If you see an unauthorized credit card transaction, block or hotlist the affected card immediately and report the transaction to the issuer through an official 24×7 channel. Save the complaint number, alert timestamp, statement entry and every message. Do not wait to identify the merchant before stopping further use.
For cyber fraud, promptly call India's cybercrime helpline 1930 and complete the appropriate report at cybercrime.gov.in in addition to notifying the card issuer. A cybercrime report does not replace the issuer dispute, and the issuer complaint does not replace urgent fraud reporting where money may still be traceable.
Unauthorized transaction, merchant dispute and failed payment are different
Choosing the right complaint type prevents delay.
| Problem | What happened | Usual starting route |
|---|---|---|
| Unauthorized transaction | You did not approve the payment | Block card and report fraud to issuer immediately |
| Merchant dispute | You approved payment but goods, amount or refund are wrong | Contact merchant, then use issuer dispute/chargeback process |
| Failed transaction | Payment failed but the card was debited | Report failed transaction with terminal/app evidence |
| Card lost or stolen | Payment instrument is missing, with or without fraud | Block card immediately and report any unknown entries |
A chargeback is an issuer and card-network process for an eligible disputed transaction. It is not an automatic refund and is not identical to the RBI framework for customer liability in unauthorized electronic banking transactions.
RBI rules on customer liability
The RBI's Customer Protection circular on unauthorized electronic transactions separates responsibility and reporting time.
When customer liability can be zero
Customer liability is zero when the unauthorized transaction results from contributory fraud, negligence or deficiency by the bank, regardless of when the customer reports it.
For a third-party breach where neither the bank nor customer is at fault, zero liability applies when the customer notifies the bank within three working days of receiving the bank's communication about the transaction.
Reporting in four to seven working days
For the same kind of third-party breach, reporting in four to seven working days limits liability to the lower of the transaction value or the regulatory cap. The circular lists ₹10,000 for credit cards with limits up to ₹5 lakh and ₹25,000 for credit cards with limits above ₹5 lakh.
Reporting after seven working days
Liability follows the bank's board-approved policy. That is why even a generous outer dispute window is not a reason to wait.
When the customer shared credentials
If loss arose from customer negligence, such as sharing a PIN, password or OTP, the customer bears the loss until the bank is notified. Loss after reporting is borne by the bank under the circular. Never share credentials or allow remote screen access, even with someone claiming to reverse a fraudulent payment.
| Situation | Reporting time | RBI liability principle |
|---|---|---|
| Bank fraud, negligence or deficiency | Any | Zero customer liability |
| Third-party breach; neither bank nor customer at fault | Within 3 working days | Zero customer liability |
| Same third-party breach | 4–7 working days | Lower of transaction value or applicable cap |
| Same third-party breach | After 7 working days | Bank's board-approved policy |
| Customer shared credentials | Any delay | Customer bears loss until reporting; bank bears later loss |
Working days are counted under the framework described in the circular. Report immediately rather than trying to calculate the last permissible hour.
Provisional credit and resolution timelines
After notification, the RBI circular requires the bank to provide a shadow reversal of the unauthorized amount within 10 working days, value-dated to the transaction date, without waiting for an insurance claim. The complaint and customer liability must be resolved within the bank's policy timeline, not exceeding 90 days.
For a credit card, the customer should not bear an additional interest burden because of the case. The burden of proving customer liability lies with the bank. RBI's consumer summary reinforces the need to report immediately and retain acknowledgment.
A provisional credit is not always the final decision. Continue paying undisputed statement amounts according to written issuer instructions and track whether a temporary credit is later made permanent or reversed after investigation.
Seven immediate steps after a transaction you do not recognize
- Lock or block the card in the official app or helpline. If confirmation does not arrive, use another official channel.
- Report the exact transaction as unauthorized. Record the complaint number and time.
- Protect connected accounts. Change compromised banking, email and device credentials; remove unknown devices.
- Call 1930 promptly for cyber fraud. Follow through with the online complaint where applicable.
- Preserve evidence. Keep alerts, statement entries, screenshots, merchant descriptors, call records and police/cybercrime acknowledgment.
- Submit the issuer's dispute form. Meet its evidence and signature requirements without delaying the first report.
- Review nearby transactions. Fraudsters may test a card with a small payment before a larger one.
Never call a number supplied in a suspicious SMS. Use the number on the issuer's official website, app or the back of the card.
When a chargeback may help with a merchant dispute
You may have authorized the payment but still have a valid dispute: duplicate billing, wrong amount, goods not received, a cancelled service charged anyway, or a promised refund that never arrived.
Contact the merchant first when safe and reasonable. Save the order, invoice, cancellation terms, delivery evidence and correspondence. If unresolved, ask the issuer which chargeback reason and filing deadline apply.
Network and issuer windows vary. For example, the SBI Card MITC publishes different discrepancy-reporting windows for Visa/Mastercard/Amex, RuPay international, and domestic or UPI RuPay transactions. Those are issuer/network workflow examples, not one legal deadline for every Indian card.
NPCI also maintains RuPay chargeback information. A RuPay credit-card-on-UPI dispute can involve the UPI app, issuer, acquirer and merchant, but your first safe action remains a prompt issuer report. Our RuPay UPI guide explains how the funding source appears on the card statement.
Evidence that makes a card dispute clearer
Build a short chronology:
- transaction date, time, amount and merchant descriptor;
- when the issuer alert reached you;
- when and how you reported it;
- whether the card was in your possession;
- why the payment was unauthorized or what merchant promise failed;
- merchant contact and response;
- cybercrime or police reference where relevant;
- the remedy requested.
Do not alter screenshots. Keep original emails and downloadable statements. A precise timeline helps distinguish fraud, service disagreement and processing failure.
Escalating an unresolved complaint
First use the issuer's complaint and grievance-officer path. Reply on the same reference so the history remains connected. If the regulated entity rejects the complaint, gives an unsatisfactory response or does not respond within the applicable period, review eligibility for RBI's Complaint Management System at cms.rbi.org.in.
An Ombudsman complaint is not a replacement for timely issuer reporting or chargeback evidence. It reviews service and regulatory compliance; it does not turn every merchant disagreement into a guaranteed refund.
Frequently asked questions
Should I pay the disputed amount?
Ask the issuer in writing how to handle the disputed line and continue paying undisputed amounts. Do not silently withhold the entire statement, because that can create a separate late-payment problem.
Is an OTP-authenticated transaction impossible to dispute?
No. Authentication is evidence, not the entire liability decision. Report what happened honestly. If credentials were shared, the RBI negligence rule can affect liability until reporting.
How many days do I have to file a chargeback?
The window depends on issuer, network, transaction rail and reason. Report immediately; do not wait for an outer limit found in an old article.
What if the card is still with me?
Card-not-present fraud can occur without physical theft. Block the card, report the transaction and secure the accounts or devices that may have exposed credentials.
Will blocking the card stop subscriptions?
It stops or restricts card use, but token and recurring-payment handling can vary. Ask the issuer and review subsequent statements. Blocking is also not the same as permanently closing the credit-card account.
The practical answer
Speed, classification and evidence matter. Block first, report to the issuer immediately, add a cybercrime report where relevant, and preserve a clean timeline. Then use the correct route: unauthorized-transaction liability rules for fraud, chargeback evidence for an authorized merchant dispute, or failed-transaction handling for a debit without successful service.
RBI, issuer and network materials checked on 31 July 2026. Dispute windows, reason codes and issuer channels can change.
