Archive · 11 Sep 2026
RBI Rules Explain Who Pays for Stolen Credit Card Fraud
If your credit card is stolen, you may not have to pay for purchases made by the thief.
The result depends on what caused the fraud and how quickly you tell the bank.
If the bank was responsible, you may have zero liability.
You may also have zero liability for some problems outside the bank if you report them within three working days of being notified.
If you shared your PIN, CVV, OTP, or other payment credentials, you may have to bear losses until you report the fraud.
Purchases made after you report and block the card should normally be paid by the bank.
Reports made four to seven working days later may involve limited liability.
Reports after seven working days are handled under the bank’s approved policy.
You should block the card immediately, report every suspicious transaction, and keep the complaint number.
Unauthorised credit-card transactions are not automatically the cardholder’s responsibility; liability depends on how the fraud occurred and when it was reported.
Transactions made after the card is reported and blocked should ordinarily be borne by the bank.
Customers may have zero liability for certain bank-related breaches or third-party breaches reported within three working days.
If customers share payment credentials, they may bear losses until reporting the unauthorised transaction; later reports may attract limited or policy-based liability.
Banks must provide 24x7 reporting channels, block cards after notification, and credit eligible amounts within 10 working days of a customer’s request.
- Who
- Credit-card holders, card issuers, the Reserve Bank of India, and banks are involved; experts Ashish Lath, Aditya Soni, and Adhil Shetty also commented.
- What
- The issue is who bears losses from unauthorised transactions made with a stolen or compromised credit card.
- When
- Liability depends on when the customer reports the fraud: within three working days, within four to seven working days, or after seven working days.
- Where
- Customers report the loss or transactions to their card issuer through its app, internet banking, helpline, or other available channels.
- Why
- RBI rules assign liability according to whether the bank, a third party, or the customer was responsible and how quickly the fraud was reported.
Customer Protection
Customer Responsibility
Who should pay for fraudulent transactions?
Customer Protection
Customers may have zero liability when the bank is responsible or when a third-party breach occurs without fault by either the bank or customer and the fraud is reported within the applicable period.
Customer Responsibility
Customers may bear losses when they were negligent, such as by sharing payment credentials, or when they report the fraud later under the bank’s policy.
Meaning of the three-working-day rule
Customer Protection
One expert interpretation says that reporting within three working days can mean the bank covers the amount spent.
Customer Responsibility
The article cautions that the three-working-day period is not an automatic refund guarantee in every case because the circumstances of the fraud still matter.
Responsibility after notification
Customer Protection
Once the customer reports the loss or unauthorised transaction and the card is blocked, subsequent unauthorised losses should ordinarily be borne by the bank.
Customer Responsibility
For transactions made before notification, the bank may assess liability under RBI rules and its customer-protection policy.
- After reporting and blocking
- Unauthorised transactions made afterward should ordinarily be borne by the bank.
- Bank-related fraud
- Customers have zero liability when the unauthorised transaction is linked to the bank, regardless of when it is reported.
- Third-party breach
- Zero liability may apply when neither the bank nor customer is at fault and the customer reports the transaction within three working days of receiving notification.
- Customer negligence
- If the customer shares payment credentials, the customer may bear losses until the unauthorised transaction is reported.
- Four to seven working days
- Liability may be limited according to RBI-prescribed caps and the type of account.
- Beyond seven working days
- Liability is determined under the bank’s Board-approved policy.
- Refund and resolution
- For eligible unauthorised electronic transactions, the bank must credit the amount within 10 working days of the customer’s request and resolve the complaint within a period not exceeding 90 days.
