Credit card fraud complaint, chargeback and banking ombudsman: what to do, in what order

What should I do first if I see a fraud transaction on my card?

Block the card, report the transaction to your bank as fraud and keep the complaint number, all the same day, because any loss after you report falls on the bank. If the card itself was lost or stolen, report that at once: HDFC, SBI Card and Canara's MITCs make you wholly liable for transactions before you report the loss. Then dial 1930 and file a police complaint.

These time limits apply to transactions before 1 January 2027: see the 2027 section.

Read today from the RBI directions, the 2026 Scheme and each bank's document, listed under sources.

How much will I pay if I report the fraud late?

If the fault lies in the wider system, not with you or the bank, you pay nothing when you report within three working days of the alert. At four to seven working days you pay the lower of the transaction value or a cap (Rs 10,000 on a card limit up to Rs 5 lakh, Rs 25,000 above), and beyond seven your bank's policy decides. A lost or stolen card may not count: HDFC, SBI Card and Canara's MITCs make you wholly liable for transactions before you report the loss.

HDFC and Canara also cite the RBI-based rules, but HDFC's list of third-party breaches does not name a lost card, so ask your bank. If the bank was at fault, you owe nothing, reported or not. If you were negligent, you bear the whole loss until you report, and the bank has to prove your liability. HDFC and SBI Card treat a failure to update your mobile number or email as negligence. Working days leave out the day of the alert and follow your home branch's schedule, or SBI Card's own.

Past seven working days, HDFC and SBI Card put the full loss on you. Axis also calls it full liability, but compensates up to Rs 5,000 or the transaction value once in the account's lifetime. Kotak pays a part up to 60 calendar days, then nothing.

An example. A Rs 40,000 fraud hits a card with a Rs 3 lakh limit, and neither you nor the bank is at fault. Report in three working days: Rs 0. Report in four to seven: the lower of Rs 40,000 and Rs 10,000, so Rs 10,000. The cap is per transaction.

Worked out for the Rs 40,000 example from HDFC's Customer Protection Policy v2.5 (28 November 2025), SBI Card's Grievance Redressal Policy (approved 31 March 2026), Axis's Customer Protection policy (September 2026) and Kotak's Customer Compensation Policy. The documents do not add GST to these sums. A transaction passed through a second factor can change these figures, as the OTP section explains. We did not read the equivalent policies at ICICI, RBL or Canara.

What changes for fraud from 1 January 2027?

For transactions on or after 1 January 2027, a third-party breach is zero liability only if you report within five calendar days of the transaction itself. After that, your bank's policy decides. The four to seven day caps go away.

The RBI's Third Amendment Directions of 24 June 2026 cover commercial banks other than payments, regional rural and local area banks, and a matching amendment covers small finance banks. SBI Card, an NBFC, still uses three and seven working days in its policy. RBI's NBFC card directions list liability under the commercial bank directions as an MITC item, but we found no notice on how the change applies to NBFCs, so ask SBI Card.

Credit card holders get a temporary credit within five calendar days of reporting. Banks must answer in 45 calendar days for domestic fraud and 60 for cross-border, and give reasons when they reject.

For small losses from your own negligence, an individual or sole proprietor with a gross loss up to Rs 50,000, who told both the bank and 1930 or the portal within five calendar days of the fraud, can get 85% of the net loss or Rs 25,000, whichever is less, once in a lifetime. It covers frauds up to one year from the start date, if the bank finds the loss genuine.

What if I shared an OTP or was tricked by a scam call?

Under today's rules that is usually treated as your negligence, so you bear the loss until you report it. Report at once anyway, because the bank bears anything after that, and it may waive your liability.

An OTP-approved transaction can go against you even if you say you shared nothing. HDFC and SBI Card treat a second factor known only to you as sufficient proof of your involvement. Kotak and Axis also put a delivered or two-factor transaction on you, Axis with the burden of proof on the bank.

From 1 January 2027 a fraudulent transaction includes one you approved under coercion or duress, but zero liability still applies only to bank negligence and third-party breach. Negligence adds downloading malicious apps and ignoring a clear warning from the bank.

Is it fraud or a merchant dispute, and how do I raise a chargeback?

It is fraud if you did not authorise the transaction, and the liability rules above cover only fraud. It is a merchant dispute if you did, and the goods never came, the refund never arrived or the amount was wrong. Raise that with the bank in writing, inside its dispute window, and the bank runs it under the card network's chargeback rules.

Visa's public rules (24 October 2026) give an issuer 120 calendar days for card-absent fraud, goods not received and refund not processed claims, but your bank's window can be far shorter. We read Visa's rules only.

ICICI's compensation policy (17 September 2026) puts chargeback investigations at 45 to 90 days, and SBI Card's policy at 45 to 90 working days or as per the card network's guidelines.

How long do I have to dispute a charge at my bank?

From 7 days at Canara Bank to 90 days at SBI Card, and the clock starts at different points. HDFC and RBL give 30 days from the statement. ICICI, Axis and Kotak give 60.

Miss the window and the documents treat the statement as accepted. For fraud, the three and seven working day clock runs first, so do not plan around this table.

From each bank's current MITC, read 31 October 2026. Check the number on your own card or statement too.

Do I have to pay the disputed amount while the bank investigates?

At some banks, yes, and the RBI does not say you can skip the bill. The RBI bars charges on a transaction disputed as fraud until the dispute is resolved. Axis requires at least the minimum amount due until any billing dispute is resolved, and Kotak says a merchant charge must be paid, disputed or not, without waiting for the outcome, so if you stop, late payment charges can apply.

A temporary credit can be taken back if the investigation goes against you, and HDFC, ICICI, Axis, RBL and Kotak also claim charges or interest. HDFC and ICICI say GST already levied is not reversed: Rs 180 on a Rs 1,000 fee at 18%.

The RBI says default information shall be released only after a dispute is settled, and RBL suspends bureau reporting on a fraud dispute. Axis still reports a missed minimum amount due as past due.

When can I go to the RBI Ombudsman, and how much can it award?

You must complain to your bank first and keep proof. You can then go to the RBI Ombudsman if the bank rejects you, you are unhappy with its reply, or it has not replied within 30 days or any longer time set by the RBI, NPCI or a card network. It has no limit on the disputed amount, and can award up to Rs 30 lakh for consequential loss plus up to Rs 3 lakh for your time, costs and harassment.

The Reserve Bank Integrated Ombudsman Scheme, 2026 has applied since 1 July 2026. File within 90 days of the bank's last communication or of its time limit ending, whichever is later. If the bank has not replied, check first: the longer time may be the RBI's 90 day limit or a network's chargeback time. The Scheme does not name it, and a complaint filed too early can be rejected.

File at cms.rbi.org.in, by email to crpc@rbi.org.in, or by post to the RBI's centre in Chandigarh. There is no fee. A complaint lodged through an advocate can be rejected unless the advocate is the aggrieved person.

The Scheme looks at deficiency in service by the bank or NBFC. A police complaint does not block you, but a case on the same grievance before a court, tribunal or arbitrator does. The Ombudsman can reject a complaint that needs elaborate evidence.

You have 30 days to accept an Award or it lapses, or 30 days to appeal. This guide is not legal advice. For a large loss, speak to a lawyer.

What if a card I never applied for arrives or is misused?

The RBI prohibits unsolicited cards. If one is activated without your consent and billed, the issuer must reverse the charges and pay you twice their value, and any loss from misuse of such a card is the issuer's. You can also go to the RBI Ombudsman.