Skip to content
Compare Cards

Blog

Visa vs Mastercard Zero Liability vs RBI's 2021 Rule: Three Layers of Fraud Protection on Indian Credit Cards

Harshil Vaja's profile photo Harshil Vaja
8 min read
Reviewed by Rahul Godeshwar Last reviewed 5 September 2026 Data verified 5 September 2026
#Fraud #Dispute #Card Network #Visa #Mastercard

The one-paragraph answer

If an unauthorised credit-card transaction hits your statement in India, three separate policies can apply at once: Visa’s Zero Liability Policy, Mastercard’s Zero Liability Protection, and the Reserve Bank of India’s 2021 Master Direction on Card Issuance. The network policies (Visa, Mastercard, Amex, RuPay) are contractual promises from the card network to the issuing bank. The RBI rule is a regulation that overrides any weaker network term. In practice the RBI rule is the floor for every Indian-issued card; the network policies either match it or sit on top of it. Most cardholders never realise all three exist — and most disputes only succeed because of the RBI rule, not because of the brand on the front of the card.

Why three layers exist

Credit-card fraud protection has accumulated over four decades, and the Indian stack is the same as the global one, just with RBI’s rule as an additional regulatory floor.

  • Network policies (Visa, Mastercard, Amex, RuPay) were introduced in the 1990s and 2000s to win consumer trust against debit cards and cash. They are contractual — what the network promises the issuing bank, which the bank then passes on to you in the MITC (Most Important Terms and Conditions).
  • RBI’s 2021 Master Direction was issued in response to rising card-not-present fraud and post-demonetisation chargeback friction. It is regulation — what every Indian bank must offer, regardless of network or card type.

The two layers mostly point the same way, but the RBI rule is stronger in two cases: it forces a 3-day reporting window for ₹0 liability, and it forces the bank (not you) to prove you authorised the transaction. Network policies defer to the bank’s discretion on both points unless the bank’s own terms explicitly match the RBI standard.

How the three rules compare

Dimension Visa Zero Liability Mastercard Zero Liability RBI 2021 Rule
Applies to All Visa-branded cards issued in India All Mastercard-branded cards issued in India Every credit card issued by an Indian bank, regardless of network
Maximum cardholder liability for unauthorised transaction ₹0 if conditions met ₹0 if conditions met ₹0 if reported within 3 days; up to ₹10,000 if reported within 4–7 days; full amount if reported after 7 days (subject to bank investigation)
Reporting window to qualify “As soon as possible” — bank-discretion wording “Promptly” — bank-discretion wording Fixed: 3 days for zero liability
Burden of proof Bank must show you were negligent or compromised credentials Bank must show you were negligent or compromised credentials Bank must prove you authorised the transaction; the default assumption is that you did not
Applies to PIN-based transactions No — PIN-based transactions excluded if PIN was disclosed or written on the card No — same exclusion Limited — you can still claim if bank failed in its duty (e.g. allowed unauthorised PIN change)
Covers card-not-present (online) fraud Yes Yes Yes
Covers international transactions Yes, on Indian-issued Visa cards Yes, on Indian-issued Mastercard cards Yes
Covers ATM / cash advances No No No — same exclusion
Time limit for the bank to resolve the dispute Bank’s own policy (typically 30–60 days) Bank’s own policy (typically 30–60 days) Fixed: 90 days from written dispute
Compensation for delay Bank’s discretion Bank’s discretion Mandatory if the bank misses the 90-day window and the dispute was genuine
Legal status Contractual — what Visa promises issuers Contractual — what Mastercard promises issuers Regulatory — overrides weaker bank or network terms

The headline difference: the network policies are permissive — they cap your liability if the bank agrees you met their conditions. The RBI rule is prescriptive — it tells the bank exactly how much you owe based on when you reported, and it puts the proof burden on them.

Who pays in each scenario

The math matters most when the dispute is contested. The four scenarios below show what each layer actually does for a ₹50,000 unauthorised charge on an Indian-issued Visa or Mastercard credit card.

Scenario 1: Skimmed at a petrol pump, reported within 24 hours

Your card was skimmed at a fuel station. The next day you see a ₹50,000 online charge at an unfamiliar merchant. You hotlist the card via the bank’s app within an hour of seeing the alert and file a written dispute the same day.

  • Visa Zero Liability: applies if your bank confirms you exercised reasonable care. Most banks treat a 24-hour report as reasonable; the bank reverses the ₹50,000.
  • Mastercard Zero Liability: same outcome.
  • RBI rule: zero liability because you reported within 3 days. The bank must reverse and cannot charge interest on the disputed amount while the investigation is open.

In this scenario all three layers point the same way — you owe ₹0. The RBI rule is the strongest because it gives the bank no discretion.

Scenario 2: Phishing OTP shared, reported on day 5

You shared an OTP with a fraudster posing as a bank manager. You realise the loss on day 5 and file a written dispute that evening.

  • Visa Zero Liability: probably denied. The condition “you exercised reasonable care” is interpreted by the bank as having failed. Most banks reject the dispute on this ground.
  • Mastercard Zero Liability: same — likely denied.
  • RBI rule: your liability is capped at ₹10,000 (because you reported between day 4 and day 7). The bank covers the remaining ₹40,000 if it confirms the transaction was fraudulent.

Here the RBI rule gives you a floor the network policies do not. The dispute becomes partly about getting the ₹10,000 cap applied, and partly about whether the bank has evidence beyond your OTP disclosure (device fingerprint, IP address, delivery address) that shows you participated more deeply.

Scenario 3: Lost card, no alerts enabled, reported on day 30

You lost your card in transit, did not enable transaction alerts, and noticed the loss only when the statement arrived 30 days later. The statement shows five charges totalling ₹50,000.

  • Visa Zero Liability: the bank has discretion to deny. “Reasonable care” usually includes enabling alerts.
  • Mastercard Zero Liability: same.
  • RBI rule: the 7-day window has lapsed. You are liable for the full ₹50,000 unless the bank agrees to waive as a goodwill gesture (rare for this scenario).

In this scenario the network policies give the bank more room to deny than the RBI rule does in the early days — but the RBI rule’s 7-day cliff also cuts both ways. Alerts are the single biggest protective lever.

Scenario 4: Online fraud where the merchant was breached

Your card number was leaked in a merchant-side breach (a shopping site, a hotel booking site). Fraudulent charges appear, but you never shared your details.

  • Visa Zero Liability: applies — you exercised reasonable care, the failure was on the merchant side.
  • Mastercard Zero Liability: applies.
  • RBI rule: applies at any reporting window, because the loss is attributable to a third-party breach where neither you nor the bank is at fault. Under RBI’s specific clause on “third-party breach”, your liability is ₹0 even if you report on day 20.

This is the cleanest case. Tokenisation (the 2021 RBI rule that makes merchants store tokens instead of raw card numbers) reduces the volume of these cases significantly, but when they still occur, all three layers favour the cardholder.

What this means for you as a cardholder

Three things you must do

  1. Enable transaction alerts for every transaction, regardless of amount. The RBI mandates alerts above a bank-set threshold (typically ₹500), but most banks let you toggle alerts down to ₹1. Smaller fraud probes (₹200–₹500) are common; you cannot catch them without alerts.
  2. Hotlist the card and file a written dispute the same day you see an unfamiliar transaction. The RBI’s strongest protection (₹0 liability) only applies inside the 3-day window. Every hour past day 3 costs you money.
  3. Use tokenised checkout (Apple Pay, Google Pay, Samsung Pay, or token-on-file at merchants that support it). Tokenisation reduces the chance of scenario 4 by replacing your real card number with a merchant-specific token at the network level.

Three things that do not change anything

  • Brand on the card. Visa and Mastercard zero-liability policies are substantively similar for Indian-issued cards. The RBI rule applies on top of either. Don’t choose a card based on its network’s policy wording.
  • Whether the card is “premium”. The same three layers apply to a lifetime-free card and a ₹5-lakh super-premium card. The bank’s service quality during dispute handling does vary; that is not part of the policy.
  • Whether the bank is public or private. The RBI rule binds all scheduled commercial banks. The dispute experience may differ in practice (some private banks have faster turnaround), but the policy floor is uniform.

The dispute form is the actual lever

The RBI rule requires the bank to acknowledge a written dispute within 3 days and resolve within 90 days. A phone complaint is logged but is not a written dispute for the 90-day clock. Use the in-app dispute form every time. The form forces the bank to issue a reference number; that reference number is what the Banking Ombudsman will ask for if you escalate.

FAQ

Does Visa Zero Liability work in India?

Yes — the Visa Zero Liability Policy applies to every Visa-branded card issued by an Indian bank. The policy is enforced through your issuing bank’s terms; you claim it by filing a dispute with the bank, not with Visa directly. Visa’s policy covers unauthorised transactions where you exercised reasonable care and reported promptly. It does not cover PIN-based transactions if you disclosed your PIN, and it does not cover cash advances.

Does Mastercard Zero Liability work in India?

Yes — Mastercard Zero Liability Protection applies to every Mastercard-branded card issued by an Indian bank. The conditions and exclusions are functionally the same as Visa’s: report promptly, exercise reasonable care, do not disclose your PIN. For most Indian cardholders the practical effect is identical to Visa’s policy.

Which is stronger: the network policy or the RBI rule?

The RBI rule. It is a regulation, not a contract, so it overrides any weaker bank or network term. The two practical cases where the RBI rule is materially stronger: (a) the 3-day reporting window for ₹0 liability is fixed in the rule, while the network policies use bank-discretion wording like “promptly”; (b) the RBI rule places the burden of proof on the bank to show you authorised the transaction, while the network policies let the bank argue negligence. In any conflict, the RBI rule wins.

What about American Express and RuPay cards?

American Express’s Online Fraud Protection Guarantee and RuPay’s Zero Liability are network-level promises in the same family as Visa’s and Mastercard’s. Both cover unauthorised online transactions for cards in good standing. The RBI 2021 rule applies on top of either — RuPay and Amex issuers must offer the same reporting-window protections as Visa and Mastercard issuers. RuPay’s official cardholder terms explicitly align with the RBI 3-day / 7-day structure.

Does the bank ever waive liability after day 7?

Sometimes, as a goodwill gesture. The bank is not obligated to waive after day 7; the RBI rule does not require it. Banks are more likely to waive if (a) the disputed amount is small relative to your history, (b) you have a clean payment record, (c) you escalate to the Nodal Officer with a strong written case. Do not rely on goodwill — file within 3 days.

What if my dispute is rejected?

Escalate in writing to the bank’s Nodal Officer (every bank must have one; the contact is on the bank’s website and on every statement). If the Nodal Officer rejects within 30 days, escalate to the RBI Banking Ombudsman under the Banking Ombudsman Scheme 2021. The Ombudsman can override the bank’s decision if the bank’s evidence is weak. For amounts above ₹1 lakh, the Ombudsman process is faster than consumer court and typically resolves within 90 days.

The bottom line

The Visa and Mastercard zero-liability policies are real, but they are the second layer of protection — not the first. The first layer is RBI’s 2021 Master Direction, which fixes your liability at ₹0 if you report within 3 days and puts the proof burden on the bank. The network policies sit on top of that, mostly as marketing copy that reassures you the bank will treat your case fairly. In a dispute, the RBI rule is what determines the outcome; the network’s brand name is what determines which 1800-number you call first. Enable alerts, hotlist fast, file in writing — that sequence delivers the protection all three rules promise.

Sources

Share: X / Twitter LinkedIn WhatsApp

← All blog posts