Time limit to file a credit card fraud complaint

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Cyber law

There is no single deadline to file a credit card fraud complaint, because three separate clocks run. Report to the card issuer within three working days of its communication to keep zero liability. Report between four and seven working days and your liability is capped at a fixed figure. Reporting later does not end the case, but it shifts the loss onto you.

People who have just been defrauded ask one question first: how long do I have? The honest answer is that Indian law does not set a single time limit for reporting credit card fraud. Three different clocks run at the same time, and each of them has a different consequence if it runs out. Missing one does not automatically kill your claim, but it moves money from the bank's side of the ledger to yours.

The clocks have different sources. The two reporting clocks come from the Reserve Bank of India directions on limiting customer liability in unauthorised electronic banking transactions, circular DBR.No.Leg.BC.78/09.07.005/2017-18 dated 6 July 2017. The third clock is a limitation period for prosecution, under section 514 of the Bharatiya Nagarik Suraksha Sanhita, 2023, which is the successor to the old section 468 of the Code of Criminal Procedure. Confusing the three is the single most expensive mistake a victim can make.

The three clocks at a glance

Clock	Time limit	What it governs	Consequence of missing it
Bank report, first band	Within 3 working days of the bank's communication	Your liability to the issuer	Zero liability no longer automatic
Bank report, second band	Within 4 to 7 working days	Your liability to the issuer	Liability capped at a fixed amount, not zero
Bank report, beyond the bands	Beyond 7 working days	Your liability to the issuer	Liability decided by the bank's board-approved policy
Bank reversal	10 working days from your notification	The bank's duty to reverse	Grounds for a banking ombudsman complaint
Bank resolution	Not exceeding 90 days from the complaint	The bank's duty to decide	Compensation still payable
Prosecution limitation	Up to 3 years, depending on punishment	The court's power to take cognizance	No case can be instituted at all

The bank clock: three working days and seven working days

The liability framework divides how the loss is shared between you and the issuer by reference to how quickly you told the issuer about the unauthorised transaction. Where the deficiency lies neither with the bank nor with you, but somewhere in the system, the position is this. If you notify the bank within three working days of receiving its communication about the transaction, you are entitled to zero liability. If you notify between four and seven working days, your per-transaction liability is limited to whichever is lower, the transaction value or the ceiling in the framework's table. Notify after seven working days and your liability is decided by the bank's own board-approved policy, which is required to be published and to have been disclosed to you.

Two details are missed constantly. First, the clock begins when the bank communicates the transaction to you, not when you first discover it, and not when the statement arrives. If you never received the alert because you did not register for one, or your number changed and was not updated, that gap is itself part of the dispute. Second, the working days are counted on the working schedule of your home branch, excluding the day you received the communication. A Sunday or a bank holiday in between does not consume the count.

There is a separate rule for genuine negligence, and it is harsher. Where the loss results from your own negligence, such as sharing payment credentials, you bear the entire loss until you report the unauthorised transaction. Every rupee lost after you report it is the bank's responsibility. Reporting therefore has an effect even in a case where the initial fault is yours: it stops the bleeding at that moment.

The reversal clock: ten days and ninety days

Once you notify the issuer, a second clock starts running against the bank rather than against you. The bank must credit the disputed amount to your account, by what the framework calls a shadow reversal, within ten working days of your notification. This is not conditional on an insurance claim being settled, and the credit must be value dated as of the date of the unauthorised transaction, so that you do not lose interest for the interval. For a credit card, the framework requires that you do not bear any additional interest burden.

The bank must also resolve the complaint and establish liability within a period fixed in its board-approved policy, and in any event not exceeding ninety days from the date it received the complaint. If it cannot resolve the complaint or decide liability within that period, it must still pay you compensation as the framework prescribes. Both of these are enforceable through the banking ombudsman rather than through a court, and the ombudsman route normally opens only after the bank has had its chance.

The police clock: is there a deadline to report an FIR?

On the criminal side there is no fixed deadline for a victim to go to the police, and no rule that a late report is invalid. Delay is evidence, not a bar. An investigating officer may ask why you waited, and a court may weigh the delay in deciding whether the prosecution's version is credible, but a first information report registered a month after the fraud is not void for that reason alone.

What the law does say is that information about a cognizable offence may be given to the officer in charge of any police station, regardless of where the offence occurred. Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 carries that rule. Two practical timings follow from it. If you give the information by electronic communication, it must be signed by you within the period the provision allows for it to be taken on record, so do not send an e-complaint and then leave it unsigned. And if the police officer decides that the information does not disclose a cognizable offence, that officer is required to record the reasons in writing, which is the document you will later need if you ask a magistrate to direct an investigation.

For credit card fraud there is a useful, hard-edged point. The offences usually invoked carry punishments that are not trivial. Cheating under section 318 of the Bharatiya Nyaya Sanhita, 2023 is punishable with imprisonment extending to three years, and where cheating dishonestly induces delivery of property, under section 318(4), the punishment extends to seven years. Identity theft under section 66C of the Information Technology Act, 2000 and cheating by personation using a computer resource under section 66D each carry imprisonment extending to three years. Those maximums decide which limitation band applies.

The prosecution clock: limitation under section 514

This is the clock that surprises people, and it runs against the State, not against you. Section 514 of the Bharatiya Nagarik Suraksha Sanhita, 2023 bars a court from taking cognizance of certain offences after a period of limitation has expired. The periods are six months where the offence is punishable with fine only, one year where it is punishable with imprisonment up to one year, and three years where it is punishable with imprisonment of more than one year but up to three years.

Read that against the offences above and the structure becomes clear. An offence punishable with up to three years, which is where sections 66C and 66D of the Information Technology Act sit, falls in the three-year band. An offence punishable with seven years, which is where cheating under section 318(4) of the Bharatiya Nyaya Sanhita sits, is outside the limitation bar altogether, because section 514 applies only to the categories it lists. The section also fixes the relevant date for computing the period: the date of filing a complaint before a magistrate, or the date on which the information was recorded under section 173. It notes the date the complaint is filed, not the date of the fraud. That distinction gives a late victim more room than most people assume, but only up to the outer limit.

If you are already past one of the clocks

Late is not the same as lost, and the response is different for each clock. If you are past three working days but within seven, report at once, because the difference between the two bands is the difference between bearing the transaction value and bearing a capped amount. If you are past seven, report anyway: the bank's board policy still governs and many policies allow a discretionary waiver of customer liability. Reporting after the outer window costs you nothing and preserves the argument.

On the criminal side, if the police refuse to register your complaint, the remedies are an escalation to the superintendent of police, a written request for the reasons, and ultimately an application to a magistrate. Because the limitation clock under section 514 starts from the date of filing or recording, delay in getting the FIR registered does not necessarily shorten the time available for prosecution, but it does make the evidence harder to get, especially the transaction logs and the call records, which service providers and networks retain for their own finite periods.

What the law does not settle

Three points should be stated plainly rather than glossed over. The first is that the working-day computation in a case where the alert was sent to a phone number that was no longer active is not resolved by the framework's text, and banks and adjudicators differ. The second is the treatment of cases where the customer says the message was never received at all: the bank produces its delivery log, and the dispute becomes one about the reliability of that log. The third is the position of a chargeback window set by a card network, which is a contractual and network rule rather than a statutory deadline, and can be shorter than any of the clocks above. Anyone who tells you there is one authoritative deadline is oversimplifying.

What you can control is the record. A complaint number stamped within three working days, a written dispute, and a signed electronic complaint are worth more than any argument about whose fault the delay was. Full details of the documents to attach are set out in our guidance on the credit card fraud complaint documents.

When to involve a lawyer

Deadlines are usually a matter of arithmetic, and arithmetic rarely needs a lawyer. The cases that do are these: where the bank relies on its board policy to shift a large loss onto you past the seven-day mark; where the ombudsman has closed a complaint and the amount justifies moving from a regulator to a court; and where the police have declined to register an FIR and the limitation band for the offence is the three-year band, so that every month of delay matters. At that stage a cyber crime lawyer in Kolkata can reconstruct the timelines from the alerts and the complaint logs and put the dates on affidavit. If a criminal case has been registered instead against you, the priority changes, and you should read our note on criminal defence before you file anything. To have the dates checked on your own file, use our contact page.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What is the time limit to file a credit card fraud complaint in India?

There is no single statutory deadline. For your liability to the bank, you must report within three working days of the bank's communication to get zero liability, or within seven working days to have your liability capped. For prosecution, the limitation under section 514 of the Bharatiya Nagarik Suraksha Sanhita, 2023 is three years for offences punishable up to three years, and no bar for offences punishable with seven years.

Do I lose all rights if I report credit card fraud after seven working days?

No. Beyond seven working days your liability is decided by the bank's board-approved policy rather than by the statutory bands, and that policy must be published and disclosed to you. Many policies permit a waiver. Reporting late also stops further loss, because the framework places the entire continuing loss on the bank once you have reported, even where the initial loss arose from your own negligence.

Is there a deadline for filing the police complaint for credit card fraud?

No fixed deadline applies to a victim's report. Delay is treated as evidence going to credibility, not as a bar. The information may be given to any police station regardless of where the offence occurred, under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023. If given electronically, it must be signed within the period that provision allows for it to be taken on record.

How long does a bank have to reverse a disputed credit card transaction?

Under the Reserve Bank directions the bank must credit the disputed amount to your account, by a shadow reversal, within ten working days of your notification, without waiting for any insurance claim to be settled. The credit must be value dated as of the unauthorised transaction, and for a credit card the bank must ensure you bear no additional interest burden.

How long does a bank have to decide a credit card fraud complaint?

The bank must resolve the complaint and establish liability within the period fixed by its board-approved policy, which cannot exceed ninety days from the date it received the complaint. If it cannot resolve the complaint or determine liability within that period, it must still pay compensation as the framework provides. A failure here is a deficiency in service for an ombudsman complaint.

When does the three working day period start for a credit card fraud complaint?

It starts when the bank communicates the transaction to you, not when you first discovered it or when the statement arrived. The working days are counted on your home branch's working schedule, excluding the day the communication was received. If you never received the alert because the contact details on record were outdated, that gap becomes part of the dispute.

Can a credit card fraud case be filed after three years?

It depends on the offence charged. Section 514 of the Bharatiya Nagarik Suraksha Sanhita, 2023 bars cognizance after three years for offences punishable with imprisonment of more than one year but up to three years, which covers sections 66C and 66D of the Information Technology Act, 2000. Cheating under section 318(4) of the Bharatiya Nyaya Sanhita, punishable with seven years, falls outside that bar.

What if the bank says the alert was delivered but I never received it?

Ask for the bank's alert delivery log and its complaint log in writing, and put your position in the same letter. Where the delivery of the communication is contested, the dispute turns on the reliability and content of the bank's own records, and the framework does not settle the point. Preserve your call records and any record of a changed mobile number on the account.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact