 2026).

¹⁰ Reserve Bank of India, Customer Protection—Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, RBI/2017-18/15, DBR.No.Leg.BC.78/09.07.005/2017-18 (July 6, 2017), https://rbi.org.in/Scripts/NotificationUser.aspx?Id=11040&Mode=0.

¹¹ Monetary Authority of Singapore & Infocomm Media Development Authority, Guidelines on Shared Responsibility Framework (Oct. 24, 2024), https://www.imda.gov.sg/-/media/imda/files/regulations-and-licensing/regulations/consultations/2024/shared-responsibility-framework-for-phishing-scams/guidelines-on-shared-responsibility-framework.pdf.

¹² Payment Services Act 2019, No.

¹³ Reserve Bank of India, Reserve Bank—Integrated Ombudsman Scheme, 2021 (Nov. 12, 2021).

¹⁴ Information Technology Act, No.

¹⁵ Information Technology Act, No.

¹⁶ Payment Services Regulations 2017, SI 2017/752, regs. 67, 74–76 (UK), https://www.legislation.gov.uk/uksi/2017/752/contents

¹⁷ Reserve Bank of India, Customer Protection—Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, RBI/2017-18/15, DBR.No.Leg.BC.78/09.07.005/2017-18 (July 6, 2017), https://rbi.org.in/Scripts/NotificationUser.aspx?Id=11040&Mode=0.

¹⁸ Monetary Authority of Singapore & Infocomm Media Development Authority, Guidelines on Shared Responsibility Framework (Oct. 24, 2024), https://www.imda.gov.sg/-/media/imda/files/regulations-and-licensing/regulations/consultations/2024/shared-responsibility-framework-for-phishing-scams/guidelines-on-shared-responsibility-framework.pdf.

¹⁹ Payment Services Act 2019, No.

²⁰ Monetary Authority of Singapore, Combatting Scams: Shared Responsibility Framework, https://www.mas.gov.sg/regulation/combatting-scams (last visited Nov. 10, 2026).

²¹ Reserve Bank of India, Statement on Developmental and Regulatory Policies (Feb. 6, 2026); https://rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=62340.

---

Author: Ilakkia.J | Institution: VMLS | Email: [email protected]