Credit Card Fraud & Chargebacks

A second rule matters just as much. The burden of proving that you were liable sits with the bank, not with you. You do not have to prove you were careless. The bank has to prove you were.

What is the RBI zero-liability rule for credit card fraud?

The 2017 circular splits fraud into three buckets, and your liability depends entirely on which bucket applies. Say the bank itself was at fault. A system failure, a breach at its end, negligence in its process. Your liability is nil. The reporting date does not matter. You could find the entry a year later and still owe nothing.

The second bucket is a third-party breach. Neither the bank nor you were at fault. Card data stolen from a merchant’s server is the common case. Here the clock decides. Report within three working days of the bank’s alert and you owe nothing. The third bucket is where you were negligent. You shared the OTP, or the card, or the CVV. Then you bear the full loss until the moment you report it. After you report it, the bank bears everything.

How many days does the bank get to put the money back?

Ten working days from the date you report it. The circular calls this a shadow reversal. The money goes back into your account while the investigation runs. It is not conditional on the outcome. Banks routinely ignore this. They tell customers to wait for the enquiry to finish. That instruction is wrong. Quoting the ten-working-day clause in writing usually ends the argument.

The investigation itself has a separate limit. The bank must close the complaint within 90 days of receiving it. If it does not, it must pay the compensation anyway. It does not matter whether the fraud is ever traced.

There is also a rule that helps while the dispute is open. The RBI Master Direction on credit and debit cards covers this (Credit Cards and Debit Cards: Issuance and Conduct Directions, 2025, RBI/DOR/2025-26/155, 28 November 2025, paragraph 27). No charges may be levied on a transaction disputed as fraud, until that dispute is settled. So interest and late fees should not accrue on the disputed amount. If your next statement shows them, that is a second complaint, not a fact of life.

Chargeback or fraud dispute — which one do you file?

These are two different things and people conflate them constantly. A fraud claim says the transaction was not authorised by you at all. A chargeback says you made the payment, but the merchant did not deliver. Wrong item, no delivery, a cancelled subscription, a double charge. All chargeback territory.

The route differs. Fraud goes to your bank under the 2017 circular, on the timeline above. A chargeback goes to your bank too. But it runs on the card network’s rules: Visa, Mastercard, RuPay or Amex. The bank then pushes it to the merchant’s acquiring bank. Network chargeback windows run from the transaction or the expected delivery date. They are shorter than people expect. File early. The bank will not tell you the window is closing.

A failed transaction is a third category again. Say your card was debited but the merchant never got a confirmation. RBI’s turnaround-time circular (RBI/2019-20/67, 20 September 2019) requires auto-reversal within five days. That covers both a swipe at a shop and an online card payment. Miss that and the bank owes you ₹100 for each day of delay, paid on its own initiative without you asking. The same circular gives UPI fund transfers a much tighter window of one day. There is more on those windows in our guide to UPI, wallets and digital payments.

What should you do in the first hour?

1. Block the card. Use the app or the 24×7 helpline. The Master Direction requires the issuer to block it immediately and send you a confirmation.
2. Get a written acknowledgement with a complaint reference number and a timestamp. This is the document that fixes your reporting date.
3. Send the same complaint by email, so you hold a dated copy that is not in the bank’s system alone.
4. Ask in writing for the ten-working-day shadow credit, quoting RBI/2017-18/15.
5. Do not close the card account while the dispute is live. Closing it makes the refund route messy.

The written acknowledgement is the part people skip, and it is the part that decides the case. Your liability turns on the reporting date. Suppose the only record of that date sits in a call-centre log you cannot see. You then cannot prove you were inside three days.

Where do you escalate if the bank refuses?

Give the bank 30 days from the date you lodged the complaint. That limit is in the Master Direction. Is the reply unsatisfactory, or absent? The next step is the RBI Ombudsman, under the Reserve Bank Integrated Ombudsman Scheme. It is free, it is online, and the bank has to defend its position with evidence.

Take the escalation seriously, because the ombudsman is where the burden-of-proof rule does its work. In a branch, the conversation is about whether you shared your OTP. In front of the ombudsman, the bank has to show that you did. Those are very different conversations. Know your other rights as a cardholder before you go in. Fraud complaints often sit alongside billing and closure disputes.