The First 24 Hours Matter Most
An unfamiliar charge on your credit card statement, a transaction you never made, in an amount you don't recognize, from a merchant you've never heard of, triggers a very specific and time-sensitive process under RBI regulation. How quickly and correctly you act in the first few days determines whether you get a full refund with zero liability, a partial refund, or end up bearing the cost yourself. This guide lays out exactly what RBI's rules say, the reporting timeline that governs your liability, and the practical steps to take the moment you spot something wrong.
Step 1: Block the Card Immediately
Before anything else, block or freeze the card through your bank's mobile app, net banking portal, or 24x7 customer care helpline. Every major issuer now supports instant card blocking directly from the app, which stops further unauthorized use in seconds rather than waiting on a call center queue. If the card is physically lost or stolen, report that fact explicitly, since it changes the nature of the dispute from a purely digital fraud case to a lost-card liability case, which some issuers handle slightly differently.
Step 2: Understand RBI's Zero-Liability Framework
RBI's guidelines on customer protection for unauthorized electronic transactions set out a graded liability structure based on how quickly you report the issue and whose negligence caused it.
| Reporting Window | Cardholder Liability | Condition |
|---|---|---|
| Within 3 working days | Zero liability | Applies when the fraud is due to bank/system-side lapse or third-party breach, with no cardholder negligence |
| 4 to 7 working days | Limited liability | Capped amount depending on card type and transaction value, as per the bank's board-approved policy |
| Beyond 7 working days | Liability as per bank's policy | Determined case by case; can approach full liability if delay is unexplained |
| Cardholder negligence (shared OTP/PIN) | Full or high liability | Applies regardless of reporting speed if negligence is established |
The critical takeaway is that speed directly protects your money. A transaction reported the same day you notice it, especially if you never shared your card details, OTP, or CVV with anyone, gives you the strongest possible claim to a full refund.
Step 3: File the Formal Dispute
Contact your bank's credit card dispute or chargeback team, either through the app, a written email to the registered grievance address, or a formal letter, clearly stating the transaction date, amount, merchant name as it appears on your statement, and an explicit declaration that you did not authorize or benefit from the transaction. Most major issuers also have an in-app "dispute this transaction" button that starts the formal chargeback process directly. Retain your acknowledgment number, since you'll need it for any follow-up or escalation.
For higher-value disputes, some banks require a copy of a police complaint or an acknowledgment from the National Cyber Crime Reporting Portal. It's worth filing this proactively even if not immediately requested, both to strengthen your case and because unauthorized transactions of meaningful size are a reportable cybercrime. You can file at cybercrime.gov.in or call the 1930 national cybercrime helpline, which is staffed specifically to handle financial fraud complaints and can sometimes help freeze funds at the receiving end if reported quickly enough.
Step 4: The Bank's Investigation and Refund Timeline
Once you've filed the dispute, the bank is required to investigate, which typically involves contacting the payment network and the merchant's acquiring bank. As per RBI's framework, the bank should resolve the complaint and, in genuine zero-liability cases, credit the disputed amount to your account within a reasonable timeframe, commonly cited as up to 10 working days from the date of reporting for the shadow credit to reflect while the investigation proceeds, though the full formal resolution can take longer for complex cases. This means you should not be made to pay interest or late fees on the disputed amount while the investigation is ongoing, and any billing cycle should reflect the amount as provisionally credited back if the bank follows the guidelines correctly.
What Counts as Cardholder Negligence
Banks frequently push back on disputes by alleging negligence, so it's worth knowing what actually qualifies. Sharing your OTP, CVV, or card PIN with anyone, including someone posing as a bank representative on a phone call, is treated as negligence and can shift liability to you. Clicking on a phishing link and entering card details on a fake payment page is also generally treated this way. However, a transaction that occurred purely through a data breach at a merchant's end, a cloned card used at a compromised point-of-sale terminal, or a system-level vulnerability exploited without any action on your part, should not be classified as cardholder negligence, and you are entitled to push back firmly if a bank tries to categorize it that way without evidence.
For a broader understanding of how liability and compensation rules apply across different fraud scenarios, the earlier article on credit card fraud, RBI rules, and compensation is a useful companion read, and the summary of RBI's Master Directions on credit cards covers the wider regulatory framework these dispute rules sit within.
Step 5: Escalating If the Bank Refuses
If your bank rejects a dispute you believe is legitimate, or simply fails to respond within a reasonable period, you have the right to escalate. First, exhaust the bank's internal grievance redressal by writing to the nodal officer. If that yields no satisfactory resolution, typically within 30 days, or if the total unresolved period since your initial complaint crosses 90 days, you can approach the RBI Banking Ombudsman through the centralized portal at cms.rbi.org.in, free of charge. The detailed process for this, including the exact information the portal requires, is covered in the guide to filing an RBI Banking Ombudsman complaint online.
Preventing the Next Unauthorized Transaction
Enable real-time SMS and app alerts for every transaction on your card, set conservative daily transaction limits through your bank's app, and disable international or card-not-present transactions if you rarely use them. If you're evaluating a new card and want one with strong fraud controls and transparent dispute handling built in, comparing options on the credit cards marketplace before applying is a sensible starting point, alongside checking your approval odds with the Credit Card Eligibility Checker.