You open your statement or get an SMS alert, and there it is: a charge you never made. A subscription you never signed up for, a withdrawal from a city you've never visited, or a swipe at a merchant you don't recognise. The panic is real, but here's the good news most cardholders don't know: the Reserve Bank of India (RBI) has a clear customer-protection framework that can leave you with zero liability if you act quickly.
This guide walks you through exactly how to dispute an unauthorised credit card transaction in India in 2026 — the RBI limited-liability rule, the timelines your bank is bound to honour, the difference between a fraud dispute and a chargeback, and the precise steps to get your money back.
The RBI rule that decides how much you pay
The cornerstone of your protection is RBI's 2017 framework on limiting customer liability in unauthorised electronic banking transactions. The single most important factor it hinges on is how fast you report the fraud after the bank communicates the transaction to you (via SMS, email or app alert).
The principle is simple. If the fraud happened because of the bank's own negligence — a system breach, a deficiency on their side — you bear nothing, regardless of when you report. If the fault lies with a third party (a skimmer, a phishing scam) and neither you nor the bank was at fault, your liability depends entirely on the speed of your report.
Liability tiers by reporting delay
Working days exclude Sundays and bank holidays, and the clock starts from when you receive the communication about the transaction — not from when the fraud occurred.
| When you report | Your liability |
|---|---|
| Bank's negligence (any time) | Zero — bank bears full amount |
| Within 3 working days | Zero liability |
| Within about 4 to 7 working days | Limited — a capped amount set by RBI based on your account/card type |
| Beyond 7 working days | As per your bank's board-approved policy |
The takeaway is blunt: report within 3 working days and you owe nothing. The capped "limited liability" tier for 4–7 working days depends on the type of instrument, but reporting on day one removes the question entirely. Delay past seven days and you surrender your statutory protection to whatever your bank's internal policy allows — a far weaker position.
The timelines your bank must follow once you report
Reporting is not the end — it triggers obligations on the bank's side that are also time-bound. Once you flag an unauthorised transaction, two RBI-mandated deadlines kick in.
The 10-working-day shadow reversal
The bank must credit the disputed amount back into your account within 10 working days of you reporting it. This is called a shadow reversal or provisional credit — your money is restored while the investigation runs, so you are not left out of pocket during the process. Crucially, this credit is not contingent on filing a police complaint.
The 90-day resolution
The bank must investigate and resolve the complaint, typically within 90 days of receiving it. If the investigation confirms the transaction was unauthorised and you reported within the protected window, the provisional credit becomes permanent. If the bank cannot complete the resolution, your liability cannot exceed what the RBI tiers above prescribe.
Fraud dispute vs chargeback — which one applies to you
People often use these terms interchangeably, but they are two distinct mechanisms with different triggers. Picking the right one matters.
A fraud dispute under the RBI framework applies when a transaction was genuinely unauthorised — you didn't make it and didn't authorise it. This is the path that unlocks the zero/limited-liability protection above.
A chargeback is a separate dispute mechanism run through the card network (Visa, Mastercard or RuPay). It is used mainly for non-fraud merchant disputes — where you did make the payment, but something went wrong with the transaction itself.
| Situation | Use this |
|---|---|
| Charge you never made / card cloned / stolen card used | Fraud dispute (RBI liability rules) |
| Goods or services never delivered | Chargeback |
| Charged twice (duplicate transaction) | Chargeback |
| Wrong amount charged | Chargeback |
| Cancelled order, refund not received | Chargeback |
In practice you raise both through your bank — it routes the complaint correctly. But knowing which is which helps you frame your report accurately and reference the right protection.
The exact step-by-step to dispute and recover
Speed and a paper trail are your two weapons. Follow these in order.
Step 1 — Block the card immediately
If the transaction is fraud, block or freeze the card right away — through your bank's mobile app, net banking, or 24x7 helpline. This stops further damage and is itself evidence that you acted promptly. Most banks let you block the card and order a replacement in under a minute on the app.
Step 2 — Report to the bank in writing, and note the time
A phone call alone is fragile. Send a written report — email to the bank's grievance address, a complaint through the app, or a letter — clearly stating the disputed amount, date and transaction reference. Record the exact date and time you reported, because the RBI clock that decides your liability runs from this moment. Keep the acknowledgement or complaint number.
Step 3 — File a formal dispute or chargeback
Ask the bank to register a formal dispute. For a fraud transaction, cite the RBI unauthorised-transaction framework and request the shadow reversal within 10 working days. For a merchant issue, request a chargeback through the card network. Confirm in writing what you've filed.
Step 4 — Keep every piece of evidence
Preserve SMS and email alerts, your statement, screenshots, any merchant correspondence, and the complaint reference. If it is a serious fraud, file a police complaint or report on the National Cyber Crime Reporting Portal (1930) — useful supporting evidence, though not a precondition for the bank to refund you.
Step 5 — Escalate if unresolved
If the bank does not resolve the matter within 30 days, or resolves it unsatisfactorily, escalate to the RBI Ombudsman under the Reserve Bank's Integrated Ombudsman Scheme. The Ombudsman service is free, and you can file online. Attach your full paper trail — the complaint number, dates, and the bank's response (or lack of one).
How to protect yourself before fraud ever happens
The framework only helps if you notice the fraud fast. Build habits that make early detection automatic:
- Keep transaction alerts on for every payment, however small. The 3-working-day clock starts when you're notified — so notifications are your first line of defence.
- Register an updated mobile number and email with your bank so alerts actually reach you.
- Set sensible spending and international-usage limits on your card, and disable channels you don't use (such as overseas or contactless) through the app.
- Never share your card number, CVV, expiry or OTP — no genuine bank or RBI official will ever ask for them.
- Review your statement line by line every cycle, and check small "test" charges fraudsters use to validate a stolen card.
If you're shopping for a card with strong fraud controls and instant in-app card management, compare options on our credit cards page. For related protections, see how cash-withdrawal charges work, and explore your everyday-money tools on the banking hub.
Frequently Asked Questions
What if I report the fraud within 3 working days?
Under RBI's framework you have zero liability — the bank bears the full disputed amount. The working-day clock starts from when the bank communicated the transaction to you, not when the fraud occurred.
How long does the bank take to refund the money?
The bank must shadow-reverse (provisionally credit) the disputed amount into your account within 10 working days of you reporting it, and resolve the complaint typically within 90 days. The provisional credit ensures you are not out of pocket during the investigation.
What is the difference between a fraud dispute and a chargeback?
A fraud dispute is for transactions you never authorised and unlocks RBI's liability protection. A chargeback runs through the card network (Visa/Mastercard/RuPay) and is used for non-fraud merchant issues like undelivered goods, duplicate charges, wrong amounts, or refunds not received.
Do I need to file a police complaint to get a refund?
No. The bank's obligation to provisionally credit your account within 10 working days does not depend on a police complaint. For serious fraud, a police report or a complaint on the cyber-crime portal (1930) is useful supporting evidence, but it is not a precondition for the refund.
What happens if I report after 7 working days?
If you report beyond seven working days, your liability is determined by your bank's board-approved policy rather than RBI's protective tiers. This is a much weaker position, which is why reporting on day one matters so much.
What if my bank refuses to refund or ignores the complaint?
If the bank does not resolve the matter within 30 days or does so unsatisfactorily, escalate to the RBI Ombudsman under the Integrated Ombudsman Scheme. The service is free, can be filed online, and you should attach your complaint number, dates and the bank's response.
The bottom line: an unauthorised charge is recoverable, but the law rewards speed. Keep your alerts on, report any suspicious transaction to your bank in writing within 3 working days, note the exact time you reported, and hold the bank to its 10-working-day reversal — and if it stalls, the RBI Ombudsman is your free backstop to get your money back.
EMI Calculator
Calculate your credit card EMI conversion
- Convert large purchases into easy EMIs
- Compare tenure options (3, 6, 9, 12 months)
- See total interest you'll pay upfront