Credit Card Fraud: What to Do in the First Hour and After

"I just got an SMS for a ₹38,000 transaction I never made." If this is happening right now, block the card in your bank's app or through the 24x7 number on the back of the card, then report the transaction to the issuer and to 1930. Do it before anything else: how quickly you report decides how much of the loss you carry under RBI rules.

This guide is the emergency plan: what to do in the first hour, the first day and the weeks after, with the RBI liability rules as of October 2026 and the new rules that start on 1 January 2027. If the problem is a merchant that did not deliver rather than fraud, our guide on credit card chargeback vs refund covers that dispute route instead.

Step-by-step: what to do

In the first hour

1. Block the card. Use the app's "block card" or "report lost/stolen" option, net banking, or the 24x7 helpline. RBI's card directions require issuers to block a lost card immediately when informed and to provide 24x7 reporting channels. A temporary lock is not enough if fraud has already happened; request a permanent block.
2. Report each unauthorised transaction to the issuer. Do this in the same call or app session. Ask for a complaint reference number and note the date and time. That timestamp is what your liability is measured from.
3. Call 1930 or file at cybercrime.gov.in. The National Cyber Crime Reporting Portal alerts banks and merchants in the chain. Save the acknowledgement number.
4. Check other cards and accounts linked to the same email or phone. Change passwords for net banking and email.

On the first day

5. Submit the issuer's dispute form (often online). List each disputed transaction with date, amount and merchant name, and state that you did not authorise it and still have the card (if true).
6. Collect evidence: SMS alerts, email alerts, screenshots of the app, any phishing message or call log, and proof of where you were at the time.
7. File a police complaint or FIR if the issuer asks for it, which is common for larger amounts.
8. Turn off unused channels on the replacement card. Under RBI's 2020 card security rules, you can switch online, international and contactless use on or off and set limits 24x7.

In the following weeks

9. Watch your statement. The disputed amount should be marked as disputed. RBI's card directions say no charges can be levied on transactions disputed as fraud until the dispute is resolved.
10. Pay your undisputed dues on time. Late fees on the undisputed part are legitimate.
11. Escalate if needed to the grievance redressal officer and then the RBI Ombudsman (see below).

Your liability: the rules as of October 2026

For transactions up to 31 December 2026

RBI's 2017 framework on limiting customer liability in unauthorised electronic banking transactions applies to credit cards issued by banks.

The working days are counted from the day you receive the bank's communication about the transaction, excluding that day. Banks should give a provisional ("shadow") credit within 10 working days of your report in eligible cases and resolve the complaint within 90 days.

For transactions from 1 January 2027

RBI's Commercial Banks (Responsible Business Conduct) Third Amendment Directions, 2026, issued on 24 June 2026, replace those rules for electronic banking transactions at commercial banks on or after 1 January 2027:

• Zero liability for third-party breaches reported within five calendar days, and always for bank negligence.
• Credit cards: a shadow reversal of the disputed amount within five calendar days of your report.
• Liability decided within 45 calendar days for domestic fraud and 60 for cross-border fraud.
• Burden of proof on the bank to show customer liability.
• One-time compensation for small frauds caused by customer negligence: for a gross loss up to ₹50,000, the lesser of 85% of the net loss or ₹25,000, once in a lifetime, if you report to 1930 or cybercrime.gov.in and to the bank within five calendar days.
• Alerts: instant SMS alerts for electronic transactions above ₹500.

Worked example

Rohit's card has a ₹3 lakh limit. On a Monday he receives alerts for two online transactions totalling ₹60,000 that he did not make. His card details were leaked from a merchant (a third-party breach).

Scenario A, reported Wednesday (2 working days): liability zero. The bank should credit ₹60,000 provisionally within 10 working days.

Scenario B, reported the following Monday (5 working days): liability is the lower of ₹60,000 and ₹10,000, so ₹10,000. The bank must reverse ₹50,000.

Scenario C, the same fraud in February 2027, reported on day 4: within five calendar days, so zero liability, with a shadow reversal within five calendar days of reporting.

Scenario D, February 2027, Rohit read out an OTP to a fake caller and lost ₹20,000. That is customer negligence. If he reported within five calendar days and nothing was recovered, compensation is the lower of 85% × ₹20,000 = ₹17,000 and ₹25,000, so ₹17,000. His loss is ₹3,000.

If the disputed amount is wrongly treated as unpaid and interest is charged, the cost adds up quickly; at 3.5% a month, ₹60,000 attracts ₹2,100 of interest in a month. Check what a disputed amount would cost you with our credit card interest calculator, and insist that the issuer marks it disputed.

Where to complain if the issuer does not help

1. Card issuer's customer care, with your fraud report number.
2. Grievance redressal officer, then nodal officer. Details are on the issuer's website. The card directions say that if you get no satisfactory response within 30 days, you can approach the RBI Ombudsman.
3. RBI Ombudsman at cms.rbi.org.in or helpline 14448. Under the RB-IOS, 2026, file within 90 days of the issuer's last reply or response deadline, whichever is later. The Ombudsman can award up to ₹30 lakh for financial loss and up to ₹3 lakh for loss of time and harassment.
4. Cybercrime follow-up on cybercrime.gov.in using your acknowledgement number.

For a broader recovery playbook covering bank accounts and UPI too, see cyber fraud money recovery, and for account debits, see unauthorised transaction and zero liability.

Ready-to-copy complaint message

Subject: Unauthorised transactions on credit card ending [XXXX] - request for reversal

Dear Sir/Madam,

I report the following transactions on my credit card ending [XXXX],
which I did not make or authorise:

1. [date, time] - Rs [amount] - [merchant name]
2. [date, time] - Rs [amount] - [merchant name]

I received the alert on [date, time] and reported it to you on
[date, time], complaint no. [number]. I blocked the card on [date].
I have also reported it on cybercrime.gov.in / 1930, ack. no. [number].
[The card is in my possession. / The card was lost on ___.]

I request you to:
1. Mark these transactions as disputed and levy no charges on them
   until resolution, as per the RBI card directions.
2. Provide a provisional/shadow credit and confirm my liability under
   RBI's customer liability framework.
3. Issue a replacement card.

Name: [your name]   Registered mobile: [number]

What not to do

• Do not delay reporting to "check with family first". Report, and withdraw the complaint later if a family member made the purchase.
• Do not just lock the card in the app and stop there. You must also report the transactions as unauthorised.
• Do not share OTPs, CVV or the new card's details with anyone who calls about the fraud, even if they claim to be from the bank or the police.
• Do not refuse to pay the whole bill. Pay the undisputed amount by the due date.
• Do not throw away alerts or messages. Screenshots are your evidence.
• Do not accept "you are liable" without reasons. Ask the bank to explain in writing how it established your liability.

Key takeaways

• Block the card and report each unauthorised transaction to the issuer immediately, then call 1930 or file on cybercrime.gov.in.
• Up to 31 December 2026: zero liability if a third-party breach is reported within three working days; capped at ₹10,000 or ₹25,000 (by card limit) for four to seven working days.
• From 1 January 2027: zero liability within five calendar days, credit card shadow reversal within five calendar days, and one-time compensation of up to ₹25,000 for small negligence frauds.
• No charges can be levied on transactions disputed as fraud until resolved; keep paying undisputed dues.
• Escalate to the grievance officer, then the RBI Ombudsman within 90 days.