Despite a zero-liability regime and a national helpline, victims of digital financial fraud continue to face poor recovery outcomes. Analyse the institutional gaps and suggest reforms.

India protects fraud victims in two ways. RBI's 2017 framework gives zero liability to customers who report within 3 working days, with a shadow credit due within 10 working days [2]. The 1930 helpline/CFCFRMS has saved over ₹11,158 crore [3]. Yet SPIR 2026 finds that most victims reached their bank within 24 hours and still faced delayed blocking, poor support and refusal of liability [1]. The failure lies with institutions, not victims.

Institutional gaps

• Days versus minutes: the RBI rule decides who bears the loss within day-based windows [2]. No deadline in hours exists for freezing funds after a 1930 alert, though money is recovered only if frozen before it leaves the system.
• Mule-account layering: stolen money hops through mule accounts within hours. I4C has flagged transnational gangs using such accounts to run illegal payment gateways [6]. Receiving banks whose KYC failed face no liability.
• Narrow "unauthorised" scope: in digital-arrest/social-engineering scams, the victim makes the payment or shares the OTP. Banks call this customer negligence, and zero liability falls away [2].
• Information asymmetry: the burden of proof lies on the bank [2], but victims handling "complex systems" alone [1] simply accept refusals.
• Redress comes after the damage: digital-transaction complaints were already 44.66% of ombudsman complaints in 2019-20 [4]. The ombudsman awards compensation after the fact [5] but cannot force a first-hour freeze.
• No accountability data: CFCFRMS publishes only total savings [3], not bank-wise response times, so slow banks face no pressure.

Reforms

• Freeze deadline in hours: RBI should set a time limit in hours for freezing funds after a CFCFRMS alert, with penalties for missing it.
• Shared liability: the revised framework should state when tricked-into-paying scams get capped liability. Receiving banks should share the loss when a mule account is proved.
• AI detection in every bank: extend MuleHunter.AI under the I4C–RBIH MoU [7] to all banks, including co-operative banks.
• Transparency: I4C should publish each bank's freeze time and recovery rate.
• Victim support: each bank should have a fraud-case officer and publicise customers' liability rights.

Zero liability decides who pays; only speed decides whether the money comes back. Time-bound duties, liability that follows fault, and public performance data would line banks' incentives up with recovery. That would make paper protections real, keep trust in digital payments, and advance SDG 16.3's goal of equal access to justice.