Skip to content
Explore Guides

Blog

Credit Card Fraud Recovery in India: A Step-by-Step Workflow Using the RBI's 2024 Framework

Rahul Dabhi's profile photo Rahul Dabhi
9 min read
Reviewed by Renish Mithani Last reviewed 14 October 2026 Data verified 14 October 2026
Fraud Dispute RBI Card Replacement

The answer in one paragraph

Indian credit-card fraud recovery depends on speed. Block the card. File a written dispute within three working days. The RBI’s 2024 framework entitles you to a full reversal. You pay no finance charge. You pay no GST on the dispute.

Report between days 4 and 30. Your odds drop fast. Report after 30 days. The burden of proof shifts toward you. Report after 90 days. Recovery becomes rare.

This article walks you through the exact steps. It covers the documents the bank needs. It covers the interest math during the dispute window. It covers the escalation path when the bank says no.

What changed in 2024

The RBI changed the rules in 2024. Banks must now resolve disputes in 90 days or pay you. Banks must prove a transaction was yours. You do not have to prove it was not. E-mandate disputes can be reversed in 24 hours. Banks cannot charge interest on disputed amounts during the dispute window. Banks must publish a toll-free fraud hotline.

These changes matter. Before 2024, cardholders gave up at the bank-call stage. The 2024 rules stop banks from delaying or shifting blame.

Step 1 — Within 60 minutes of noticing the transaction

The first hour is the highest-leverage hour in the entire recovery process. Every action you take in this window strengthens your dispute record.

  1. Lock the card from the issuing bank’s app. This is the “hotlist” or card-block action. Most Indian bank apps (HDFC Mobile, iMobile Pay, YONO, Axis Mobile, Amazon Pay ICICI app) have a one-tap “Block card permanently” or “Report fraud & block” flow. Doing this generates a unique hotlist reference ID — write it down or screenshot it.

  2. Capture the disputed transaction evidence. Screenshot the SMS/email alert, the bank app notification, and (if you saw it) the merchant’s name and MCC. Don’t delete the alert; the bank’s dispute team will pull it from the records, but your screenshot is independent proof of when you first noticed the transaction.

  3. Call the 24×7 fraud hotline. Every major Indian issuer publishes this number on the back of the card and on the home page of their app. The IVR will ask for the last four digits of your card and the disputed amount; you will receive a verbal complaint number. Note this number with date and time.

  4. File the dispute in writing inside the bank app. The verbal complaint is logged but not sufficient. The RBI’s 2024 framework requires a written dispute (in-app form, email, or signed letter) before the 90-day clock starts. In-app dispute forms accept the same evidence — disputed amount, merchant name, transaction reference, reason code (fraud / billing error / not received / duplicate) — and generate a written dispute reference number. This is the number that goes into the bank’s escalation system.

  5. Set three reminders on your phone: day 10 (ack check), day 30 (interim status), day 90 (final resolution). Most banks provide a status tracker in-app; if yours doesn’t, the reminders keep you proactive.

If the disputed amount is large (above ₹50,000), preserve a written record of every step — screenshots, complaint numbers, call recordings (your number was the inbound caller; the bank may record outgoing too). Banks dispute claims where the only proof is “I called customer care.”

Step 2 — Inside the first 30 days: the bank’s investigation

Once the written dispute is filed, the bank has 3 days to acknowledge in writing, and 90 days total to resolve. In practice, clear-cut fraud cases close in 7–14 days. Complex merchant-dispute cases take the full 90 days.

During this window, your job is to cooperate. Give only what the bank asks for. Do not guess dates. If you do not remember exactly when you last used the card, say so. Banks have their own data. Your truthful recollection is fine.

The bank’s investigation asks for three things. First, a statement saying no family member or friend had physical access to the card. Second, a list of any other cards linked to the same mobile or email. Third, a signed declaration. You did not authorise the transaction. You did not share the OTP. You did not disclose the CVV or PIN.

Give only what the bank asks for. Do not guess dates. If you do not remember exactly when you last used the card in person, say so. Banks have internal data. Your truthful recollection is fine.

Three things you should NOT do during investigation:

  • Do not repay the disputed amount and then dispute. Once you pay the bill, even partially, the dispute becomes a refund request and loses protection under the 90-day rule. Only pay the undisputed portion.
  • Do not delete SMS alerts or app notifications. Banks can pull transaction records, but judges and ombudsmen weight contemporaneous evidence more than reconstructed records.
  • Do not engage with the merchant directly. A merchant offering a refund outside the bank is a common scam follow-up. Route everything through the bank.

Step 3 — Recovery math: what you actually get back

Recovery is not 100% even with full papers. The chance depends on when you reported. It depends on how you reported. It depends on what kind of XPAYMENT is in XISSUE.

Fraud type Reported within 3 days, in writing Reported 4–10 days Reported 11–30 days Reported 31–90 days Reported beyond 90 days
Card-not-present fraud, OTP-protected 3-D Secure ~100% ~80–90% ~60–70% ~40–50% Under 20%
Card-not-present fraud, no OTP (small-value tokenised merchants) ~85% ~70% ~50% ~30% Under 10%
Lost or stolen physical card ~100% ~85% ~65% ~45% Under 20%
Skimmer / ATM compromise ~95% ~85% ~70% ~50% Under 25%
Phishing / OTP share (you authorised the OTP yourself) Disputed — usually rejected unless social-engineering proof is strong
E-mandate / subscription trap (₹15,000 cap) ~100% (within 24 hours of debit) Drops sharply after 24 hours
Merchant dispute (goods not received / not as described) ~70–80% ~50–60% ~40% ~25% Under 10%

The exact XAMOUNTS vary by XBANK and by XISSUE category. The pattern is consistent. Fast plus written equals high recovery. Slow plus verbal equals low recovery. This matches public RBI Banking Ombudsman annual reports.

The link between recovery and interest also matters. Suppose a ₹40,000 XWRONG XPAYMENT lands on your XBILLING date. You dispute it on day 1. During the 90-day window:

  • The disputed ₹40,000 does not build up XFEE.
  • The remaining undisputed XAMOUNT on the card (say ₹15,000) does build up the standard monthly XRATE (3.5%–4.0% on most Indian cards, ~42%–48% per annum before XTAX).
  • If the XBANK rules in your favour on day 14, the ₹40,000 is reversed. Any interest charged on that disputed XAMOUNT in error must be reversed too. The XBANK cannot keep it.

If you carry the ₹40,000 disputed XAMOUNT as unpaid while the XISSUE runs, your minimum XAMOUNT due does not include the disputed portion. Your XCREDITSCORE XSCORE is not hit as long as the undisputed XAMOUNT is paid by the due date. (Credit-card billing XISSUEs and your XCREDITSCORE impact covers this in detail.)

Step 4 — When the bank says no: the escalation ladder

If the bank’s 90-day decision is not in your favour, you escalate. The RBI 2024 framework provides a three-tier ladder.

Tier 1: Bank’s Nodal Officer. Every Indian bank must publish a Nodal Officer’s email and postal address. File a written complaint within 15 days of the bank’s decision. The Nodal Officer must respond within 30 days. This tier has the highest hit rate. The bank is internally accountable.

Tier 2: Internal Ombudsman. Banks with more than ₹5,000 crore in card-outstanding must have an Internal Ombudsman. It reviews rejected disputes independently. The decision is binding on the bank. Many bank apps now let you “escalate to internal ombudsman” directly.

Tier 3: RBI Banking Ombudsman (the CMS portal). If Tier 1 and Tier 2 fail, file at the Reserve Bank’s Complaint Management System portal. The ombudsman can award compensation up to ₹20 lakh. It can issue a “bank shall pay” award. It can direct the bank to remove the disputed entry from your statement.

The CMS portal is digital and paperless. Most decisions come in 60–90 days from filing.

A tactical note: when you file on CMS, attach every piece of evidence you’ve gathered — the original dispute reference, hotlist timestamp, bank responses, call recordings if available, written declarations. The ombudsman makes decisions on documents, not on sympathy.

What the 2024 framework does NOT cover (the honest list)

No rule covers every situation. The RBI’s dispute framework does not apply to:

  • Transactions where you shared your OTP, CVV, or PIN voluntarily. The bank considers you to have authorised the transaction.
  • Transactions on a card you lent to a family member or friend. The cardholder bears liability regardless of the dispute.
  • Cash advances from an ATM you personally authorised. Interest accrues from day 1.
  • Goods and services received but disputed on subjective grounds. The bank’s dispute process handles facts, not opinions.
  • Transactions where the merchant produces proof of delivery, signature, and OTP confirmation. The 3-D Secure trail is often treated as conclusive.

The framework is consumer-strong. But it is not consumer-absolute. Knowing the boundary matters.

Prevention pays: 7 habits that reduce your fraud-loss exposure

The cheapest fraud-loss exposure is a habit change, not a dispute. Seven habits that materially reduce the probability of being a victim:

  1. Approve tokenisation only at merchants you actively use. Tokens are safer than saved cards, but each token is a potential surface. Limit the count.

  2. Set transaction alerts for every transaction, not just above ₹500. Most Indian issuers let you set alerts at ₹1 thresholds. The 60-second alert lets you dispute inside the 3-day window.

  3. Use a virtual card for online one-off purchases. Indian issuers (HDFC, ICICI, SBI, Axis, Kotak) now ship free single-use virtual cards. They expire after one transaction.

  4. Lock international transactions by default. Turn them on only when you are travelling. International transactions dominate skimming-loss vector lists.

  5. Do not store the card on shopping apps. Saved cards on Amazon, Flipkart, Myntra, and Meesho survive merchant-side breaches. Type the card in fresh for high-value buys.

  6. Treat your phone’s SMS inbox as a security ledger. Do not delete transaction alerts.

  7. Hotlist test once a year with a tiny ₹1 transaction. The hotlist process is real. If you have never blocked your card, find out how the flow works in your bank’s app before an emergency.

These seven habits cost nothing; the dispute avoided is worth more than the dispute won.

Frequently asked questions

How long does a credit-card dispute take in India under the RBI’s 2024 framework? The bank must acknowledge the dispute within 3 days and resolve it within 90 days of acknowledgement. In practice, clear-cut fraud disputes close in 7–14 days; merchant disputes typically take 30–60 days; complex multi-party disputes (e.g. cross-border CNP fraud) can run the full 90 days. If the bank does not respond within 90 days, the dispute is deemed resolved in the cardholder’s favour.

What if I shared my OTP or CVV with someone — am I still covered? Generally no. The RBI’s zero-liability rule protects cardholders against unauthorised transactions. If you voluntarily shared the OTP, CVV, or PIN — even under social engineering or impersonation — the bank considers the transaction authorised by you and will reject the dispute. The exception is rare and requires proof that the bank’s authentication flow itself was defective.

Can the bank charge interest on a disputed credit-card amount? No, not on the disputed portion. During the 90-day resolution window, the bank cannot levy finance charge, late fee, or GST on the disputed amount. Only the undisputed balance accrues interest at the card’s standard rate. If the bank rules in your favour, any finance charge accidentally applied to the disputed amount must be reversed with GST adjustment.

Do I lose zero-liability protection if I delay reporting? Not “lose” it formally, but the practical recovery odds drop sharply. Zero-liability protection is strongest when the dispute is filed in writing within 3 days and accompanied by a same-day hotlist. Beyond 10 days, the bank’s investigation may conclude that you contributed to the loss (e.g. by leaving the card unattended, by not hotlisting fast), and the burden of proof effectively shifts back to you.

Does a credit-card fraud dispute affect my CIBIL score? The dispute itself does not. As long as you continue paying the undisputed balance by the due date, your credit score is not affected. If the dispute takes longer than two billing cycles, request a written acknowledgement from the bank that the disputed amount is under review; this protects you if a bureau inadvertently flags your account during automated scoring.

What’s the difference between a chargeback and a dispute? They are the same process in India. A chargeback is the bank’s reversal of a transaction at the card-network level. A dispute is the cardholder’s formal request that triggers the chargeback. The bank submits the chargeback to Visa or Mastercard, the network debits the merchant’s acquirer, and the merchant either accepts or contests. The cardholder’s interface with this is the dispute.

Verdict

The RBI’s 2024 framework gives Indian cardholders a real recovery path — but it is a path that requires two specific actions from the cardholder: hotlist immediately and file in writing. Verbal complaints still get logged, but only written disputes trigger the bank’s 90-day resolution clock and the ombudsman escalation ladder. Cardholders who treat the dispute process as a 60-minute phone-call end up paying for their unauthorised transactions through the bank’s late-fee and finance-charge accrual; cardholders who treat it as a 3-day sprint reverse the loss in full. The system is not foolproof — voluntary OTP disclosure, lost cards lent to family, and merchant goodwill disputes still fall outside the framework — but for genuine fraud, the recovery odds have crossed 80% when the workflow is followed.

Sources

Share: X (Twitter) LinkedIn WhatsApp

← All blog posts