The SMS says your card has just been used at a website you've never heard of, or for a cash withdrawal in a city you've never been to. The card is in your wallet. You didn't do this.
First, it isn't your fault that someone else used your card, and you have real protections under RBI's rules. Most of them depend on one thing: how quickly you tell your bank. So here's what to do, in order.
In the first few minutes
- Block the card. The fastest way is usually your bank's app or net banking, where you can block or "hotlist" a card in seconds. Or call the number on the back of the card or on the bank's own website. If you're not sure the payment is fraud, block it anyway; a replacement card is a small price.
- Report every transaction you don't recognise to your bank. Give the date, time, amount and merchant name from the SMS, say whether you still have the card, and say whether you shared your card details or an OTP with anyone. Be honest; it helps your case. RBI's rules require banks to acknowledge a fraud report straight away with a complaint number. Write it down with the date and time.
- Call 1930 as well, especially if the money was spent online or moved to another account or wallet. The national cyber crime helpline can ask the banks involved to hold money that hasn't moved on yet. Our guide to calling 1930 lists what to keep ready.
The same day
- Put your complaint in writing. Use the bank's complaint form or app, or e-mail from the address registered with the bank. List each transaction, say you didn't authorise it, ask the bank to raise a dispute (often called a chargeback) and to credit the amount while it investigates. Our guide to reporting fraud to your bank covers what to say.
- File a complaint on cybercrime.gov.in and keep the complaint number. Some banks ask for it when they review a dispute.
- Switch off what you don't use. Since RBI's 2020 card security rules, banks must let you switch online, international and contactless use on or off, and set limits, at any hour, in the app, net banking, at ATMs or by phone banking. Turn off international and online use on your other cards until you're sure what happened.
- Look for recurring payments you didn't set up, such as an e-mandate on the card, and ask the bank to cancel them.
- Think about how it happened. Did you enter card details on an unfamiliar site, share an OTP or let someone take your card out of sight? If you shared an OTP, read what to do after sharing an OTP and change your net banking password.
- Save the evidence: the transaction SMS and e-mails, your complaint numbers, and a screenshot of the statement entries.
In the following days
- Check your next statement. On a credit card, ask the bank to keep the disputed amount out of what you owe while it investigates. Pay the rest of the bill on time so you aren't charged late fees.
- Follow up in writing, quoting your complaint number, until the bank gives you a final answer.
- Escalate if you need to. If the bank doesn't reply within 30 days, or you're unhappy with its reply, complain to the RBI Ombudsman at cms.rbi.org.in or on 14448. Under the Integrated Ombudsman Scheme, 2026 (in force from 1 July 2026), you have 90 days to do so, and it's free.
Your rights under RBI's rules
RBI's current rules, first set in July 2017, apply to card transactions made up to 31 December 2026:
- If the bank was at fault, you have zero liability, whether or not you reported it.
- If neither you nor the bank was at fault (for example, card details stolen somewhere else), you have zero liability if you report within three working days of getting the bank's alert. Report in four to seven working days and your loss is capped: ₹10,000 for most savings accounts and for credit cards with a limit up to ₹5 lakh, and ₹25,000 for credit cards with a higher limit. After seven working days, the bank's own board-approved policy decides.
- If you shared card details or an OTP, you carry the loss until you report it. Anything taken after you report is the bank's responsibility.
- The bank should credit the amount to you within 10 working days of your report while it investigates, and resolve the complaint within 90 days. It is up to the bank to prove you were liable, not up to you to prove you weren't.
New RBI rules apply to transactions from 1 January 2027. Zero liability in "neither side's fault" cases then needs a report within five calendar days. Banks must resolve complaints within 45 calendar days (60 for cross-border fraud), and must temporarily reverse a disputed credit card charge within five calendar days of your report. There's also a once-in-a-lifetime compensation for small losses where the customer was negligent: 85% of the net loss, up to ₹25,000, on losses of up to ₹50,000, if you report to 1930 or the national cybercrime portal and to your bank within five calendar days. That covers frauds in the rules' first year.
What to expect next
Your bank will usually block the card, send a new one and ask you to sign a dispute form. Disputes on card payments go through the card network's process, which can take weeks. Sometimes the answer is simpler than fraud: a shop's name on a statement can differ from the name you know, or a family member or a forgotten recurring payment made the charge. Ask the bank for the merchant details before you decide, but don't delay blocking the card while you find out.
No one can promise the money back. Reporting fast and in writing gives you the strongest position.
What not to do
- Don't wait for your statement. The clock starts from the bank's alert, not the bill.
- Don't share your card number, CVV or an OTP with anyone who calls about the fraud. Scammers often follow up a fraud with a fake "bank" call. Call the bank yourself.
- Don't pay anyone who offers to get the money back for a fee.
Where BharatCaller fits
BharatCaller, a free Indian caller ID app, can't reverse a card charge, but before you answer it warns you about numbers other people have reported as spam, which helps with those fake follow-up calls.
Quick answers
How was my card used when it's still in my wallet?
Online payments use the card's details, not the card itself. Details can be stolen through fake websites, data leaks or card skimmers, and some payments, especially on foreign websites, don't ask for an OTP.
How quickly must I report it?
At once. Under the current rules, within three working days of the alert keeps you fully protected when neither you nor the bank was at fault. For transactions from 1 January 2027, the window is five calendar days.
What if the bank rejects my claim?
Ask for the reasons in writing, then complain to the RBI Ombudsman at cms.rbi.org.in.
Should I file a police complaint?
Report it on 1930 or cybercrime.gov.in. If your card was physically stolen, also report the theft to the police.
