Legal information notice: this article provides general information and isn't a substitute for advice from a qualified lawyer.
A transaction on your credit card statement you never made — whether from a cloned card, a phishing scam, or a card-not-present online fraud — is one of the more recoverable forms of financial fraud in India, provided you act fast and follow the right process. Here’s exactly how to report it and get your money back.
Use your bank’s app, net banking, or 24×7 card helpline to block the card the moment you spot an unrecognized transaction — don’t wait to investigate first.
Follow up your verbal/app report with a written complaint (email is fine) to your card issuer within 3 working days — this is the key window for RBI’s zero/limited liability protection on unauthorized card transactions.
Ask your bank to raise a chargeback for the specific transaction(s) through the card network (Visa/Mastercard/RuPay). You’ll typically need to fill a dispute form confirming you didn’t authorize it.
In addition to your bank complaint, file on cybercrime.gov.in or call 1930 — this is a separate process that also needs to happen for a full paper trail and investigation.
Chargeback investigations typically resolve within the card network’s mandated timeline (often 30-90 days depending on the case). Save your dispute reference number and follow up if you don’t hear back.
When you raise the dispute with your bank, come prepared with specific detail — the exact date and amount of the transaction, the merchant name as it appears on your statement, and a clear one-line statement that you did not authorize or benefit from the charge. Disputes with precise, well-organized information tend to move through the chargeback process faster than vague ones.
It’s also worth checking your statement for other unfamiliar charges around the same period, not just the one that first caught your eye — card fraud sometimes starts with a small “test” transaction before a larger one follows, and catching the pattern early strengthens your case.
With the card blocked and the dispute documented, here’s how your liability actually plays out based on timing:
| Situation | What Applies |
|---|---|
| Reported within 3 working days | Zero liability in most cases of third-party breach, per RBI's Customer Protection guidelines |
| Reported between 4-7 working days | Limited liability, capped depending on your card/account category |
| Chargeback investigation | Typically resolved within 30-90 days depending on the card network and case complexity |
Start with your card issuer’s dispute/fraud department — this is mandatory and where the chargeback process actually happens. File the cybercrime complaint separately and in parallel; it doesn’t replace the bank dispute, and the bank dispute doesn’t replace the cybercrime complaint.
No — raising a dispute/chargeback with your bank and filing a cybercrime complaint are both free. You’d only incur cost if you need a lawyer later to push back on a denied claim.
Yes, in most cases — this process is designed for direct self-service. A lawyer becomes useful if:
Need professional legal help with this?
Find a Lawyer on VidyodayIf the fraud involved your broader bank account rather than just a credit card, see our guide on a hacked bank account. For UPI-specific fraud, see UPI fraud recovery instead.
Report it anyway — this is common with card-not-present fraud where the merchant name shown may not match what you’d expect, or the merchant’s own systems were compromised without their knowledge.
It varies by card network and case complexity, but 30-90 days is typical. Your bank should be able to give you an estimated timeline specific to your dispute.
Many banks provide a provisional credit during investigation for larger disputed amounts, though this isn’t guaranteed in every case — ask your bank directly when you file.
The same reporting and liability rules apply — report and block immediately, and your liability depends on how quickly you reported after the theft, not just after noticing the transaction.
Yes, if their investigation finds evidence suggesting you authorized the transaction or were negligent — but you can escalate a denial you disagree with to the RBI Ombudsman.
The cybercrime portal complaint is generally sufficient and routes appropriately; you don’t need to separately visit a police station first.
The same dispute process applies through your card network, though cross-border investigations can sometimes take longer — report it the same way regardless.
Your bank will typically block and reissue a new card automatically once you report fraud — you generally don’t need to separately request a full account closure.
This article is for general information only and does not constitute legal or financial advice. RBI rules, card network policies, and dispute timelines can be updated — verify current guidelines with your card issuer or on rbi.org.in before relying on this for a real case.
