Block the card or account immediately through your bank's official channel, report the transaction as unauthorised in writing, and call 1930. Under RBI's customer-liability rules, you bear no loss if the fraud was the bank's fault or a third-party breach you reported promptly. If the bank refuses, complain to the RBI Ombudsman.
Key takeaways
- Block the card first, then report every disputed transaction in writing and keep the reference number.
- Prompt reporting of a third-party breach can mean zero liability under RBI rules.
- Sharing an OTP or PIN usually shifts the loss to you until you report it.
- Banks must reply to your complaint; if they do not, the RBI Ombudsman is free to use.
- No genuine bank asks you to update KYC through a link, call or remote-access app.
What should you do right after credit card fraud?
Treat the first hour as the most important. The aim is to stop further debits and create a time-stamped record that you reported the fraud, because the timing of your report decides how much of the loss the bank must bear.
- Block the card from your bank's app, net banking or the number printed on the back of the card. Most apps let you switch off online, international and contactless use separately.
- Report every unauthorised transaction to the bank and say clearly that you did not authorise it. Use a channel that gives you a complaint number, such as the app, email to the bank's official address or the bank's fraud helpline. Note the date and time.
- Call 1930 or file on cybercrime.gov.in, especially for large amounts. The police route helps freeze money that reached a fraudster's account. Our step-by-step reporting guide covers this in detail.
- Submit the bank's dispute form if it asks for one, attaching a copy of the cyber complaint acknowledgement.
- Keep the card if it is still with you; it shows the transaction did not need the physical card, which helps in skimming and online-misuse cases.
Can the bank refund fraud? RBI's customer-liability rules
Yes, in many cases the bank must. RBI's framework on limiting customer liability in unauthorised electronic banking transactions, which covers cards, net banking and similar channels, works broadly like this:
| Situation | Who usually bears the loss |
|---|---|
| Fraud caused by the bank's negligence or system lapse | Bank (zero customer liability), whether or not you reported quickly |
| Third-party breach (skimming, data leak, hacked merchant) that you report promptly | Bank (zero customer liability) |
| Third-party breach that you report late | Customer liability is limited to a capped amount, which rises with delay and depends on account type, as set out in the bank's policy |
| Loss due to your negligence, such as sharing PIN, OTP or card details | Customer, until the moment you report; the bank bears losses after that |
Two more points matter. First, the burden of proving customer negligence is on the bank, not on you. Second, after you report, the bank is expected to credit the disputed amount to your account provisionally (often called a "shadow reversal") within a set time while it investigates, and to resolve the complaint within a fixed period.
RBI has issued updated directions for commercial banks that apply to electronic transactions from 1 January 2027, strengthening alerts, 24x7 fraud reporting and reversal timelines, including a compensation mechanism for eligible small-value frauds. The exact day limits and liability caps for your case are written into your bank's board-approved customer-protection policy, which it must publish on its website. Ask for it in writing if the bank disputes your claim.
How does ATM skimming work, and how do you protect yourself?
Skimming means a device fixed on an ATM or a card swipe machine copies your card's magnetic stripe, while a hidden camera or fake keypad records your PIN. The copied card is then used elsewhere, sometimes in another city.
- Before inserting your card, check the card slot and keypad for anything loose, bulky or freshly glued.
- Cover the keypad with your hand while typing your PIN.
- Prefer ATMs inside bank branches or guarded kiosks, and use card-less or tap options where available.
- Keep transaction alerts on and read every SMS, even for small amounts; skimmers often test a card with a tiny withdrawal first.
If you are hit, report it at once and mention in writing that the card never left your possession. A skimming loss is a classic third-party breach, which is why fast reporting matters so much under the RBI framework. You can also ask the bank to preserve the ATM's CCTV; see our guide on CCTV footage as evidence for why footage must be requested quickly.
What are KYC-related frauds in India?
KYC frauds start with an SMS, WhatsApp message or call saying your account, card or wallet will be blocked unless you "update KYC" today. The fraudster then gets you to click a link that copies your net-banking login, read out an OTP, or install a remote-access app that lets them see your screen.
Know these facts:
- Banks do KYC updates through their branch, official app or official website, never through a link sent from a mobile number.
- No bank employee needs your OTP, PIN, CVV or net-banking password.
- A genuine bank never asks you to install a screen-sharing or "support" app.
- Messages from personal mobile numbers claiming to be from a bank are a red flag. Report them on Sanchar Saathi's Chakshu facility.
KYC fraud is often combined with a SIM swap, where the fraudster also takes over your number so OTPs go to them. If your phone suddenly loses signal, read our guide to SIM swap fraud straight away.
How do you report bank fraud to RBI?
RBI does not investigate individual frauds itself, but it runs the Integrated Ombudsman Scheme, which handles complaints against banks, NBFCs and payment system participants in one place.
- Complain to your bank first, in writing, and keep the complaint number.
- If the bank rejects the complaint, does not reply within the time allowed under the scheme, or you are not satisfied, file at cms.rbi.org.in. You can also send the complaint by email or post to RBI's Centralised Receipt and Processing Centre.
- Attach the bank's reply (or your proof of complaint), your cyber complaint acknowledgement, the transaction statement and any card-block confirmation.
- The Ombudsman can facilitate a settlement or pass an award directing the bank to pay. There is no fee, and you do not need a lawyer.
The Ombudsman route is about the bank's duty to you. Criminal prosecution of the fraudster runs separately through the police. For UPI transactions, the dispute ladder also includes NPCI; see what to do after a UPI fraud.
Can credit card fraud be traced?
Often, yes, by the bank and the police. Card networks and banks know which merchant received the payment, and the merchant or payment gateway knows the account, delivery address, device or IP used. Police can obtain these details through lawful requests under the BNSS and the IT Act. Fraud through cards and online banking is typically charged as cheating (BNS s.318) and, where identity data was misused, identity theft and cheating by personation under IT Act s.66C and s.66D.
A private detective cannot lawfully access bank, card or telecom records. What a professional can do is help in cases with a known suspect, such as an employee, relative or domestic help who had access to your cards, by gathering lawful evidence for your police complaint. Our guide on employee theft and fraud investigation explains how such cases are handled for businesses.
How do you protect your cards and accounts going forward?
- Turn off international and online use on cards you only use in shops, and set daily limits in the bank app.
- Register both SMS and email alerts and keep your mobile number updated with the bank.
- Use virtual or single-use card numbers for online shopping where your bank offers them.
- Check your credit report a few times a year for cards or loans you did not apply for; that is a sign of identity theft, covered in our guide on PAN and Aadhaar misuse.
- Never save card details in apps or browsers on shared devices.
Bottom line
Block first, report in writing second, call 1930 third. Under RBI rules, your liability depends on who was at fault and how fast you reported, and the bank must prove your negligence if it says you were careless. If the bank says no, the RBI Ombudsman is a free and effective next step. For business cases with an inside suspect, a verified investigator through corporate investigation services can help build the evidence.
Sources & official links
This guide is general information, not legal advice. Laws and procedures change, and every case is different — speak to a lawyer about your situation. In an emergency, call 112.