ComplaintAdda
Fact CheckedLast Updated: 21 July 2026Reviewed By: ComplaintAdda Banking Dispute Advisory Cell

Credit Card Fraud & Unauthorized Transaction Chargeback Guide

Credit card fraud represents one of the most financially damaging categories of cybercrime targeting Indian consumers. Fraudsters leverage international payment gateways that bypass two-factor authentication (2FA/OTP) mandatory in India, physical point-of-sale (POS) card skimming at petrol pumps or ATMs, card cloning, and deceptive phishing calls offering limit upgrades to siphon thousands of rupees. Under Reserve Bank of India (RBI) directions—specifically the Master Direction on Credit Card and Debit Card Issuance (2022) and the Circular on Limiting Customer Liability in Unauthorized Electronic Transactions (2017)—credit cardholders enjoy robust statutory protections. If you block your compromised credit card and lodge a formal written dispute with your issuing bank within 3 working days of an unauthorized debit, your legal liability is strictly ZERO, and the bank is mandated to issue a shadow credit (temporary reversal) within 10 working days while investigating.

Expert Advisory Note & Regulatory Nuance

Under RBI's Master Direction on Credit Cards and 2017 Customer Protection Policy, reporting an unauthorized credit card debit within 3 working days guarantees absolute Zero Customer Liability. Banks are legally required to credit the disputed amount temporarily (Shadow Credit) within 10 working days and cannot charge interest during investigation.

What Is It

Credit card fraud involves any unauthorized, fraudulent, or deceptive transaction conducted using a credit card number, CVV, or card credentials without the cardholder's explicit consent. Common categories of credit card fraud include: (1) International Card-Not-Present (CNP) Fraud where fraudsters use stolen card numbers and CVVs on overseas e-commerce portals (e.g., US or European websites) that do not enforce RBI's mandatory 3D-Secure OTP verification. (2) POS Skimming & Card Cloning where physical magnetic strip data is copied using hidden skimming devices installed inside ATM card slots or handheld POS machines. (3) Phishing & Vishing Scams where callers impersonate bank card department officers offering 'Annual Fee Waivers', 'Reward Point Redemptions', or 'Limit Upgrades' to extract CVV, Expiry Date, and OTP. (4) Merchant Billing Disputes & Subscription Traps where websites charge recurring unauthorized monthly subscriptions without cardholder authorization. (5) Application Fraud where identity thieves apply for new credit cards using forged Aadhaar and PAN documents.

When To Use It

Use this guide immediately if you receive an SMS/email alert for a credit card debit you did not authorize, if an unknown transaction appears on your monthly credit card statement, if your physical credit card is lost/stolen, or if your issuing bank (SBI Card, HDFC, ICICI, Axis, Kotak, RBL, Bank of Baroda) refuses to reverse fraudulent charges.

Step-by-Step Process

  1. 1Step 1: Instantly Block Credit Card & Toggle Controls. Open your bank's mobile app or internet banking portal. Immediately block the credit card (temporary lock or permanent block). Turn OFF 'International Transactions', 'Online E-Commerce Transactions', and 'Tap & Pay (NFC)' in card control settings.
  2. 2Step 2: Call National Cyber Crime Helpline 1930 & Bank Fraud Hotline. Report the unauthorized credit card transaction immediately to 1930 to record the incident on the CFCFRMS portal. Simultaneously call your bank's 24x7 Emergency Fraud Reporting Line to register an official Fraud Ticket Number.
  3. 3Step 3: Download & Fill Bank's Official Credit Card Chargeback / Dispute Form. Visit your card issuing bank's official portal (e.g., SBI Card Dispute Form, HDFC Credit Card Dispute Form, ICICI Card Declaration Form). Fill in all details including Card Number, Transaction Date, Amount, Merchant Name, and check 'Unauthorized Transaction / Card in My Possession'.
  4. 4Step 4: File a Cyber Crime Complaint on cybercrime.gov.in. Log into cybercrime.gov.in, select 'Report Financial Fraud', enter transaction and bank details, upload the SMS screenshot/statement, and download the 15-digit Cyber Complaint Acknowledgement PDF.
  5. 5Step 5: Submit Dispute Package to Bank Chargeback Department. Email the signed dispute form, bank statement highlighting the fraud, copy of physical credit card (front side only, cover CVV), and the Cyber Complaint PDF to your bank's dedicated Card Dispute Department (e.g., chargebacks@sbicard.com, creditcarddisputes@hdfcbank.com). Request a formal Case Reference Number.
  6. 6Step 6: Track Statutory 10-Day Shadow Credit Mandate. Under RBI rules, once you submit the written dispute form, the bank must provide a temporary 'Shadow Credit' (reversal of disputed amount) within 10 working days and freeze any interest or late penalty calculation on the disputed sum during investigation.
  7. 7Step 7: Escalate to RBI Ombudsman at cms.rbi.org.in. If the bank fails to reverse the fraudulent charges within 30 calendar days, or wrongfully rejects your chargeback claim despite zero customer negligence, submit an Ombudsman complaint at cms.rbi.org.in.

Documents Required

  • Official Signed Credit Card Transaction Dispute / Chargeback Declaration Form
  • Credit Card Monthly Statement or E-Statement PDF highlighting the disputed unauthorized transactions
  • Uncropped Screenshots of Transaction Debit SMS Alerts containing transaction timestamps and merchant names
  • Copy of 15-digit Cyber Crime Complaint Acknowledgement PDF from cybercrime.gov.in
  • Photocopy of the physical Credit Card (Front Side ONLY — never scan or share the back side CVV number)
  • Passports/Travel Proof (mandatory in cases of unauthorized international transactions to prove physical presence in India)

Fees

Free. Card blocking, lodging chargeback disputes with credit card issuers, filing cyber portal reports, and submitting RBI Ombudsman appeals are 100% free of charge.

Processing Time

Card blocking takes effect instantly within seconds. RBI mandates banks to issue temporary Shadow Credit within 10 working days. Final chargeback investigation and permanent reversal by Visa/Mastercard/RuPay takes 30 to 60 calendar days.

Important Tips

  • Keep 'International Usage' turned OFF by default in your bank app; only enable it temporarily when traveling abroad or making verified international payments.
  • Set individual transaction limits (e.g., maximum ₹5,000 for domestic online transactions) on your credit card mobile app settings.
  • Never share your Credit Card CVV, Expiry Date, Card Number, or OTP with anyone over a phone call, even if the caller claims to be a Bank Card Department Manager.
  • Always inspect physical ATM card slots and POS card swipe machines for loose plastic attachments, extra wiring, or unaligned card readers before inserting your card.
  • Check your credit card monthly e-statement diligently every month for small 'test debits' (e.g., ₹50 or $1 debits) which scammers use to verify valid card credentials.

Frequently Asked Questions

Under RBI Customer Protection directives, when a cardholder submits a formal written chargeback dispute for an unauthorized electronic transaction, the issuing bank is legally required to provide a temporary 'Shadow Credit' (crediting the disputed sum back to the card account) within 10 working days. Furthermore, the bank cannot charge interest, finance charges, or late fee penalties on the disputed amount while the investigation is ongoing.
Yes. In India, RBI mandates Two-Factor Authentication (2FA/OTP) for all domestic electronic payments. Many overseas websites (such as US/EU platforms) process payments without requesting an OTP. If your card credentials are used fraudulently on an international site, you are fully protected under Zero Liability provided you report the unauthorized transaction within 3 working days and confirm the physical card was in your possession.
Under RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18: (1) Zero Liability (100% refund) applies if reported within 3 working days of the transaction SMS alert. (2) Limited Liability (capped at ₹10,000 for standard credit cards or ₹25,000 for premium cards) applies if reported between 4 to 7 working days. (3) If reported after 7 working days, refund depends on the individual bank's board-approved policy.
Card skimming occurs when fraudsters overlay a microscopic magnetic reader and pinhole camera onto an ATM slot or handheld POS swipe machine to capture your card's magnetic strip data and PIN. To spot skimming: check if the card insertion slot feels loose or bulky, inspect for unaligned plastic parts, and cover the keypad with your hand while typing your PIN.
RBI Master Directions explicitly prohibit banks from levying interest, finance charges, or late payment penalties on transactions under formal chargeback dispute. Submit a written grievance to the Principal Nodal Officer (PNO) of the bank citing RBI Master Direction on Credit Cards (2022). If the bank refuses to remove the charges, lodge an Ombudsman complaint at cms.rbi.org.in.
If you disclosed an OTP or CVV on a phishing call, call your bank's emergency line immediately to block the card and block net banking access. While sharing an OTP introduces customer liability under RBI rules, reporting immediately within the Golden Hour to Helpline 1930 allows cyber police to freeze the merchant wallet before settlement.
A Credit Card Fraud Chargeback occurs when an unauthorized third party conducts transactions without your knowledge or consent (Zero Liability rule applies). A Merchant Billing Dispute occurs when you intentionally made a purchase, but the merchant sent defective goods, failed to deliver, or charged the wrong amount. Merchant disputes are resolved through Visa/Mastercard commercial arbitration rules.
Banks are legally prohibited under RBI guidelines from reporting disputed fraudulent amounts as adverse defaults to credit bureaus (CIBIL, Experian, Equifax) while a formal chargeback investigation is pending. If your score dropped due to a fraud dispute, submit a dispute report on cibil.com along with your bank chargeback acknowledgement letter.
As per Visa, Mastercard, and RuPay operating regulations, card issuers provide a temporary shadow credit within 10 days. The acquiring bank and merchant have 30 days to present counter-evidence. If no valid proof of 2FA authorization is provided, the chargeback becomes permanent within 45 to 60 calendar days.
This article is for general information only and does not constitute legal advice. Always verify with the official source before acting.