Card Skimming and Cloning: What to Do and Get Money Back

"My debit card is in my wallet, but SMS alerts show ₹20,000 withdrawn from an ATM in another city." This is usually card skimming or cloning. Block the card in your banking app right now, report the transactions to your bank's 24x7 fraud channel and to 1930, and note the time you reported. Under RBI rules, reporting quickly usually means you bear zero loss.

This guide focuses on fraud where your physical card was copied. For frauds where you shared an OTP or UPI PIN, see our UPI scams guide.

How skimming and cloning work

RBI asked banks to fit anti-skimming measures on ATMs and move to chip-based processing years ago, and chip-and-PIN cards are standard. But many cards still carry a magnetic strip for compatibility, so a skimmed strip can still be misused at machines that accept it.

Warning signs at a machine: a bulky or loose card slot, a keypad that feels raised, a small hole above the keypad, someone "helping" you at the ATM, or a shop employee taking your card out of view.

Step-by-step: what to do

In the first hour

1. Block the card. Use the app's "block card" or "hotlist" option, or the bank's 24x7 helpline listed on its official website. A temporary lock is not enough; ask for a permanent block so the card number cannot be used again.
2. Report the fraud to the bank. Banks must provide 24x7 channels to report unauthorised transactions. Use the "report fraud" option, the helpline, or reply to the number in the transaction SMS. Get a complaint number with the date and time. That timestamp decides your liability.
3. Call 1930 or file at cybercrime.gov.in. This is the National Cyber Crime Reporting Portal. If the money went through transfers, early reporting helps freeze it. Note the acknowledgement number.
4. Turn off card uses you do not need. Switch off international, online and contactless use for any other card on the account.

On the first day

5. Write down where you last used the card. List ATMs, fuel stations and shops from the past few weeks. This helps the bank trace a common point of compromise.
6. Collect evidence. Screenshots of SMS alerts, your statement, the complaint number and proof that you were elsewhere at the time (a UPI payment, office attendance or a travel ticket).
7. File a written dispute. Many banks send a dispute form. State clearly that the card was in your possession and you did not share your PIN.
8. Police complaint. For larger amounts, banks may ask for an FIR or the cybercrime acknowledgement. File it promptly.

If unresolved

9. Ask for the shadow reversal. Under the current framework, the bank must credit the amount within 10 working days of your report while it investigates.
10. Escalate to the grievance or nodal officer if the bank delays or rejects without reasons.
11. File with the RBI Ombudsman at cms.rbi.org.in if there is no resolution within 30 days, or you disagree with the outcome. Under the Reserve Bank – Integrated Ombudsman Scheme, 2026, file within 90 days of the end of that 30-day period or the bank's last reply, whichever is later.

What you are owed under RBI rules

Skimming and cloning are normally treated as a third-party breach: the fault lies neither with you nor with the bank, but somewhere else in the system.

For transactions up to 31 December 2026

RBI's 2017 framework on limiting customer liability applies:

If the bank itself was negligent, for example an unsecured ATM, your liability is zero whenever you report. The bank must prove customer negligence if it wants to deny a refund.

For transactions from 1 January 2027

RBI's Commercial Banks (Responsible Business Conduct) Third Amendment Directions, 2026 replace that framework for commercial banks:

• Zero liability for a third-party breach reported within 5 calendar days; after that, the bank's policy applies.
• Unauthorised transactions after you report are borne by the bank.
• Credit card fraud complaints get a shadow reversal within 5 calendar days.
• Complaints must be resolved within 45 days for domestic fraud and 60 days for cross-border fraud.
• Reversals must be value-dated, so you lose no interest.

Small finance banks, regional rural banks and rural co-operative banks have similar amendment directions; check your bank's customer protection policy on its website.

Worked example

Meera's savings account debit card was skimmed at a fuel pump. On 10 November 2026, three ATM withdrawals of ₹20,000 each were made in another state, a total of ₹60,000.

If the same fraud happened on 10 January 2027 at a commercial bank, reporting within five calendar days would mean zero liability and a refund of the full ₹60,000.

The difference between reporting on day 0 and day 5 is ₹10,000 in this example. Turning on SMS alerts and reading them is the single best protection.

Ready-to-copy complaint message

Subject: Unauthorised transactions on debit card ending XXXX – suspected skimming / cloning

Dear Sir/Madam,

I report unauthorised transactions on my debit card ending XXXX, account [number]:

• [Date, time, amount, ATM / merchant location]
• [Date, time, amount, ATM / merchant location]

The physical card has been in my possession throughout, and I have not shared my PIN, OTP or card details with anyone. I was at [location] at the time. I first reported this on [date and time], reference [number], and the card is now blocked. Cybercrime complaint acknowledgement: [number].

As this is a third-party breach reported within the RBI time limit, please credit the amount to my account as a shadow reversal and confirm zero liability under RBI's customer liability rules. If you hold that I was negligent, please share the evidence in writing.

Regards, [Name], [registered mobile]

What not to do

• Do not wait to "check with family" first. Every day of delay can move you into a higher liability band.
• Do not just lock the card temporarily. Hotlist it and ask for a new card number.
• Do not accept a verbal rejection. Ask for the reasons and evidence in writing; the bank carries the burden of proof.
• Do not pay "recovery agents" who call offering to get your money back for a fee. That is a second scam.
• Do not let a shop staffer take your card out of sight. Ask for the terminal to be brought to you.
• Do not type your PIN uncovered. Shield the keypad with your hand every time.

Reduce the damage next time

• Insert or tap the chip; avoid swiping where possible.
• Keep international use and ATM withdrawal limits low, and raise them only when needed.
• Use ATMs inside bank branches or well-lit, guarded locations.
• Keep a low balance in the account linked to your everyday debit card and park savings in a separate account or FD; our FD calculator shows what that idle money earns.

If the cloned card was a credit card, see our guide on credit card fraud, and for the general liability rules across all channels, unauthorised transactions and zero liability.

Key takeaways

• Skimming copies your card's magnetic strip; a hidden camera or overlay captures the PIN.
• Block the card, report to the bank's 24x7 channel and 1930 immediately, and keep the timestamp.
• Until 31 December 2026, reporting a third-party breach within 3 working days means zero liability; capped liability applies for 4 to 7 days.
• From 1 January 2027, commercial banks give zero liability if reported within 5 calendar days and must resolve domestic fraud complaints within 45 days.
• The bank must prove negligence; insist on written reasons for any rejection and escalate to cms.rbi.org.in.