Disputing a fraudulent transaction: the exact process and bank timelines

Disputing a fraudulent transaction: the exact process and bank timelines

Published: 19 October 2026

Category: how-to-guides | cardbuzz

You get an SMS for a ₹48,000 transaction you never made. Your stomach drops. What you do in the next few hours determines how much of that money you get back — and how fast. This is the exact process, in order, with the timelines that actually apply in India.

The first 30 minutes: contain the damage

1. Block the card immediately. Use your bank's app — every major Indian issuer now offers instant card blocking — or call customer care. Do not wait to "check whether it was really fraud." A blocked card stops further misuse; you can always unblock or get a replacement later.

2. Note the exact time and details. Screenshot the SMS/email alert showing the transaction amount, merchant, time, and the last four digits of the card. This timestamp matters because RBI's liability framework keys off how quickly you report.

3. Do not share OTPs with anyone who calls "from the bank." A common follow-up scam: after the fraud, someone calls claiming to be bank staff "helping reverse" the transaction and asks for an OTP. Banks never ask for OTPs. Anyone who does is part of the fraud.

The first 3 working days: report and file

This window is the most financially consequential 72 hours in the process. Under RBI's Customer Protection circular of 6 July 2017:

• Report within 3 working days of receiving the bank's communication about the transaction, and your liability for a third-party breach is zero — regardless of the amount.
• Report on days 4–7, and your liability is capped: ₹5,000 for basic savings accounts, ₹10,000 for credit cards with a limit up to ₹5 lakh, ₹25,000 for cards with higher limits (or the transaction value, whichever is lower).
• Report after 7 working days, and liability is decided by the bank's own board-approved policy — the worst position to be in.

"Working days" are counted per your home branch's schedule, excluding the day you received the bank's message. Report through a channel that creates a record: the app's dispute flow, an email to customer care, or a call followed by a written complaint referencing the call. Get a complaint/reference number — without one, you cannot track or escalate.

If the loss was your own negligence (you shared your OTP or PIN), the rules are harsher: you bear the full loss until you report. Reporting still matters — after you report, the bank bears subsequent loss — so report immediately anyway.

What the bank must do: the timelines

Once you report, the bank's obligations under the RBI framework are specific:

The 10-working-day provisional credit is the one banks most often miss. If day 10 passes without the credit, write to the bank's nodal/grievance officer citing the RBI circular — that letter alone often unblocks it.

Filing the formal dispute

After the initial fraud report, file a formal transaction dispute:

1. Describe precisely what happened: you did not authorize the transaction, you did not share credentials, the card was in your possession (or when you noticed it missing).
2. Attach evidence: the alert screenshot, your complaint reference number, a copy of any FIR (some banks request one for large amounts — filing an FIR at your local police station or on the cybercrime portal cybercrime.gov.in strengthens the file, and is mandatory for large fraud claims with some issuers).
3. State the remedy you want: reversal of the transaction plus reversal of any interest/fees charged on the fraudulent amount.

Keep paying at least the minimum due on the rest of your bill during the dispute. The fraudulent amount is under investigation, but the remainder of your statement is still due — a missed payment now would add a CIBIL black mark to your fraud trauma.

If the bank denies your claim

Banks sometimes reject fraud disputes claiming the transaction was "authenticated" (OTP-verified). If you genuinely did not share the OTP, push back:

• Ask for the transaction logs — IP address, device details, merchant details. SIM-swap fraud and OTP interception leave traces.
• Escalate to the grievance redressal officer, then the principal nodal officer — banks must publish these contacts.
• After 30 days without satisfactory resolution, file with the RBI Integrated Ombudsman at cms.rbi.org.in. The Ombudsman can award up to ₹20 lakh for the direct loss plus up to ₹1 lakh for mental agony and harassment. The process is free.
• For large or complex frauds, a complaint on the National Cybercrime Reporting Portal (cybercrime.gov.in) or helpline 1930 creates an official record that strengthens every other channel.

Prevention checklist (after the dust settles)

• Enable transaction alerts for every transaction, not just large ones.
• Set card usage limits in the app (domestic/international, online/offline, ATM) — most Indian banking apps now allow per-channel toggles.
• Never save card details on merchant sites you use rarely; use tokenized or virtual cards where offered.
• Review your statement monthly. Fraud discovered in month four is still disputable within the 120-day network window, but your RBI zero-liability protection is long gone.

Bottom line

Block the card, report within 3 working days for zero liability, get your complaint number, expect provisional credit within 10 working days and resolution within 90 days — with the burden of proof on the bank. If the bank stalls or denies, escalate through its grievance officers to the RBI Ombudsman, and file on cybercrime.gov.in for the official record.

Sources: RBI circular "Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions," 6 July 2017; Business Standard chargeback timeline guide (Jan 2026); RBI Integrated Ombudsman Scheme 2021; National Cybercrime Reporting Portal (cybercrime.gov.in), helpline 1930.