SwipeWise

Disclosure. No link on this page earns us a commission today: buttons go to the issuer's own pages. Any paid link will be labelled, and rankings never depend on one. Details

Credit card fraud: RBI rules, liability and how to report

Updated 30 Oct 2026 · by SwipeWise editorial team · how we write

This guide reports only what RBI circulars, a government press release and issuer MITC documents say. Read the version your own issuer gives you, since terms change.

Card controls issuers must offer

RBI/2019-20/142 (15 January 2020) says new cards “shall be enabled for use only at contact based points of usage [viz. ATMs and Point of Sale (PoS) devices] within India”. Issuers must give a facility to enable card-not-present, international and contactless use, and to “switch on / off and set / modify transaction limits” on a 24x7 basis through “multiple channels - mobile application / internet banking / ATMs / Interactive Voice Response (IVR)”. They must also send SMS or e-mail alerts when card status changes.

Tokens and saved cards

RBI/2021-22/96 (7 September 2021) says tokenisation needs “explicit customer consent requiring Additional Factor of Authentication (AFA) validation by card issuer”. Since 1 January 2022 no entity other than issuers and card networks may store actual card data; others may keep the last four digits and issuer name. The issuer must let you view the merchants where you opted for a token and de-register any of them (app, net banking, IVR or branch).

Lost card: Master Direction provisions

The Master Direction on Credit Card and Debit Card, 2022 (updated 7 March 2024), requires issuers to:

  • “block a lost card immediately on being informed by the cardholder” (para 23(e));
  • offer 24x7 reporting through channels such as a helpline, SMS number, e-mail, IVR, website or app, and “immediately send a confirmation” after blocking (23(f), 23(g));
  • levy “no charges … on transactions disputed as ‘fraud’ … until the dispute is resolved” (10(d)).

Para 30(f) makes issuers state cardholder liability by reference to the 2017 circular below, “as updated from time to time”.

Liability tiers in the 2017 circular

DBR.No.Leg.BC.78/09.07.005/2017-18 (6 July 2017) is addressed to scheduled commercial banks, small finance banks and payments banks. Its table lists credit cards, but its text does not name NBFC card issuers; SBI Card’s MITC says its policy follows the circular. For a third-party breach where the fault lies “neither with the bank nor with the customer”:

Time to report, from the bank’s communicationCustomer liability
Within 3 working daysZero
4 to 7 working days“The transaction value or the amount mentioned in Table 1, whichever is lower”
Beyond 7 working days“As per bank’s Board approved policy”

Table 1 caps: credit card limit up to ₹5 lakh, ₹10,000; above ₹5 lakh, ₹25,000, applied per transaction. Working days follow “the working schedule of the home branch of the customer excluding the date of receiving the communication”. Where the customer was negligent, “such as where he has shared the payment credentials”, the customer bears the entire loss until reporting; later loss is the bank’s. Bank-side fault means zero liability whether or not reported.

The bank must credit the amount “within 10 working days from the date of such notification”, without waiting for any insurance claim. It must resolve the complaint “not exceeding 90 days” from receipt; for credit cards the customer must not “bear any additional burden of interest”.

Worked example (third-party breach, card limit ₹3 lakh, cap ₹10,000):

  • ₹40,000 reported on working day 2: ₹0.
  • ₹40,000 reported on working day 5: lower of ₹40,000 and ₹10,000 = ₹10,000.
  • ₹6,000 reported on working day 5: lower of ₹6,000 and ₹10,000 = ₹6,000.

Issuer MITC clauses

IssuerTopicParaphrase and short quoteDocument
HDFC BankLossLiable before reporting; after notification “subsequent liability is zero”. SMS “Block CC ****” to 7308080808.MITC, updated 29 Oct 2026
HDFC BankDisputeStatement deemed correct unless disputed “within 30 days of the Statement Date in writing”.Same
SBI CardLossNot liable “prior to the time of reporting”; SMS “BLOCK XXXX” to 5676791; no confirmation “within 5 minutes” means call the helpline.MITC, file metadata Oct 2026
SBI CardDispute90 days from transaction (Visa, Mastercard, Amex, RuPay international); 30 days for RuPay domestic and UPI.Same
ICICI BankLossReport “immediately”; SMS “BLOCK” plus last four digits; not liable for transactions “post reporting”; replacement “within 7 (seven) working days”.MITC, 9 Oct 2026
ICICI BankDispute“within 60 (sixty) days of the Statement Date in writing”.Same
Axis BankLossReport immediately; lost-card option is “option - 0” on the toll-free numbers; FIR required; bank liability “limited to the amount covered under Lost Card Liability”.MITC, file metadata Oct 2026
Axis BankDispute“within 60 days of the Issue of Statement”.Same

Windows start from different points (transaction or statement date). HDFC and SBI Card point to separate customer-protection policies on their websites, which we did not open. Related: how to read a credit card MITC and billing cycle and due date.

National helpline

A PIB release of 18 December 2024 says the National Cyber Crime Reporting Portal (cybercrime.gov.in) exists, and the toll-free helpline 1930, introduced in 2020, “operates 24X7X365”. It says the Citizen Financial Cyber Fraud Reporting and Management System (2021) is for “immediate reporting of financial frauds”.

What to check

  • The blocking channels and reporting windows in your issuer’s MITC.
  • Whether your issuer is a bank or an NBFC, since the 2017 circular is addressed to banks.

Limits

  • The Master Direction page has no card on/off or token provisions; those come from the separate circulars above.
  • We found no later amendment to the 2017 circular, but could not rule one out.
  • cybercrime.gov.in itself would not open.

Sources

Try it with your own numbers. Open the calculator

Keep reading