Credit Card Fraud Liability Guidelines (RBI) in India

Updated: July 15, 2026Published: July 15, 2026

Quick Answer

Under RBI guidelines, customers have zero liability for unauthorized credit card transactions if the fraud is the bank's fault or if the customer reports it within three working days. Delays in reporting can result in limited or full liability for the customer.

Table of Contents

Key Takeaways

  • Zero liability applies if the fraud is reported within 3 working days of receiving the SMS/email alert.
  • Reporting between 4 to 7 working days results in limited liability capped by the RBI.
  • Customers bear full liability if they negligently share their OTP, PIN, or CVV with fraudsters.
  • Banks must credit the disputed amount back to the customer's account within 10 working days of notification.

Introduction

With the rapid digitalization of payments, credit card fraud—ranging from phishing scams and card cloning to unauthorized international transactions—has become a widespread threat. A common fear among cardholders is that they will be forced to pay off massive debts generated by a hacker. To protect consumers and foster trust in digital banking, the Reserve Bank of India (RBI) has laid down robust guidelines that dictate exactly who bears the financial loss in the event of an unauthorized electronic banking transaction. Understanding these timelines is critical to shielding your finances.

The governing framework is the RBI Master Circular on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions.

  • Zero Liability of the Customer: A customer bears no financial loss if:
    1. The unauthorized transaction occurs due to contributory fraud, negligence, or a security deficiency on the part of the bank (irrespective of when the customer reports it).
    2. The fraud occurs due to a third-party breach (neither the bank nor the customer is at fault), and the customer notifies the bank within 3 working days of receiving the transaction communication.
  • Limited Liability of the Customer: If a third-party fraud is reported after 3 working days but within 7 working days, the customer's liability is capped. The maximum liability ranges from ₹5,000 to ₹25,000, depending on the credit limit of the card and the type of account.
  • Full Liability (Customer Negligence): If the loss is due to the customer's negligence—such as sharing their One-Time Password (OTP), PIN, or CVV with a scammer—the customer bears the entire financial loss until the moment they report the unauthorized transaction to the bank. Any fraud occurring after the report is the bank's responsibility.

Step-by-Step Process for Reporting

  1. Block the Card Immediately: The moment you notice an unauthorized charge, call the bank's 24/7 toll-free emergency number or use the mobile banking app to block the credit card.
  2. Log a Formal Dispute: Register a formal fraud dispute with the bank and secure a complaint tracking number.
  3. File a Cyber Crime Complaint: Call the National Cyber Crime Reporting Portal at 1930 or file a complaint online at cybercrime.gov.in.
  4. Track the Reversal: Under RBI rules, once notified, the bank must credit (shadow reverse) the amount involved in the unauthorized transaction to the customer's account within 10 working days.

Practical Tips

  • Preserve Alert Timestamps: To prove you reported the fraud within the golden 3-day window, preserve the exact timestamp of the SMS or email alert sent by the bank, alongside the call logs or email timestamp of your immediate complaint.
  • Maintain Cyber Complaint Records: Keep a downloaded PDF copy of the police/cyber cell FIR or complaint acknowledgment. Banks require this to process high-value fraud chargebacks.
  • Do Not Delete Fraudulent Messages: If you were tricked by a phishing SMS or email link, do not delete it. Preserve it as evidence of a third-party breach to argue against customer negligence.

When Should You Consult a Lawyer?

While most credit card fraud disputes are resolved through the bank's internal mechanisms or the RBI Ombudsman, you should consult a banking lawyer when:

  • The Bank Unfairly Blames You: If the bank refuses to reverse the charges after 90 days, falsely claiming you shared an OTP when the fraud was actually a sophisticated backend cloning or bin-attack breach.
  • Credit Score Damage: If the bank illegally reports the disputed fraudulent amount as a "default" to CIBIL or other credit bureaus while the investigation is still pending, damaging your financial reputation.
  • High-Value Escalations: If the fraud involves a massive sum and the Banking Ombudsman rejects your claim, a lawyer can help file a formal case in the Consumer Disputes Redressal Commission for deficiency of service.

Conclusion

The RBI guidelines heavily favor the vigilant consumer. By mandating zero liability for swift reporting and enforcing a 10-day reversal rule, the regulatory framework ensures that innocent cardholders do not pay for systemic security breaches. The ultimate shield against credit card fraud liability is speed—blocking the card and notifying the bank within three working days is the most critical action a consumer can take to secure their money.

Frequently Asked Questions

Q: What happens if I report the credit card fraud after 7 working days?

A: If you report a third-party unauthorized transaction after 7 working days, your liability will be determined entirely by the individual bank's board-approved policy. In many cases, banks may hold you fully liable for the loss due to the extreme delay.

Q: Do I have to pay the credit card bill for the fraudulent amount while it is being investigated?

A: No. Under RBI guidelines, the bank must provide a shadow credit for the disputed amount within 10 working days. You are not required to pay the disputed amount or any late fees/interest levied on it while the bank investigates the fraud (which must be resolved within 90 days).

Q: Is the bank responsible if someone steals my physical credit card and taps it for Wi-Fi payments?

A: If the card is stolen and used for contactless (tap-and-pay) transactions without a PIN, the zero liability rule applies provided you report the loss of the card within 3 working days. The bank is liable for transactions made before the card was blocked if reported promptly.

Need personalized legal help?

Find advocates on JurisOS and send an enquiry.

Find Banking & Finance Law Lawyers