Credit Card Fraud: What to Do in the First Hour, and After

If you are reading this because of a transaction you don’t recognise, start with the steps below. You can read the rules later. Speed matters here, because it can affect both how much can be recovered and who bears the loss.

In the next few minutes

1. Block the card. Use your issuer’s official app or net banking, or call the number on the back of your card. Don’t use a number from a text, an email or a search ad.
2. Call 1930. This is the National Cyber Crime helpline, run under the Ministry of Home Affairs, for quick reporting of financial fraud. Have the transaction amount, date, time and reference number ready.
3. File at cybercrime.gov.in. Note your acknowledgement number. Do this even if you have called 1930.
4. Report to your bank separately. A report to 1930 or the portal doesn’t replace your dispute with the bank. Tell them each transaction you dispute, and ask for a complaint number.

Don’t delete anything. Keep the SMS alerts, emails, call logs and screenshots.

Today

• Write to the bank. Send an email through its official channel, listing each disputed transaction with date, amount and merchant, and say clearly that you didn’t authorise it.
• Ask two direct questions. When will a provisional credit (a “shadow reversal”) be applied? Which rules are being applied to this case?
• Change your passwords. Change those for your net banking, email and banking apps, and your UPI PIN if it may have been exposed.
• Check your other accounts. Look through your other cards and bank accounts, and your UPI safety settings.
• Remove unknown apps. If you installed a screen-sharing or remote-access app at someone’s request, uninstall it and tell your bank.
• Consider a police complaint if asked for one, or if the loss is large. Keep a copy.

Who bears the loss: the rules are changing

The answer depends on when the transaction took place. RBI issued amended rules on 24 June 2026, and we understand they apply to electronic transactions made on or after 1 January 2027. Please check the current position with your bank or on rbi.org.in, because details matter.

Burden of proof. Under both sets of rules, it is for the bank to prove you were liable, not for you to prove you weren’t. Banks may also waive liability at their discretion.

A worked example. Suppose ₹30,000 is misused on a card with a ₹2 lakh limit, in a third-party breach before January 2027, and you report it on the sixth working day after the bank’s alert. Your liability would be capped at ₹10,000. If you had reported it within three working days, it could have been zero.

A new compensation scheme. The June 2026 rules also set up a limited scheme for small-value fraud involving customer negligence. It covers losses up to ₹50,000, with compensation of 85% of the net loss or ₹25,000, whichever is lower. It can be claimed only once in a lifetime, and it runs for one year from the rules’ start date. You must report to the bank and to 1930 or the cybercrime portal within five calendar days. Check the exact conditions with your bank.

What to do about the bill

Keep paying the part of your bill that isn’t in dispute. Ask the bank in writing whether the disputed amount, plus any interest or charges on it, will stay on hold. Under the new rules, a provisional credit shouldn’t attract interest or charges. Then check each statement until the dispute closes.

Keep an eye on your credit report in the months that follow. If a disputed amount or late mark shows up in error, follow our guide to fixing errors in your credit report. Our score basics guide explains how bureau disputes fit in.

If the bank doesn’t resolve it

1. Escalate within the bank. Use its nodal officer or grievance process, which should be listed on its website.
2. Go to the RBI Ombudsman. Under the Reserve Bank - Integrated Ombudsman Scheme, 2026, you can complain if there’s no reply within 30 days, or if you are unhappy with the reply. You must do this within 90 days of that period ending or of the bank’s last reply, whichever is later.
3. How to file. Use cms.rbi.org.in or email [email protected]. You can also write to the Centralised Receipt and Processing Centre, Central Vista, Sector 17, Chandigarh 160017.
4. Need guidance? RBI’s contact centre is on toll-free 14448, though you can’t file a complaint through it. The scheme itself doesn’t charge a fee.

Details are as of November 2026, so check the RBI portal for updates.

Spotting the next attempt

Fraud victims are often targeted again, sometimes by callers offering to “recover” the money.

• No genuine bank, police officer or government agency needs your OTP, PIN, CVV or passwords.
• Don’t install any app at a caller’s request.
• Ignore messages about a lapsed reward, a limit increase or a KYC update that come with a link.
• Be wary of anyone who asks for a fee to get your money back.

Prevention helps too. Switch on SMS alerts for all transactions, turn off any card uses you don’t need, such as international or contactless payments, and check your statement every month. RBI’s rules also ask banks to have customers register for alerts, so keep your mobile number updated.

Bottom line

Block the card, call 1930, file at cybercrime.gov.in and put your dispute to the bank in writing, all as quickly as you can. Keep evidence, watch your statements, and use the RBI Ombudsman route if the bank doesn’t help. We can’t promise recovery, but prompt reporting usually gives you the strongest position.