Yes, an unauthorized credit card transaction can generally be disputed and recovered in India, subject to the circumstances and the applicable RBI customer-protection framework. If a transaction was not authorised by the cardholder, the cardholder should report it to the card issuer immediately. Depending on whether the loss resulted from bank negligence, a third-party breach, or the customer’s own negligence, the cardholder’s liability may be zero, limited or, in certain circumstances, potentially higher.
RBI’s framework specifically provides protection for customers against unauthorised electronic banking transactions and requires banks to provide mechanisms for reporting such transactions.
What Is an Unauthorized Credit Card Transaction?
An unauthorised credit card transaction is a payment or withdrawal that the cardholder did not approve or initiate.
Examples may include:
- Online purchases made without the cardholder’s permission
- Card-not-present transactions using stolen card details
- Transactions after physical card theft
- Fraudulent transactions resulting from compromised payment credentials
- Other electronic transactions that the cardholder did not authorise
A transaction being unfamiliar does not automatically prove fraud. For example, a merchant may appear under a different billing name, or a family member may have used the card with permission. The cardholder should therefore verify the transaction before making a formal dispute.
Is the Cardholder Automatically Responsible?
No.
RBI’s customer-protection framework determines liability according to the circumstances surrounding the unauthorised transaction.
Where the unauthorised transaction results from contributory fraud, negligence or deficiency on the part of the bank, the customer’s liability is zero, regardless of whether the customer reported the transaction.
Similarly, where the transaction results from a third-party breach and neither the bank nor the customer is responsible for the deficiency, the customer can have zero liability if the transaction is reported within the prescribed period.
This makes prompt reporting extremely important.
What Happens If the Customer Reports the Fraud Quickly?
If the unauthorised transaction results from a third-party breach where neither the customer nor the bank is responsible, reporting the transaction within three working days of receiving the bank’s communication about the transaction can result in zero customer liability under the RBI framework.
If the customer reports the transaction later, but within four to seven working days, the customer’s liability may be limited according to the applicable RBI framework and the relevant maximum amount.
For delays beyond seven working days, liability is generally determined according to the bank’s board-approved policy.
Therefore, customers should not wait for the next billing cycle before reporting a suspicious transaction.
What If the Customer Shared the Card Details?
The position can be different if the loss resulted from the customer’s own negligence.
RBI’s framework gives the example of a customer sharing payment credentials. In such circumstances, the customer bears the loss until the unauthorised transaction is reported to the bank. Any loss occurring after the customer reports the transaction is to be borne by the bank under the framework.
This does not mean that every fraud involving a cardholder’s information automatically proves customer negligence. The circumstances of the transaction and the available evidence matter.
How Quickly Must the Bank Act?
Banks are required to provide customers with accessible mechanisms for reporting unauthorised transactions, including multiple channels such as website, phone banking, SMS, email and other appropriate methods. On receiving a report, the bank must take immediate steps to prevent further unauthorised transactions.
For eligible cases involving zero or limited liability, RBI’s framework requires the bank to provide a shadow reversal of the amount involved within 10 working days from notification, without waiting for the outcome of an insurance claim.
The complaint and determination of customer liability should generally be resolved within the period prescribed by the bank’s policy, which cannot exceed 90 days under the RBI framework.
Does the Cardholder Still Have to Pay the Disputed Amount?
A cardholder should immediately notify the card issuer and formally dispute the transaction rather than simply ignoring the credit card bill.
RBI’s customer-protection framework specifically provides that, in the case of a credit card, the customer should not bear an additional burden of interest arising from an eligible unauthorised transaction while the matter is being dealt with under the applicable framework.
The cardholder should ask the issuer for written confirmation of the dispute and understand how the disputed amount will be treated on the account while the investigation is pending.
What Evidence Should Be Preserved?
A cardholder disputing an unauthorised transaction should preserve evidence such as:
- SMS and email transaction alerts
- Credit card statements
- Transaction date, amount and merchant details
- Screenshots of disputed transactions
- Complaint/reference numbers issued by the card issuer
- Details of when the card or credentials were reported lost or compromised
- Communications with the bank or merchant
Prompt documentation can help establish when the cardholder discovered and reported the transaction.
What If the Bank Rejects the Dispute?
If the card issuer concludes that the transaction was authorised or determines that the customer is liable, the cardholder can request the basis for that decision and supporting information where applicable.
The customer should first use the card issuer’s internal grievance-redressal mechanism. RBI’s credit-card framework requires card issuers to maintain a grievance-redressal and escalation process and provide relevant contact information to customers.
If the complaint is not satisfactorily resolved, the customer may consider the applicable RBI complaint-redressal mechanism, subject to its eligibility requirements and procedure.
Where the transaction involves suspected identity theft, fraud or other criminal conduct, a complaint to the appropriate law-enforcement or cybercrime authority may also be appropriate.
Can an Unauthorized Transaction Affect Credit History?
A disputed fraudulent transaction should not simply be treated as an ordinary voluntary purchase by the cardholder without considering the dispute and applicable customer-protection rules.
However, customers should continue communicating with the card issuer about undisputed dues and follow the issuer’s instructions regarding the disputed amount. Keeping the dispute formally documented is important if billing or credit-reporting issues arise.
What Should You Do Immediately After Discovering Fraud?
The safest approach is to act quickly:
- Block or temporarily disable the card through the issuer’s available channel.
- Report the unauthorised transaction immediately.
- Obtain and save the complaint/reference number.
- Check the statement for other suspicious transactions.
- Change relevant credentials where compromise is suspected.
- Preserve transaction alerts and other evidence.
- Follow up with the card issuer in writing.
- Escalate through the appropriate grievance mechanism if the issue remains unresolved.
RBI specifically advises customers to notify their bank immediately after discovering a fraudulent or unauthorised electronic transaction.
Conclusion
An unauthorised credit card transaction can be legally disputed and, where the customer qualifies for protection under the RBI framework, the amount can be recovered or reversed. Customer liability depends on the circumstances, including whether the bank was negligent, whether a third-party breach occurred and whether the customer contributed to the loss through negligence.
Reporting quickly is particularly important. Where a qualifying third-party breach is reported within three working days, the customer can have zero liability.
Customers should therefore never ignore an unfamiliar credit card transaction. The appropriate response is to notify the card issuer immediately, block the compromised card where necessary, preserve evidence and use the bank’s grievance process if the transaction is not resolved satisfactorily.
