Credit card fraud complaint process: steps and timeline

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Online fraud

A credit card fraud complaint process in India begins with two urgent actions, not with a legal office. Block the card through your issuer's app or helpline, then report the unauthorised transaction and record a complaint number. The legal framework that follows rests on the IT Act 2000, the BNS 2023, the BNSS 2023, the BSA 2023 and the RBI's 2017 directions on customer liability for unauthorised electronic transactions.

Speed matters because liability is not automatic. The RBI's 2017 directions separate zero liability from limited liability and give the bank a defined period to investigate. A cardholder who reports within three working days, keeps the card safe and has not shared the PIN or OTP is treated differently from one who waits weeks. The complaint is therefore evidence work as much as it is a police process, and the quality of the first report often shapes the final result.

What the law says

The IT Act 2000 supplies the computer-crime provisions. Section 66 covers computer-related offences. Section 66C covers identity theft, which applies when someone uses your card details, name or authentication credentials. Section 66D covers cheating by personation by using a computer resource. Where the fraud involves a phishing link or a fake payment page, these provisions are usually the starting point for the police.

The BNS 2023 supplies the general criminal offences. Section 318 deals with cheating, including dishonestly inducing delivery of property. Section 316 deals with criminal breach of trust where property is dishonestly misappropriated. Section 336 deals with forgery, and Section 351 with criminal intimidation where threats follow the fraud. A single card fraud complaint can therefore combine an IT Act offence with one or more BNS offences, and the police may register the case under both statutes.

Procedure comes from the BNSS 2023. Section 173 governs the recording of an FIR. Section 175(3) allows a preliminary enquiry in certain cases before registration. Section 35 deals with arrest and the safeguards around it. Section 187 deals with remand and the limits on detention. Sections 480, 482 and 528 deal with the magistrate's and the higher court's powers at different stages. For the complainant, the practical entry point is Section 173.

Evidence comes from the BSA 2023. Section 63 makes electronic records admissible when the statutory certificate and conditions are satisfied. Card statements, SMS alerts, email headers, screenshots and payment-gateway logs are all electronic records. The certificate is not a technicality; it is the bridge between your phone and the court record, and a missing certificate can delay or defeat the proof of a document that everyone knows exists.

The RBI's 2017 directions are the customer-protection layer. They require the bank to provide a channel for reporting, to acknowledge the complaint, to investigate, and to decide liability based on whether the customer was negligent. They also set out when provisional credit should be given. These directions bind the bank even though they are not criminal law, and a bank's failure to follow them is itself a ground for escalation.

How card fraud usually happens

The common methods are card-not-present fraud, skimming at a terminal, phishing calls that ask for the OTP, and the misuse of saved card details on a compromised merchant site. In a card-not-present case, the fraudster has the number, expiry and CVV but not the physical card. In a skimming case, the card data is copied at a terminal and later used online or abroad. In a phishing case, the customer is persuaded to approve a transaction or read out an OTP.

Each method leaves a different trail. A card-not-present transaction leaves an IP address, device fingerprint and merchant order record. A skimming case leaves terminal data and often a cluster of complaints against the same merchant. A phishing case leaves call records, SMS messages, a fake URL and a payment-gateway reference. The complaint should identify which pattern fits, because the bank's dispute team and the police investigate different records.

Step-by-step credit card fraud complaint process

1. Block the card immediately. Use the issuer's app, net-banking portal or 24-hour helpline. Ask for a blocking reference number and note the exact time. Do not wait to finish the police complaint first, because the card remains usable until it is blocked.
2. Report each transaction to the issuer. Dispute every unauthorised debit separately. Ask for the dispute or chargeback form, the ticket number and the email address where documents should be sent. Keep the ticket number in writing.
3. Call 1930 and use cybercrime.gov.in. The national cyber-crime helpline and portal create a written trail. Save the acknowledgement number and the PDF receipt. If the fraud involved a phishing link or a fake app, mention the URL and the app name.
4. Write to the bank's nodal officer. A short email with the last four digits of the card, the transaction dates, amounts, merchant names, the dispute number and the 1930 acknowledgement is enough. Keep the language factual and attach the documents.
5. File an FIR or a police complaint. Go to the police station with jurisdiction or use the online complaint system. Under BNSS Section 173 the officer must record the information. If the officer refuses, ask for the refusal in writing and approach the magistrate under BNSS Section 175(3).
6. Preserve the evidence. Download statements, keep the SMS and email alerts, screenshot the phishing page and the chat, and preserve the email headers. Do not delete anything. Prepare a BSA Section 63 certificate when the electronic record is to be produced in court.
7. Follow the chargeback and the investigation. Reply to the bank's queries within the deadline. If the bank rejects the dispute, ask for the reasons in writing and escalate under the RBI's grievance mechanism. Keep the police informed of the bank's decision.
8. Keep one timeline sheet. Record every call, email, ticket number, date and person spoken to. This sheet becomes the spine of any later consumer or criminal proceeding and prevents the complaint from becoming a set of disconnected screenshots.

Documents and timeline table

The RBI's 2017 directions expect a cardholder to report within three working days for zero liability. The bank is expected to resolve the complaint within ninety days. Those are outer timelines, not guarantees, and the bank may ask for more information. The criminal process runs on a different clock, and an FIR does not pause the bank's chargeback process.

A practical timeline looks like this. The card is blocked on day zero. The dispute is filed within twenty-four to forty-eight hours. The 1930 report and the police complaint follow within the same week. The bank's provisional credit decision may come within ten working days in a zero-liability case. The final decision can take longer if the merchant or the acquirer disputes the chargeback.

What decides the outcome

The first factor is the speed of reporting. A report made within hours supports the argument that the card was lost or the details were stolen without the holder's knowledge. A report made after several weeks invites the bank to argue that the customer delayed and therefore accepted the transaction. The timestamp on the first call is often the single most important fact.

The second factor is negligence. Sharing an OTP, writing the PIN on the card, handing the card to a stranger, or approving a remote-access app weakens the zero-liability claim. The RBI directions distinguish between a third-party breach where the customer is not negligent and a case where the customer's own act enabled the fraud. The bank will look at the authentication logs, not only at the customer's statement.

The third factor is the quality of the evidence. A bank can see the IP address, device fingerprint and merchant data. If your complaint matches those records, the dispute is stronger. If the transaction was authenticated with your OTP and your device, the bank will ask hard questions. A clear explanation of how the OTP was obtained is essential in a phishing case.

The fourth factor is whether the merchant or payment aggregator cooperated. Cross-border transactions are slower because the chargeback rules and the merchant's jurisdiction differ. Domestic transactions usually move faster because the issuer, acquirer and merchant are within the same regulatory system. The bank's ability to raise a chargeback within the card network's time limit also matters.

The fifth factor is the police investigation. A well-documented FIR with account numbers, UPI IDs, phone numbers and screenshots gives the investigating officer something to work with. A one-line complaint does not. The police can request the bank's records and the merchant's records, and that request is stronger when the complaint identifies the exact transactions and the suspected channel.

The sixth factor is consistency. The account of events given to the bank, the 1930 portal and the police should match on the essentials: the time, the device, the caller, the link and the transactions. Small differences are normal in a stressful situation, but a changing story gives the bank and the defence an easy point. Write a short chronology once, check it against the documents and use it for every complaint.

Common mistakes to avoid

• Waiting for the bank to reverse the transaction automatically before filing a police complaint.
• Deleting SMS alerts or clearing the browser history that shows the phishing page.
• Confronting the fraudster on chat or call and warning them to delete evidence.
• Sharing the OTP, CVV or card number again with anyone who calls claiming to be from the bank.
• Filing only a bank complaint and treating it as a police complaint.
• Not asking for written acknowledgement at each stage.
• Approving a reversal link sent by the fraudster, which is usually a second fraud.

When to involve a lawyer

Most straightforward card disputes can be handled by the cardholder with the bank and the 1930 portal. A lawyer becomes useful when the bank rejects liability on negligence grounds, when the amount is large, when the fraudster has been identified and the police need to be pushed, or when a chargeback decision must be challenged. A cyber crime lawyer in Kolkata can review the bank's reasoning, draft the escalation and coordinate the criminal complaint. For matters that also involve a civil claim against a merchant or an aggregator, the civil litigation route may be considered alongside the criminal process. The decision should be based on the documents and the bank's written reasons, not on urgency alone.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Net banking fraud complaint process: steps and timeline
• Matrimonial Fraud Complaint: Process, Documents, Timeline
• Instant loan app fraud complaint: step-by-step process
• Credit card fraud how to recover money: legal steps
• UPI Fraud Complaint Process in India: Steps and Timeline
• Credit Card Fraud: What It Is and How It Works

Cyber crime lawyer in your city · Bank account freeze help · Contact