Spotted Card Fraud in India? Here Is Exactly What to Do in the First 30 Minutes

Your phone shows a transaction you did not make. That moment is not the time to call a family member or Google what happened. It is the time to move. Chanakya wrote in the Arthashastra that a loss identified at once is a loss half-recovered. He was describing a treasury, but the logic holds for your bank account.Before anything else, take a screenshot of the SMS or app notification. Note the exact time, the merchant name, and the transaction amount. This record becomes your evidence. Do not delete the message. Do not attempt to log in to a suspicious link that may have arrived alongside the alert.

Most Indian banks offer three ways to block a card immediately:1. The bank's mobile app, look for "Block Card" or "Hot-list Card" under card settings.2. The 24-hour customer care number printed on the back of your card.3. Net banking, most portals carry a card management section.Use whichever you can reach first. Speed matters more than method. Once the card is blocked, no further transaction can go through on that card number. If your bank's app is slow, call the helpline simultaneously from a second device. SBI's helpline is 1800-11-2211. HDFC Bank's is 1800-202-6161. ICICI Bank's is 1800-1080. Every major Indian bank publishes a toll-free number, keep it saved in your contacts before you ever need it.After blocking, change your net banking password and your UPI PIN from a device you trust. If the fraud came through a UPI app, deregister the compromised number from that app immediately.

A phone call to customer care is not enough. Banks require a written dispute to process a chargeback or refund. Send an email to your bank's official grievance address within the same day, ideally within the hour.The email must include: your account number, the card number (last four digits only), the transaction date and time, the merchant name or transaction ID, the amount, and a clear statement that the transaction was unauthorised. Attach the screenshot you took in step one.Ask for a written acknowledgement with a complaint reference number. Keep that number. Every follow-up call you make will require it.The RBI's limited liability framework is the rule that protects you here. Under this framework, if a fraudulent transaction happens through no fault of your own, a bank-side breach, a card skimmer, a phishing attack you did not click, and you report it within three working days, your liability is zero. The bank must reverse the amount. The window is three working days, not three calendar days, but do not wait. Report the same day.

Go to cybercrime.gov.in and file a complaint under "Financial Fraud." This is the Ministry of Home Affairs portal and it is the official channel for digital financial crime in India. You will need your transaction details, your bank complaint reference number, and a brief description of how the fraud occurred.This step does two things. It creates a formal record with law enforcement, which strengthens your case if the bank disputes your refund claim. It also feeds data to the National Cybercrime Reporting Portal, which tracks fraud patterns, skimmer locations, phishing domains, mule accounts, that investigators use to catch repeat offenders.If your bank does not resolve the dispute within 30 days, escalate to the RBI Integrated Ombudsman Scheme at cms.rbi.org.in. The Ombudsman has the authority to direct the bank to refund you. You do not need a lawyer. You do not pay a fee. You need your complaint reference number and the bank's written response, or proof that 30 days have passed without one.

Three things determine the outcome of your dispute.First, timing. The RBI's three-working-day window is a hard line. Report inside it, and the bank bears the liability. Report after seven working days, and the liability shifts to you. The days between three and seven sit in a grey zone where the bank and the RBI adjudicate case by case.Second, your own conduct. If you shared your OTP, your CVV, or your PIN with anyone, including someone who called claiming to be from your bank, the fraud is classified as a customer-negligence case. The bank's liability drops significantly. The RBI framework does not protect you from your own disclosure.Third, documentation. A dispute backed by a timestamped screenshot, a same-day email complaint, a cybercrime portal reference number, and a bank acknowledgement is a dispute that gets taken seriously. A verbal complaint remembered three days later is not.The refund process typically takes 10 to 45 working days once a dispute is accepted. During that period, the disputed amount may be provisionally credited to your account while the bank investigates.The 30-minute window is not about recovering money. It is about closing the door on further loss and building the paper trail that makes recovery possible. The bank's obligation to you is real, but it is conditional, on your speed, your documentation, and the accuracy of your report.