Bank's duty to refund in credit card fraud cases
By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Online fraud
A bank must refund an unauthorised credit card transaction under the RBI directions of 6 July 2017 on limiting customer liability: the customer's liability is zero where the bank was at fault or the transaction was reported within three working days, and otherwise capped at a fixed amount depending on the account type.
A bank's duty to refund in a credit card fraud case is not a matter of goodwill; it is regulated. The RBI directions of 6 July 2017 on limiting customer liability in unauthorised electronic banking transactions set out exactly when the customer pays nothing and when the customer pays a limited amount. In short, if the bank's own systems failed, or if the fault lies elsewhere in the system and the customer reports promptly, the customer's liability is zero. If the customer was negligent or reported late, liability is limited by a cap that depends on the type of account.
The framework applies to credit cards as much as to bank accounts, and it says something specific about credit cards: after notification, the customer must not bear any additional burden of interest. Where a bank refuses or delays a refund, the complaint can go to the RBI Integrated Ombudsman Scheme or to a consumer commission under the Consumer Protection Act, 2019. The burden of proving that the customer is liable lies on the bank.
Where the duty comes from
The source is a set of RBI directions issued on 6 July 2017, published as circular DBR.No.Leg.BC.78/09.07.005/2017-18, which regulate how banks treat unauthorised electronic banking transactions. The directions distinguish two kinds of transaction: remote or online payments, which do not require the physical instrument to be presented, such as internet banking, mobile banking and card-not-present transactions; and face-to-face or proximity payments, where the card or phone must be present, such as ATM and point-of-sale transactions. Card fraud typically falls in the first group. The directions require banks to maintain robust fraud detection, to send transaction alerts, and to define a transparent, board-approved policy on customer liability and display it publicly.
Two other instruments sit alongside the RBI directions. Section 43A of the Information Technology Act, 2000 makes a body corporate liable to compensate a person where it fails to protect sensitive personal data that it handles, which can cover a bank's failure over card data. The Consumer Protection Act, 2019 treats a deficient service as an actionable wrong and provides a three-tier commission structure for redress.
Zero liability: when the customer pays nothing
Zero liability arises in two situations. First, where the unauthorised transaction results from contributory fraud, negligence or deficiency on the part of the bank — and in that case it makes no difference whether the customer reported the transaction at all. Second, where the deficiency lies neither with the bank nor with the customer but elsewhere in the system, and the customer notifies the bank within three working days of receiving the bank's communication about the unauthorised transaction. In the second situation the clock runs from the bank's message, not from the transaction itself, so a customer who reads and acts on an alert promptly is protected.
Zero liability is triggered by the bank's fault, or by prompt reporting where the fault lies elsewhere in the system. It is not a reward for complaining loudly.
Limited liability: the caps and the timeline
Where the customer was negligent — for example by sharing the card details, the PIN or the one-time password — the customer bears the entire loss until the transaction is reported to the bank, and the bank bears the loss after that. Where the fault lies elsewhere in the system but the customer reported later, the customer's liability per transaction is capped at the lower of the transaction value and the amount shown in the table below.
| Time taken to report from the bank's communication | Customer's liability |
|---|---|
| Within three working days | Zero |
| Within four to seven working days | The transaction value or the cap in the second table, whichever is lower |
| Beyond seven working days | As per the bank's board-approved policy |
The caps that apply in the four-to-seven-day window depend on the type of account.
| Type of account | Maximum customer liability |
|---|---|
| Basic savings bank deposit accounts | Five thousand rupees |
| Other savings accounts, prepaid instruments and gift cards, MSME current, cash credit and overdraft accounts, individual accounts with average balance or limit up to twenty-five lakh rupees, and credit cards with a limit up to five lakh rupees | Ten thousand rupees |
| Other current, cash credit and overdraft accounts, and credit cards with a limit above five lakh rupees | Twenty-five thousand rupees |
Working days are counted according to the working schedule of the customer's home branch, excluding the date on which the bank's communication was received.
The bank's own obligations, independent of liability
Even where some customer liability is established, the bank has duties that are not conditional on the outcome. On being notified, the bank must credit the amount involved to the customer's account within ten working days — a shadow reversal — without waiting for any insurance settlement, and the credit must be value-dated as of the date of the unauthorised transaction. The bank must resolve the complaint and determine the customer's liability within the period fixed in its board-approved policy, and in any event not later than ninety days from the receipt of the complaint; where it cannot resolve the matter within that period, it must pay the compensation due. In the case of a credit card, the customer must not bear an additional burden of interest on the disputed amount.
Burden of proof lies on the bank
The directions place the burden of proving customer liability squarely on the bank. In practice this means the bank must show, with its own records, that the customer shared the credentials, or that the customer was negligent, or that the report was late and that the fault lay elsewhere in the system. A bare assertion that the transaction was authenticated, without evidence of how the authentication was obtained, is not enough. This allocation matters because the customer usually has no access to the bank's internal logs, whereas the bank does. Where the bank cannot discharge the burden, the refund claim strengthens.
Credit cards: the interest point
A credit card differs from a bank account in a way that matters financially. In a debit-card or account fraud, the customer's grievance is that the money has already left. In a credit-card fraud, the disputed amount sits on a revolving balance and attracts interest until it is reversed, so the delay itself becomes a loss. The directions address this directly: after notification, the customer must not suffer loss of interest in a debit-card or account case, and must not bear any additional interest burden in a credit-card case. A customer who is charged interest on a disputed amount that has since been reversed has a further grievance, and it should be raised in the same complaint.
Step by step: forcing the refund
- Report to the bank immediately, in writing. Use the bank's app, email and customer-care number, and keep the complaint reference. A phone call alone is not enough.
- Block the card and change the credentials. Stopping further loss is part of the customer's duty and removes an objection.
- Note the date of the bank's communication. The three-working-day and four-to-seven-working-day windows run from that date, so preserve the alert or email.
- File the cyber crime complaint. Report the fraud on the national cyber crime portal or on the 1930 helpline, and keep the acknowledgement. The complaint helps the investigation and supports the refund claim.
- Escalate in writing to the nodal officer. If the bank does not reverse within ten working days, write to its principal nodal officer and demand the value-dated credit.
- If the refusal stands, escalate outside the bank. Take the matter to the RBI Integrated Ombudsman Scheme, which is free of cost, or file a consumer complaint under the Consumer Protection Act, 2019.
What decides the outcome
- Whether the bank or the system failed. Contributory fraud or a deficiency on the bank's side gives the customer zero liability.
- How quickly the transaction was reported. Reporting within the bank's window keeps liability low or nil.
- Whether the customer shared credentials. Negligence shifts the loss onto the customer until the transaction is reported.
- Whether the bank can prove its case. The burden is on the bank, and weak records favour the customer.
- Whether the directions were followed on timelines. Failure to reverse within ten working days or to resolve within ninety days strengthens the complaint.
Bank terms cannot override the directions
A common objection from customers is that the bank's card terms and conditions say something different, or that the cardholder agreement shifts all unauthorised-use liability to the customer. Such a clause does not displace the RBI directions. The directions require each bank to frame a customer relations policy, with board approval, covering the rights and obligations of customers in unauthorised transaction scenarios, and that policy must be transparent and non-discriminatory. It must be displayed on the bank's website along with the grievance-handling and escalation procedure, and the RBI instructions must be incorporated into it. A bank that relies on a hidden or one-sided clause, or on a policy it has not published, is not applying the framework correctly, and that failure is itself something the customer can raise in a complaint.
The directions also require banks to inform existing customers individually about the liability policy, and to advise them to notify the bank of any unauthorised transaction at the earliest, warning that the longer the delay the greater the risk of loss. Where a bank has not sent transaction alerts, which the directions require, that failure affects the bank's own position rather than the customer's.
The Ombudsman route in practice
The RBI Integrated Ombudsman Scheme gives a cardholder a free, out-of-court route against a bank's deficiency in service, and it is designed to be used after the bank has had a chance to respond. A complaint is filed online, with the bank's complaint reference, the account or card details, and a short statement of what the bank was asked to do and what it actually did. The Ombudsman can direct the bank to refund the amount and, where appropriate, pay compensation for the deficiency and the inconvenience caused. The complaint must be brought within the time limit prescribed by the Scheme, and the Ombudsman will not entertain a matter already pending before or decided by a court or a consumer commission on the same facts.
Common mistakes
- Reporting only by phone. Without a written complaint and a reference number, proving the reporting date becomes hard.
- Waiting for the police case. The refund does not depend on the criminal outcome; the RBI clock runs independently.
- Deleting the alert messages. They establish the date from which the reporting windows run.
- Accepting a partial reversal without asking why. A cap applies only in defined situations, and a customer wrongly charged under a cap should challenge it.
- Ignoring the interest on a credit card. The additional interest burden should be raised in the same complaint.
When to involve a lawyer
The refund framework is weighted in the customer's favour, but banks do not always apply it correctly, and the escalation routes have their own procedure and time limits. Where a reversal is refused on a claim of customer negligence, where the amount is large, or where the bank alleges that the credentials were shared, advice on how to present the bank's own records and the timeline can make the difference between a refusal and a refund. For assistance in Kolkata and West Bengal, see our cyber law practice or reach us through contact.
Need help with a cyber crime matter?
Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.
Call +91-9007000603 WhatsAppFrequently asked questions
Is the bank liable to refund money lost to credit card fraud?
Yes, in defined situations. Under the RBI directions of 6 July 2017 on limiting customer liability, the customer's liability is zero where the unauthorised transaction results from the bank's own contributory fraud, negligence or deficiency, or where the fault lies elsewhere in the system and the customer reports within three working days of the bank's communication. Outside those situations the customer's liability is capped, not unlimited.
How long does the bank have to reverse an unauthorised transaction?
The RBI directions require the bank, once notified, to credit the amount to the customer's account within ten working days as a shadow reversal, without waiting for any insurance settlement. The credit must be value-dated as of the date of the unauthorised transaction. The complaint itself must be resolved and the customer's liability determined within the period in the bank's board-approved policy and in any event within ninety days.
What if I shared my OTP or PIN and then money was taken?
If the loss is due to your own negligence, such as sharing the payment credentials, you bear the entire loss until you report the unauthorised transaction to the bank. Every loss occurring after you report it is borne by the bank. This is the position under the RBI directions, and it is why reporting immediately matters even where you think the fault was your own.
What is the maximum amount I can lose in a card fraud case?
Where the fault lies elsewhere in the system and you report within four to seven working days, your liability is capped at five thousand rupees for basic savings accounts, ten thousand for most savings accounts and cards up to a five lakh rupee limit, and twenty-five thousand for other current and overdraft accounts or higher-limit cards, whichever is lower.
Who has to prove that I was negligent in a card fraud case?
The bank does. The RBI directions place the burden of proving customer liability in an unauthorised electronic banking transaction on the bank. In practice the bank must show from its records that you shared the credentials, were negligent, or reported late, and that the fault lay elsewhere in the system. A bare claim that the transaction was authenticated is not enough without evidence of how authentication was obtained.
Does a credit card fraud refund cover the interest charged on the disputed amount?
Yes. The RBI directions provide that after notification the customer must not suffer loss of interest in a debit-card or account case, and must not bear any additional burden of interest in a credit-card case. A credit-card fraud often sits on a revolving balance and attracts interest until reversed, so any interest charged on the disputed amount after you report it should be reversed along with the principal.
Where can I complain if the bank refuses to refund?
Escalate first to the bank's principal nodal officer in writing. If the refusal stands, you can go to the RBI Integrated Ombudsman Scheme, which is free of cost, or file a consumer complaint under the Consumer Protection Act, 2019, where a refusal or delay in reversing an authorised debit is treated as a deficiency in service. The cyber crime complaint on the national portal supports the same claim.
Does the refund depend on the outcome of the police case?
No. The refund obligation under the RBI directions runs independently of the criminal investigation. The bank cannot make a reversal conditional on the police case being solved or on an FIR being filed. Delaying the refund because the investigation is ongoing is not a valid reason under the directions, although a bank may follow its own board-approved policy and timelines for determining liability.
Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.
Related articles
Cyber crime lawyer in your city · Bank account freeze help · Contact