TL;DR: If your card is charged without your consent, block it and tell your bank straight away. Under the RBI's 2017 customer-protection directions you carry zero liability for a third-party fraud reported within three working days, and the bank should credit the money back within 10 working days. Report late and your liability can rise. If you shared an OTP or PIN, you may bear the loss until you report.

👉 Use the free digital footprint checker — 30 seconds →

A card fraud alert at midnight is stressful, but the first hour matters more than anything else you do. The Reserve Bank of India's rules on unauthorised electronic transactions reward speed, so this guide starts with the clock.

The first hour: what to do

  1. Block the card in your bank's app or by calling the number printed on the back of the card. Do not use a number from a search result, because fake helplines are a scam of their own (see our guide to fake customer care numbers on Google).
  2. Write down the details: amount, date, merchant name and reference number from the alert.
  3. Report in writing. The RBI directions require banks to let you report by replying to the alert message, and also by email, phone banking and a link on the bank's site, according to YourStory.
  4. Keep the evidence: screenshot the alert and do not delete the messages.
  5. If a call, link or app install came first, also call 1930 and file at the national cybercrime portal. Our 1930 fund-freeze explainer and cybercrime complaint guide walk through it.

Your liability under the RBI directions

The RBI's July 2017 directions on limiting customer liability in unauthorised electronic banking transactions set out who pays, depending on who was at fault and how fast you report. As summarised by Millennium Post:

Once you notify the bank of a covered transaction, it should credit the amount back within 10 working days without waiting for any insurance claim, as explained by PersonalFN. Banks publish their own versions of these rules, so check your card issuer's policy for the exact limits.

What counts as "unauthorised"?

A transaction you did not start or approve: a cloned or skimmed card, card details stolen from a compromised merchant, or an online charge that went through without your OTP. That is different from a charge you approved after being tricked, for example by a caller posing as your bank asking for the OTP. Banks tend to treat that as customer negligence, so the three-day protection may not help. Report it anyway, because losses after you report are the bank's, and the 1930 fund-freeze can still catch money in transit. Scripts like this one are covered in KYC update scam calls.

If the bank refuses or stalls

  1. Ask for the refusal in writing, with the reason and your complaint reference number.
  2. Escalate to the bank's nodal officer, then to the RBI's complaint system for banking grievances through the Reserve Bank of India.
  3. Keep every alert, email and call log. The RBI directions also expect complaints to be resolved and liability settled within 90 days.

Cut the odds next time

UPI is a different track with different recovery rules; see how UPI fraud disputes work.

FAQs

What is zero liability for credit card fraud in India?

Zero liability means you lose no money on an unauthorised card transaction. Under the RBI's 2017 directions it applies when the bank is at fault, or when the fault lies elsewhere in the system and you report to the bank within three working days of receiving its transaction alert.

How many days do I have to report card fraud in India?

Report immediately. Within three working days you get zero liability in third-party fraud cases. From four to seven working days your liability is capped, and after seven working days it depends on your bank's board-approved policy.

Will the bank refund me if I shared my OTP?

Usually not automatically. If the loss is due to your negligence, such as sharing an OTP, PIN or card details, you bear the entire loss until you report it. Losses after you report are the bank's. Report at once and call 1930 if a scammer was involved.

How long does the bank take to refund unauthorised card fraud?

Once you notify the bank of a covered unauthorised transaction, the RBI directions require it to credit the amount to your account within 10 working days, without waiting for any insurance claim to settle.

Should I call 1930 for credit card fraud?

Yes, if the fraud involved a phishing call, link, fake app or scam message. The 1930 helpline and the national cybercrime portal can trigger a fund freeze, which works alongside your bank dispute, not instead of it.

Does the same rule cover debit cards and net banking?

The directions cover electronic banking transactions, including internet banking, mobile banking, ATM and point-of-sale transactions, so debit cards and net banking are included.

Leaked phone numbers and emails feed the calls that lead to card fraud, so see what is exposed with the free digital footprint checker.

Curious what's already out there? Scan My Shadow checks a phone number and email across 1,500+ sources and sends a clear report — no guesswork, just facts. Start your scan.

Sources

Related Reading