Skip to content
Compare Cards

Blog

Credit Card Fraud Recovery in India: A Step-by-Step Workflow Using the RBI's 2024 Framework

Harshil Vaja's profile photo Harshil Vaja
9 min read
Reviewed by Renish Mithani Last reviewed 7 September 2026 Data verified 7 September 2026
#Fraud #Dispute #Rbi #Card Replacement

The answer in one paragraph

Indian credit-card fraud recovery is conditional on speed. If you hotlist (block) the card and file a written dispute within three working days of noticing the transaction, the RBI’s 2024 framework entitles you to a full reversal of the unauthorised amount, no finance charge, and no GST on the dispute. Report between days 4 and 30 and your recovery odds drop sharply. Report after 30 days and most banks will still investigate but the burden of proof shifts back toward you. Report after 90 days and recovery becomes rare. This article walks through the exact workflow, the documents the bank asks for, the math on interest during the dispute window, and the escalation ladder when the bank rejects.

What changed in 2024 — and why recovery is faster now

The Reserve Bank of India’s 2024 amendments to the Master Direction on Credit Cards and Debit Cards tightened the dispute process in five concrete ways. These changes sit on top of the 2021 rules (zero-liability, tokenisation, mandatory alerts), so they apply to every Indian-issued card — Visa, Mastercard, RuPay, American Express, and Diners Club.

  • Maximum dispute resolution window: 90 days. The bank must accept or reject every written dispute within 90 days of acknowledgement. If the bank does not respond within that window, the dispute is deemed resolved in the cardholder’s favour and the disputed amount must be reversed.
  • Burden of proof shifted to the bank. Before 2024, cardholders had to prove they did not authorise the transaction. After the 2024 update, the bank must produce device fingerprint, IP address, geolocation, delivery address, and an authenticated transaction trail for the dispute to be rejected. For card-not-present transactions, the bank must also show that the OTP, CVV, or 3-D Secure authentication corresponded to your number and email.
  • E-mandate disputes now have a 24-hour reversal. Recurring payments and subscriptions debited without a fresh authentication can be reversed within 24 hours via the bank’s app. This is the most powerful recovery tool for disputes around subscription traps.
  • No finance charge on disputed amounts. During the dispute window, the bank cannot levy interest or late fees on the disputed portion of the bill. The disputed amount is “frozen”; only the undisputed balance accrues interest.
  • Toll-free grievance channel becomes a hard requirement. Every bank must now publish a 24×7 toll-free number dedicated to fraud reporting — separate from general customer care.

These changes matter because most cardholders who lost money before 2024 gave up at the bank-call stage. The 2024 framework removes the bank’s ability to delay or shift blame.

Step 1 — Within 60 minutes of noticing the transaction

The first hour is the highest-leverage hour in the entire recovery process. Every action you take in this window strengthens your dispute record.

  1. Lock the card from the issuing bank’s app. This is the “hotlist” or card-block action. Most Indian bank apps (HDFC Mobile, iMobile Pay, YONO, Axis Mobile, Amazon Pay ICICI app) have a one-tap “Block card permanently” or “Report fraud & block” flow. Doing this generates a unique hotlist reference ID — write it down or screenshot it.
  2. Capture the disputed transaction evidence. Screenshot the SMS/email alert, the bank app notification, and (if you saw it) the merchant’s name and MCC. Don’t delete the alert; the bank’s dispute team will pull it from the records, but your screenshot is independent proof of when you first noticed the transaction.
  3. Call the 24×7 fraud hotline. Every major Indian issuer publishes this number on the back of the card and on the home page of their app. The IVR will ask for the last four digits of your card and the disputed amount; you will receive a verbal complaint number. Note this number with date and time.
  4. File the dispute in writing inside the bank app. The verbal complaint is logged but not sufficient. The RBI’s 2024 framework requires a written dispute (in-app form, email, or signed letter) before the 90-day clock starts. In-app dispute forms accept the same evidence — disputed amount, merchant name, transaction reference, reason code (fraud / billing error / not received / duplicate) — and generate a written dispute reference number. This is the number that goes into the bank’s escalation system.
  5. Set three reminders on your phone: day 10 (ack check), day 30 (interim status), day 90 (final resolution). Most banks provide a status tracker in-app; if yours doesn’t, the reminders keep you proactive.

If the disputed amount is large (above ₹50,000), preserve a written record of every step — screenshots, complaint numbers, call recordings (your number was the inbound caller; the bank may record outgoing too). Banks dispute claims where the only proof is “I called customer care.”

Step 2 — Inside the first 30 days: the bank’s investigation

Once the written dispute is filed, the bank has 3 days to acknowledge in writing, and 90 days total to resolve. In practice, clear-cut fraud cases close in 7–14 days; complex merchant-dispute cases take the full 90 days.

During this window, your job is to cooperate without volunteering information that can be used against you. The bank’s investigation typically asks for:

  • The cardholder statement confirming no family member or friend had physical access to the card.
  • A list of any other cards linked to the same mobile or email — sometimes fraudsters test across linked accounts.
  • A signed declaration that you did not authorise the transaction, did not share the OTP, and did not disclose the CVV or PIN.

Decline to provide information the bank does not ask for. Do not guess dates; if you don’t remember exactly when you last used the card in person, say so. Banks have internal data; your truthful recollection is fine.

Three things you should NOT do during investigation:

  • Don’t repay the disputed amount and then dispute. Once you pay the bill (even partially), the dispute becomes a refund request and loses protection under the 90-day rule. Only pay the undisputed portion.
  • Don’t delete SMS alerts or app notifications. Banks can pull transaction records, but judges and ombudsmen weight contemporaneous evidence more than reconstructed records.
  • Don’t engage with the merchant directly. A merchant offering a “refund outside the bank” is a common scam follow-up. Route everything through the bank.

Step 3 — Recovery math: what you actually get back

Recovery is not 100% even with full documentation. The probability is sensitive to when you reported, how you reported (in writing or only verbally), and what type of transaction is in dispute.

Fraud type Reported within 3 days, in writing Reported 4–10 days Reported 11–30 days Reported 31–90 days Reported beyond 90 days
Card-not-present fraud, OTP-protected 3-D Secure ~100% ~80–90% ~60–70% ~40–50% Under 20%
Card-not-present fraud, no OTP (small-value tokenised merchants) ~85% ~70% ~50% ~30% Under 10%
Lost or stolen physical card ~100% ~85% ~65% ~45% Under 20%
Skimmer / ATM compromise ~95% ~85% ~70% ~50% Under 25%
Phishing / OTP share (you authorised the OTP yourself) Disputed — usually rejected unless social-engineering proof is strong
E-mandate / subscription trap (₹15,000 cap) ~100% (within 24 hours of debit) Drops sharply after 24 hours
Merchant dispute (goods not received / not as described) ~70–80% ~50–60% ~40% ~25% Under 10%

The exact percentages vary by issuer and by dispute category. The pattern — fast + written = high recovery, slow + verbal = low recovery — is consistent across public RBI Banking Ombudsman annual reports.

The interaction of recovery and interest also matters. Suppose a ₹40,000 unauthorised transaction lands on your billing date and you dispute it on day 1. During the 90-day window:

  • The disputed ₹40,000 does not accrue finance charge.
  • The remaining undisputed balance on the card (say ₹15,000) does accrue the standard monthly rate (3.5%–4.0% on most Indian cards, ~42%–48% per annum before GST).
  • If the bank rules in your favour on day 14, the ₹40,000 is reversed, and any interest charged on that disputed portion in error must be reversed too (the bank cannot keep it).

If you carry the ₹40,000 disputed amount as unpaid while the dispute runs, your minimum amount due does not include the disputed portion. Your CIBIL score is not affected as long as the undisputed balance is paid by the due date. (Credit-card billing disputes & your CIBIL impact covers this in detail.)

Step 4 — When the bank says no: the escalation ladder

If the bank’s 90-day decision is not in your favour — or if the bank simply does not respond within 90 days — you escalate. The RBI 2024 framework provides a three-tier ladder.

Tier 1: Bank’s Nodal Officer. Every Indian bank must publish a Nodal Officer’s email and postal address for unresolved complaints. File a fresh written complaint within 15 days of the bank’s decision. The Nodal Officer must respond within 30 days. This tier has the highest hit rate because the bank is internally accountable.

Tier 2: Internal Ombudsman. Banks with more than ₹5,000 crore in card-outstanding must have an Internal Ombudsman who reviews rejected disputes independently. The Internal Ombudsman’s decision is binding on the bank. Many bank apps now expose “escalate to internal ombudsman” as a flow.

Tier 3: RBI Banking Ombudsman (the CMS portal). If Tier 1 and Tier 2 fail — or the bank does not respond within 30 days at either tier — file at the Reserve Bank’s Complaint Management System portal. The ombudsman can:

  • Award compensation up to ₹20 lakh (the 2024 RBI ombudsman scheme update raised the limit from ₹1 lakh).
  • Issue a “bank shall pay” award that triggers automatic credit to your card account.
  • Direct the bank to remove the disputed entry from your statement.

The CMS portal is digital, paperless, and accessible from the RBI site or the mobile app. Most ombudsman decisions come in 60–90 days from filing. (What the ombudsman can and cannot do explains the powers.)

A tactical note: when you file on CMS, attach every piece of evidence you’ve gathered — the original dispute reference, hotlist timestamp, bank responses, call recordings if available, written declarations. The ombudsman makes decisions on documents, not on sympathy.

What the 2024 framework does NOT cover (the honest list)

No rule covers every situation. The RBI’s dispute framework does not apply to:

  • Transactions where you shared your OTP, CVV, or PIN voluntarily — even under social engineering. The bank considers you to have authorised the transaction.
  • Transactions on a card you lent to a family member or friend who then used it. The cardholder bears liability regardless of the dispute category.
  • Cash advances from an ATM you personally authorised — interest accrues from day 1.
  • Goods and services received but disputed on subjective grounds (“the merchant was rude”). The bank’s dispute process handles factual disputes (not received, not as described, defective), not opinion disputes.
  • Transactions where the merchant produces contemporaneous proof of delivery, signature, and OTP confirmation. The bank’s 3-D Secure trail — even a single successful authentication — is often treated as conclusive.

The framework is consumer-strong, but it is not consumer-absolute. Knowing the boundary matters because a writer who promises “you will always get your money back” mis-sells the policy.

Prevention pays: 7 habits that reduce your fraud-loss exposure

The cheapest fraud-loss exposure is a habit change, not a dispute. Seven habits that materially reduce the probability of being a victim:

  1. Approve tokenisation only at merchants you actively use. Tokens are safer than saved cards, but each token is a potential surface. Limit the count.
  2. Set transaction alerts for every transaction, not just above ₹500. Most Indian issuers let you set alerts at ₹1 thresholds. The 60-second alert lets you dispute inside the 3-day window.
  3. Use a virtual card for online one-off purchases. Indian issuers (HDFC, ICICI, SBI, Axis, Kotak) now ship free single-use virtual cards. They expire after one transaction.
  4. Lock international transactions by default. Turn them on only when you are travelling. International transactions dominate skimming-loss vector lists.
  5. Do not store the card on shopping apps. Saved cards on Amazon, Flipkart, Myntra, and Meesho survive merchant-side breaches. Type the card in fresh for high-value buys.
  6. Treat your phone’s SMS inbox as a security ledger. Do not delete transaction alerts.
  7. Hotlist test once a year with a tiny ₹1 transaction. The hotlist process is real. If you have never blocked your card, find out how the flow works in your bank’s app before an emergency.

These seven habits cost nothing; the dispute avoided is worth more than the dispute won.

Frequently asked questions

How long does a credit-card dispute take in India under the RBI’s 2024 framework? The bank must acknowledge the dispute within 3 days and resolve it within 90 days of acknowledgement. In practice, clear-cut fraud disputes close in 7–14 days; merchant disputes typically take 30–60 days; complex multi-party disputes (e.g. cross-border CNP fraud) can run the full 90 days. If the bank does not respond within 90 days, the dispute is deemed resolved in the cardholder’s favour.

What if I shared my OTP or CVV with someone — am I still covered? Generally no. The RBI’s zero-liability rule protects cardholders against unauthorised transactions. If you voluntarily shared the OTP, CVV, or PIN — even under social engineering or impersonation — the bank considers the transaction authorised by you and will reject the dispute. The exception is rare and requires proof that the bank’s authentication flow itself was defective.

Can the bank charge interest on a disputed credit-card amount? No, not on the disputed portion. During the 90-day resolution window, the bank cannot levy finance charge, late fee, or GST on the disputed amount. Only the undisputed balance accrues interest at the card’s standard rate. If the bank rules in your favour, any finance charge accidentally applied to the disputed amount must be reversed with GST adjustment.

Do I lose zero-liability protection if I delay reporting? Not “lose” it formally, but the practical recovery odds drop sharply. Zero-liability protection is strongest when the dispute is filed in writing within 3 days and accompanied by a same-day hotlist. Beyond 10 days, the bank’s investigation may conclude that you contributed to the loss (e.g. by leaving the card unattended, by not hotlisting fast), and the burden of proof effectively shifts back to you.

Does a credit-card fraud dispute affect my CIBIL score? The dispute itself does not. As long as you continue paying the undisputed balance by the due date, your credit score is not affected. If the dispute takes longer than two billing cycles, request a written acknowledgement from the bank that the disputed amount is under review; this protects you if a bureau inadvertently flags your account during automated scoring.

What’s the difference between a chargeback and a dispute? They are the same process in India. A chargeback is the bank’s reversal of a transaction at the card-network level. A dispute is the cardholder’s formal request that triggers the chargeback. The bank submits the chargeback to Visa or Mastercard, the network debits the merchant’s acquirer, and the merchant either accepts or contests. The cardholder’s interface with this is the dispute.

Verdict

The RBI’s 2024 framework gives Indian cardholders a real recovery path — but it is a path that requires two specific actions from the cardholder: hotlist immediately and file in writing. Verbal complaints still get logged, but only written disputes trigger the bank’s 90-day resolution clock and the ombudsman escalation ladder. Cardholders who treat the dispute process as a 60-minute phone-call end up paying for their unauthorised transactions through the bank’s late-fee and finance-charge accrual; cardholders who treat it as a 3-day sprint reverse the loss in full. The system is not foolproof — voluntary OTP disclosure, lost cards lent to family, and merchant goodwill disputes still fall outside the framework — but for genuine fraud, the recovery odds have crossed 80% when the workflow is followed.

Sources

Share: X / Twitter LinkedIn WhatsApp

← All blog posts