Credit card fraud how to recover money: legal steps

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Online fraud

Credit card fraud how to recover money is answered by three parallel tracks: the bank's liability and chargeback process, a criminal complaint, and a civil claim where a merchant or aggregator is responsible. The RBI's 2017 directions decide much of the bank's response. Speed, evidence and whether you were negligent decide how much comes back.

Credit card fraud how to recover money is not a single remedy. Recovery runs on three tracks at the same time: the bank's liability and chargeback process, the criminal complaint, and a civil claim where a merchant, payment aggregator or platform is responsible. Each track has its own evidence, its own forum and its own timeline, and a mistake on one track can weaken the others.

The bank track is usually the fastest. The RBI's 2017 directions on customer protection for unauthorised electronic transactions require the issuer to investigate and decide liability, and they distinguish between zero liability and limited liability. The criminal track is slower but creates the record that supports recovery and punishment. The civil track matters when the loss is not fully covered by the bank or when a merchant's negligence caused the fraud. The remedies rest on the IT Act 2000, the BNS 2023, the BNSS 2023, the BSA 2023 and the RBI's 2017 directions.

What the law says

The IT Act 2000 provides the computer-crime offences. Section 66 covers computer-related offences. Section 66C covers identity theft, which applies when a person dishonestly uses another person's electronic signature, password or other unique identification feature. Section 66D covers cheating by personation by using a computer resource. In a card fraud case, the fraudster typically uses the card number, CVV or OTP to impersonate the cardholder, so Sections 66C and 66D are commonly invoked.

The BNS 2023 provides the general criminal law. Section 318 deals with cheating and dishonestly inducing delivery of property. Section 316 deals with criminal breach of trust. Section 336 deals with forgery, and Section 351 with criminal intimidation. The police may register a card fraud complaint under the BNS provisions alone or together with the IT Act provisions, depending on how the fraud was carried out and what the investigation reveals.

The BNSS 2023 governs procedure. Section 173 requires the police to record information about a cognizable offence. Section 175(3) allows a magistrate to order an investigation in certain circumstances. Section 35 deals with arrest and its safeguards. Section 187 deals with remand. Sections 480, 482 and 528 deal with the powers of magistrates and higher courts at different stages. For a victim, the important point is that the police cannot simply refuse to record a written complaint without a lawful reason.

The BSA 2023 governs electronic evidence. Section 63 makes an electronic record admissible when the required certificate and conditions are met. A card statement downloaded from net banking, an SMS alert, an email from the merchant and a screenshot of the phishing page are all electronic records. The certificate requirement should be handled early, because banks and payment gateways may delete or archive logs after a period.

The RBI's 2017 directions are not criminal law, but they are the strongest lever for recovery from the bank. They require a reporting channel, acknowledgement, investigation and a liability decision. They also provide for provisional credit in certain cases. A bank that ignores the directions or decides liability without reasons gives the customer a clear ground for escalation to the RBI's grievance mechanism and, in an appropriate case, to a consumer forum or civil court.

Track one: bank liability and chargeback

The bank track starts with the card issuer. You must block the card and dispute each unauthorised transaction. The dispute is not the same as a police complaint, and the bank will not usually wait for the police investigation before deciding the chargeback. The bank's decision depends on its own records, the merchant's response and the customer's explanation.

Block the card and note the time. Use the app or helpline. A blocked card cannot be used for further transactions, and the blocking time is evidence of prompt action.
File a written dispute for each transaction. Ask for the dispute form and the ticket number. Give the transaction date, amount, merchant name and the reason you dispute it. Attach the statement and the 1930 acknowledgement.
Ask for provisional credit. Under the RBI's 2017 directions, provisional credit may be given within the stated period in a zero-liability case. Ask the bank in writing whether it has applied the directions and, if not, why.
Respond to the bank's investigation. The bank may ask for a written statement, a copy of the FIR and an explanation of how the card details were compromised. Reply within the deadline and keep proof of delivery.
Get the decision in writing. If the bank rejects the dispute, ask for the reasons and the evidence relied on. A decision without reasons is difficult to challenge and is itself a service deficiency.
Escalate. Use the bank's nodal officer and then the RBI's grievance mechanism. Keep the complaint numbers and the dates. A civil suit or consumer complaint can follow if the bank's decision is arbitrary.

Track two: the criminal complaint

The criminal track begins with 1930 and cybercrime.gov.in, and then with a police station. The national portal creates a record that the bank and the police can use. The police complaint should identify the transactions, the merchant or UPI ID, the phone numbers involved and the nature of the fraud. If the fraud was committed through a phishing link, the URL and the time of the click should be stated.

Under BNSS Section 173, the officer in charge must record the information. If the officer treats the matter as civil or refuses to register an FIR, the complainant can ask for the refusal in writing and move the magistrate under BNSS Section 175(3). The criminal case can lead to the identification of the beneficiary account and the freezing of funds. It can also produce a charge sheet that supports the bank's liability decision and any civil claim.

The criminal complaint is not a substitute for the bank dispute. A police investigation can take months, while the bank's chargeback timelines are shorter. The two tracks should be run together, with copies of each document shared between them. The FIR number should be given to the bank, and the bank's decision should be given to the investigating officer.

Track three: civil recovery

A civil claim becomes relevant when the bank's liability decision does not cover the full loss, when a merchant or payment aggregator failed to protect card data, or when a platform allowed a fraudulent merchant to operate. The claim may be for recovery of the amount, interest and costs. The evidence is the same electronic record, but the standard of proof and the forum are different from a criminal case.

A civil suit can also be used to obtain interim relief, such as an injunction or an order to preserve records. The limitation period and the correct forum depend on the facts, so the claim should be assessed before it is filed. A criminal complaint and a civil suit can proceed at the same time, but the pleadings must be consistent. A statement in one proceeding can be used in the other.

Comparing the tracks

Track	Forum	Main question	Speed
Bank liability	Card issuer and RBI grievance mechanism	Was the customer negligent?	Weeks to months
Criminal complaint	Police and magistrate	Who committed the offence?	Months to years
Civil recovery	Civil or consumer forum	Who is liable for the loss?	Months to years

The tracks can produce different results. The bank may refund the transaction while the police case continues. The police may identify the fraudster while the bank refuses liability. A civil court may award damages that the bank process does not cover. The victim should not assume that one outcome closes the others.

What decides how much comes back

The first factor is the timing of the report. The RBI's 2017 directions treat prompt reporting as central to zero liability. A report within three working days is strong. A report after the statement cycle or after several weeks is weak. The bank will look at when the customer first knew or ought to have known about the transaction.

The second factor is negligence. If the customer shared the OTP, wrote the PIN on the card, used the card on an insecure site or approved a remote-access app, the bank may apply limited liability. The question is not whether the customer was careless in general, but whether the customer's specific act enabled the unauthorised transaction. The bank's authentication logs are the key evidence.

The third factor is the strength of the merchant response. In a chargeback, the merchant can produce an order record, a delivery proof or a customer authorisation. If the merchant's record is weak, the chargeback is more likely to succeed. If the merchant shows that the cardholder authorised the purchase, the bank may reject the dispute.

The fourth factor is the quality of the police complaint. A complaint that names the beneficiary account, the UPI ID and the phone numbers gives the police a route to freeze funds. A vague complaint does not. The police can also request the bank's CCTV, call records and IP logs, which may not be available to the customer.

The fifth factor is the bank's compliance with the RBI directions. If the bank failed to acknowledge the complaint, failed to investigate within the timeline, or failed to give reasons, the customer can argue that the process itself was defective. That argument does not guarantee recovery, but it shifts the burden and supports an escalation.

A sixth factor is the recoverable asset. A civil decree is only as useful as the defendant's ability to pay. If the fraudster is untraceable or has no assets, the bank route and the criminal freeze are more practical. If a merchant or aggregator is a registered business, a civil claim may be enforceable. The victim should assess the asset position before spending on litigation.

Mistakes that reduce recovery

Reporting only to the police and not to the card issuer, or the reverse.
Missing the bank's dispute deadline while waiting for the FIR.
Accepting a verbal assurance that the amount will be reversed without a ticket number.
Deleting the phishing SMS or the call log before the bank reviews the dispute.
Signing a settlement with a merchant without checking whether the bank process is still open.
Filing a civil suit without first obtaining the bank's written decision.
Giving inconsistent accounts to the bank and the police.

When to involve a lawyer

A cardholder can usually manage the first stages without a lawyer. Legal help is useful when the bank rejects liability, when the amount is substantial, when the fraudster is identified and the criminal case needs to be monitored, or when a civil claim against a merchant or aggregator is being considered. A cyber crime lawyer in Kolkata can review the bank's decision, draft the escalation and coordinate the criminal complaint. If the loss is not fully recoverable through the bank, the civil litigation route can be assessed on the documents. The choice should follow the evidence and the bank's written reasons, not a promise of a particular result.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Can I recover money lost to credit card fraud?

Yes, recovery is possible through the bank's chargeback and liability process, and sometimes through a civil claim. The RBI's 2017 directions require the issuer to investigate and decide liability. Prompt reporting and a clean authentication record improve the chances. A police complaint supports the criminal case but does not by itself return the money.

What is the first step to recover credit card fraud money?

Block the card and report the unauthorised transaction to the issuer immediately. Ask for a dispute ticket number and a blocking reference. Then call 1930 and file a police complaint. The bank's timeline starts from the report, so the first call is the most important step.

Does the bank refund money if the OTP was shared?

Not automatically. Sharing an OTP is usually treated as negligence, and the bank may apply limited liability under the RBI's 2017 directions. The bank will examine whether the customer was tricked or careless. A phishing complaint with call records and screenshots can still support a dispute, but the outcome is not guaranteed.

How long does a credit card chargeback take?

A chargeback can take several weeks to a few months, depending on the card network, the merchant's response and whether the transaction is domestic or cross-border. The bank is expected to resolve the complaint within ninety days under the RBI's 2017 directions. Provisional credit may arrive earlier in a zero-liability case.

Can I file a civil suit and a police complaint together?

Yes, the two proceedings can run in parallel. The criminal complaint addresses the offence, while the civil suit seeks recovery from a liable party. The pleadings must be consistent, and the evidence should be shared carefully. A lawyer should assess the correct forum and limitation period before filing.

What evidence helps recover money after card fraud?

Keep the card statement, SMS and email alerts, the dispute form, the 1930 acknowledgement, the FIR copy and screenshots of any phishing page or chat. Preserve the device and email headers. For court, a BSA Section 63 certificate may be required for the electronic records.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact