If your debit or credit card is lost, or you see a transaction you did not make, block the card and report it to your bank straight away. Under the RBI’s 2017 rules on limiting customer liability, which still apply to transactions this year, you bear no loss for a fraud caused by a third party if you report it within three working days of the bank’s alert. The bank must then credit the disputed amount to your account within 10 working days.
Report later and your loss can be capped but not zero; report after seven working days and the bank’s own policy decides. From 1 January 2027 a new RBI framework takes over with a five-day window and compensation for small frauds, so it pays to know both sets of rules.
Before you start
| Document | Who needs it | Notes |
|---|---|---|
| Card number or last four digits | Everyone | Found in the app or on statements |
| Registered mobile number | Everyone | Banks must send SMS alerts and let you reply to report fraud |
| Details of each disputed transaction | Everyone disputing | Date, amount, merchant, from the SMS or statement |
| Complaint or acknowledgement number | Everyone | Banks must issue one immediately |
| Cyber crime complaint number | Victims of online fraud | From 1930 or cybercrime.gov.in |
Source: RBI circular of 6 July 2017.
The steps
- Block the card immediately. Use your bank’s app or net banking to block or hotlist the card, or reply to the transaction SMS, or call the helpline printed on your statement. The RBI requires banks to offer reporting channels 24×7, including SMS, phone and the website.
- Report each unauthorised transaction. Blocking stops future misuse; it does not dispute past charges. Tell the bank which transactions you did not make, and note the time you reported.
- Get the complaint number. Banks must acknowledge your report at once with a complaint number and record the date and time. This is your proof that you reported in time.
- Report online fraud to the police. For phishing, OTP or online card fraud, call 1930 or file on cybercrime.gov.in. This can help freeze money before it moves.
- Follow up in writing. Email or write to the bank listing every disputed transaction. If you never shared your PIN or OTP, say so: the bank carries the burden of proving that you were negligent.
- Check for the shadow credit. Within 10 working days of your report, the bank must credit the amount, value-dated to the transaction, without waiting for an insurance claim.
- Get a replacement card. Order it through the app or branch, and where your bank allows, switch on only the uses you need, such as domestic or contactless.
How much you can lose
| When you report a third-party fraud | Your maximum liability |
|---|---|
| Within 3 working days | Nil |
| 4 to 7 working days, basic savings (BSBD) account | ₹5,000 or the transaction value, whichever is lower |
| 4 to 7 working days, most savings accounts and credit cards up to ₹5 lakh limit | ₹10,000 or the transaction value |
| 4 to 7 working days, other current accounts and cards above ₹5 lakh limit | ₹25,000 or the transaction value |
| After 7 working days | As per the bank’s board-approved policy |
| Bank’s own negligence or fault | Nil, whenever you report |
Source: RBI circular RBI/2017-18/15, 6 July 2017. Applies to scheduled commercial banks, small finance banks and payments banks.
If you shared your PIN or OTP, the loss up to the moment you report is yours, but anything after the report falls on the bank.
For transactions from this date, new RBI directions give zero liability if you report within five calendar days, and pay 85% of losses up to ₹50,000, capped at ₹25,000, once in a lifetime, as summarised by Fox Mandal after the RBI’s 24 June 2026 release.
The 2027 rules also cut the time banks get to resolve complaints to 45 days for domestic frauds and 60 days for cross-border ones.
Common mistakes
It’s often said that the customer has to prove they were not careless before the bank will refund.
In fact the RBI circular puts the burden of proving customer liability on the bank.
If it goes wrong
If the bank does not credit you in 10 working days, or rejects the dispute, escalate to its grievance or nodal officer in writing. If there is no fair reply within 30 days, file with the RBI Ombudsman at cms.rbi.org.in under the Integrated Ombudsman Scheme, 2026; you generally have 90 days after the bank’s reply period. For large losses, consider legal advice.
Quick answers
How fast must I report a fraudulent card transaction?
Within three working days of the bank’s alert for zero liability under the current rules; from 2027, five calendar days.
When will the bank return my money?
It must credit the disputed amount within 10 working days of your report, and resolve the complaint within 90 days.
Does blocking the card dispute the charges?
No. Blocking stops new misuse. Report each unauthorised transaction separately and get a complaint number.
Information checked against official sources on 19 October 2026. Fees, dates and rules can change; confirm on the linked official pages before acting.
Sources
- Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 6 July 2017 (RBI)
- RBI issues amendment directions on Review of Framework of Limiting Customer Liability in Digital Transactions, 24 June 2026 (RBI)
- RBI revises customer protection framework for fraudulent transactions (Fox Mandal)
- RBI issues Reserve Bank – Integrated Ombudsman Scheme, 2026 (RBI)
