Mistakes, Fraud and Complaints
Credit card fraud in India: zero liability if reported within 3 working days, and what to do
What to do after an unauthorised credit card transaction in India, the RBI customer liability rules (zero, limited and policy-based), the 10-day shadow credit, disputes and helpline 1930.
If an unauthorised transaction appears on your credit card, block the card and report it to the issuer immediately — the timing decides who pays. Under the RBI's customer liability framework for banks (first issued on 6 July 2017 and now carried in the RBI's responsible business conduct directions), you have zero liability for third-party fraud if you report it within three working days of receiving the bank's alert; reporting in four to seven working days caps your liability at the transaction value or ₹10,000 for cards with a limit up to ₹5 lakh (₹25,000 above ₹5 lakh), whichever is lower; after seven working days, the bank's board policy decides. If the loss is due to the bank's own deficiency, you have zero liability regardless. If you shared your OTP or PIN, you bear the loss until you report it. Also report cyber fraud on 1930 or cybercrime.gov.in. Change ahead: for commercial banks, the RBI replaced these rules on 24 June 2026 with a new customer protection framework that applies to electronic transactions made on or after 1 January 2027 (see below).
This guide belongs to the credit card mistakes guide. It is general information, not legal advice.
The liability table
| Situation | Your liability |
|---|---|
| Fraud due to the bank's contributory fraud, negligence or deficiency | Zero, whether or not you report |
| Third-party breach (fault neither yours nor the bank's), reported within 3 working days | Zero |
| Third-party breach reported within 4–7 working days | Lower of the transaction value or ₹10,000 (card limit up to ₹5 lakh) / ₹25,000 (card limit above ₹5 lakh) |
| Reported after 7 working days | As per the bank's board-approved policy |
| Loss due to your negligence (e.g. sharing OTP, PIN, CVV) | Full loss until you report; the bank bears losses after reporting |
Working days are counted from the date you receive the bank's communication (SMS or email alert), excluding that day, according to the working schedule of your home branch. This is why registering your mobile number for alerts matters.
The 10-day shadow credit and 90-day resolution
Once you report, the bank must credit the disputed amount to your account (shadow reversal) within 10 working days of your notification, without waiting for any insurance claim. The complaint must be resolved and liability established within the time in the bank's board policy, not exceeding 90 days from receipt of the complaint; if it is not, the bank must compensate you as if you were not liable. While a transaction is disputed as fraud, the RBI's card directions say no charges may be levied on it until the dispute is resolved.
What changes from 1 January 2027 (commercial banks)
The RBI (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026 of 24 June 2026 replace the liability section for electronic transactions made on or after 1 January 2027. Separate amendments cover small finance banks, payments banks, regional rural banks and co-operative banks. In outline:
| Point | Rule for transactions from 1 Jan 2027 |
|---|---|
| Bank's negligence or deficiency | Zero liability, whether or not you report |
| Third-party breach | Zero liability if you report within five calendar days of the transaction; after that, the bank's policy |
| Your negligence (e.g. sharing credentials) | You bear the loss until you report |
| Burden of proof | On the bank |
| Shadow reversal on a credit card | Within five calendar days of your notification |
| Resolution | Within the bank's policy, at most 45 calendar days (domestic) or 60 calendar days (cross-border) |
| Alerts | SMS for every electronic transaction above ₹500 |
The amendment also sets up a one-time compensation for small-value fraud victims (gross loss up to ₹50,000; 85% of the net loss or ₹25,000, whichever is lower), with conditions such as reporting to the bank and on 1930 or cybercrime.gov.in within five calendar days. Check the RBI text for the exact conditions before you rely on it.
What to do, in order
- Block the card in the app, by SMS or on the 24x7 helpline. This stops further losses.
- Report the transaction to the issuer through its official channel and get a reference number. Note the date and time.
- Call 1930 or report on the National Cyber Crime Reporting Portal for online fraud; this helps attempt to freeze funds quickly.
- Change passwords and PINs for your banking apps and email.
- Submit the dispute form and any documents the issuer asks for (an FIR or cyber complaint copy, if requested).
- Check the shadow credit within 10 working days, and the final decision within 90 days (from 1 January 2027: five calendar days and 45 or 60 days at a commercial bank).
- If the issuer refuses or does not respond within 30 days, complain to the RBI Ombudsman; see credit card complaints.
Worked example (illustrative)
You get an SMS on Monday at 10 p.m. for a ₹42,000 online transaction you did not make. Your card limit is ₹3 lakh.
- Report on Tuesday morning: within 3 working days → zero liability (if you did not share credentials).
- Report the following Monday (the fifth or sixth working day, depending on whether that Saturday is a bank working day): liability up to ₹10,000 (lower of ₹42,000 and ₹10,000).
- Report three weeks later: the bank's policy decides.
Common fraud patterns
- OTP and "KYC update" calls. Banks do not ask for OTP, PIN or CVV on calls.
- Fake reward redemption links. Messages saying your points will expire, linking to a lookalike site.
- Collect requests on UPI. Approving a collect request sends money; it does not receive it.
- Card skimming and lost cards. Use contactless or chip where possible; set limits.
- Remote access apps. Never install screen-sharing apps at a caller's request.
Prevention settings
| Setting | What to do |
|---|---|
| Domestic online, contactless, international use | Switch off what you do not use; the RBI circular "Enhancing Security of Card Transactions" of 15 January 2020 requires issuers to let you switch these on and off and set limits, 24x7 |
| Transaction limits | Set per-channel limits in the app |
| Alerts | Keep SMS and email alerts active and your contact details current |
| Tokenised cards | Use tokens saved with merchants rather than typing card details |
Frequently asked questions
Do I lose money if I report on the fourth day?
For a third-party breach on a transaction before 1 January 2027, your liability is capped at the lower of the transaction amount or ₹10,000/₹25,000 depending on your card limit. For transactions at a commercial bank from 1 January 2027, reporting within five calendar days keeps your liability at zero.
What if I shared my OTP?
You bear the loss until you report it. Losses after reporting are the bank's.
Will the bank charge interest on the disputed amount?
No charges should be levied on a transaction disputed as fraud while the dispute is open.
Should I also go to the police?
For significant amounts or identity theft, yes. A cyber complaint number is often useful to the bank.
Sources
- Reserve Bank of India — Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (6 July 2017), Responsible Business Conduct Third Amendment Directions, 2026 (24 June 2026) and Enhancing Security of Card Transactions (15 January 2020)
- National Cyber Crime Reporting Portal — reporting online fraud, helpline 1930
- RBI Complaint Management System — complaints to the RBI Ombudsman
