How do I dispute fraudulent or wrong credit card charges in India?

Move within 24 hours of discovering the disputed transaction — the RBI Customer Protection Circular (July 2017) reserves zero customer liability for reports within three working days of the fraudulent entry, and speed compounds the odds of chargeback success. Immediately block the card via the bank's app, SMS or customer care and note the reference number. Save every SMS or email transaction alert. For ATM or online fraud, call the 1930 cybercrime helpline; for cases involving identity or KYC compromise, file an FIR the same day.

Follow the phone report with a written dispute — a letter or bank-provided form listing the card number, transaction date, amount, merchant, reason for dispute and supporting evidence. Submit it by email plus a physical letter or branch visit, and retain the acknowledgement. The bank must acknowledge within 30 minutes and, under the RBI Customer Protection framework, effect a shadow reversal — crediting your account with the disputed amount pending investigation — within 10 working days. Investigation must complete within 90 days, with the outcome in writing.

If the transaction involves a merchant, the bank initiates chargeback through the card network (Visa, Mastercard, RuPay) using specific codes: fraud (goods not received), cardholder dispute (quality issue), processing error (duplicate billing), or unauthorised charges. The merchant has 30-45 days to respond. If the bank refuses to act, escalate to the branch nodal officer, then the bank's principal nodal officer, then the Bima Bharosa-equivalent RBI complaint portal, then the Banking Ombudsman. Cyber cell FIR plus consumer complaint runs in parallel for large frauds. Rejection grounds you must be ready to counter include claims of policy lapse, invalid driver licence-equivalent authorisation, drunk-driving-style negligence claims (OTP shared, etc.), late intimation beyond 48 hours, or wrong-use allegations. The strongest counter is documented evidence that the transaction was on your card without your consent and was reported within the RBI window.

The RBI Customer Protection (Limiting Liability for Unauthorised Electronic Banking Transactions) circular of 6 July 2017 is the strongest consumer protection in Indian retail banking. Its liability framework is straightforward. Zero customer liability applies where the fraud results from bank negligence, from a third-party breach where the bank shares fault, or from any third-party breach where you notify within 3 working days. In these cases the bank must shadow-reverse the disputed amount within 10 working days and bear the entire loss.

Limited liability applies for delayed reporting between 4 and 7 working days: ₹5,000 for Basic Savings Bank Deposit accounts, ₹10,000 for standard savings and credit cards under ₹5 lakh limit, ₹25,000 for current, cash credit, overdraft and high-limit credit cards. Reporting after 7 working days shifts full liability to the customer. The critical point is that the burden of proof is on the bank to establish customer negligence — mere allegation does not suffice. The bank must produce the customer's authentication trail, device fingerprint, IP and location logs, OTP delivery records and evidence that the customer was aware of security best practices. Mere claim of "OTP shared" without demonstrating the customer's active involvement is not sufficient defence.

Shadow reversal within 10 working days is not conditional on investigation outcome — it protects you during the investigation. If the eventual finding is customer fault, the bank can recover the amount with justification; if not, the reversal is permanent. Investigation must complete within 90 days with written outcome and detailed reasoning. Banks must provide 24/7 reporting channels including toll-free helpline, mobile app one-tap reporting, branch acknowledgement, web portal, email and SMS. RBI enforces the framework through inspections and can impose penalties for systemic non-compliance. The Banking Ombudsman actively enforces the circular; compensation up to ₹20 lakh plus ₹1 lakh for mental harassment is routine. Supreme Court and NCDRC rulings have consistently strengthened the customer position — State Bank of India v. P.V. George emphasised the bank's higher duty of care. If the bank contests your zero-liability claim, quote the circular's specific paragraphs, the 3-day and 10-day windows, and the burden-of-proof rule.

Eligibility for the RBI Banking Ombudsman is straightforward: you must have filed a complaint with the bank at least 30 days earlier, or the bank must have rejected or partially redressed your complaint. The complaint must fall within a year of the bank's reply or 13 months from your original filing. It must not be under litigation elsewhere on the same matter. The grounds covered are extremely broad — non-payment or delayed payment of instruments, non-adherence to RBI directives, delay or refusal of remittances, wrongful account closure, charges levied without prior notice, all card-related complaints (credit, debit, prepaid), ATM disputes, deficiency in mobile and internet banking, non-adherence to fair practices code, loans against RBI directives, pension delays, and, in the catch-all category, virtually any bank-service failure.

Filing is free and does not require a lawyer. The Integrated Ombudsman Scheme, 2021 operates through cms.rbi.org.in, email to CRPC@rbi.org.in, the 14448 helpline, or physical letter to CRPC, Reserve Bank of India, 4th Floor, Sector 17, Chandigarh-160017. The complaint form (P-II online) asks for personal and bank details, account or card number, nature of complaint, bank's earlier response, and specific relief sought — a compensation amount, service restoration, or refund. Attach supporting documents including the transaction records, correspondence with the bank, RBI Customer Protection Circular references, and identity proof.

The Ombudsman routes the complaint to the appropriate branch, issues notice to the bank, and typically attempts mediation first. If mediation fails, a formal award follows after hearing. Statutory disposal timeline is three months, though the actual timeline is often six. Reliefs include direction to credit the disputed amount with interest, compensation up to ₹20 lakh, additional ₹1 lakh for harassment and mental agony, specific performance, restoration of facility, and interest on wrongfully retained amounts. The award is binding on the bank if you accept it, and the bank must comply within 30 days. You can reject the award and pursue other forums — Consumer Commission for stakes above ₹50 lakh or specifically deficient service, civil court for very large stakes, or High Court writ for systemic issues. The Ombudsman route is faster and cheaper than any court, and the enforcement rate is high — banks take Ombudsman complaints seriously because of the regulatory oversight.

Merchant disputes fall into a few common patterns. For items not received, wait 7-15 days past expected delivery, contact the merchant with proof, then raise chargeback via the bank with tracking evidence and communication trail. For defective or misdescribed items, first exhaust the platform's return process — the Consumer Protection (E-Commerce) Rules, 2020 mandate seller cooperation — then chargeback. For cancelled bookings, the DGCA passenger charter applies to flights, refund policies to hotels; chargeback is the fallback if the merchant refuses. Recurring subscriptions require a written cancellation demand plus a request to the bank to stop the standing instruction; future charges can be chargebacked.

Unilateral EMI conversion — where a bank converts a large purchase into an EMI without your explicit consent — is prohibited by the RBI Master Direction on Credit and Debit Cards, 2022. Banks defend by pointing to IVR or app consent trails; if the trail is thin or non-existent, demand reversal in writing. Excessive interest and late fees are actionable — the annual percentage rate must be transparently disclosed, late fees are capped by RBI direction, and compounding interest on unbilled amounts is improper. Consumer Commission has held excessive interest beyond RBI norms an unfair trade practice; the NCDRC ruling in HDFC Bank v. Awaz (2008) is the reference. Undisclosed annual fees — where "lifetime free" cards suddenly charge an annual fee — are challengeable within a 30-day cooling-off window. The RBI Master Direction requires one-month advance notice of any new fee and allows opt-out by card closure with fee refund.

Foreign currency markup, typically 3-3.5%, must be transparently communicated. Dynamic Currency Conversion at overseas point-of-sale is optional; you can refuse and be billed in the local currency at your bank's rate. Reward points wrongly forfeited or expired without notice are contractual breaches; the Consumer Commission has jurisdiction. Wrongly declined or blocked cards causing overseas embarrassment are compensable; the bank's "fraud prevention" defence must be proportionate. Cards must not be shared or credentials stored insecurely; RBI's tokenisation direction requires card details not to be stored merchant-side. Data breaches at merchants trigger chargeback plus the bank's responsibility for tokenisation enforcement. Route complaints in this order: RBI Banking Ombudsman for bank issues, Consumer Commission for merchant issues where chargeback failed, NPCI for UPI, IMPS or NEFT disputes, cybercrime portal for fraud.

The RBI Master Direction on Credit and Debit Cards, 2022 sets strict rules on collection practices. Calls are permitted only between 8 AM and 7 PM. Calls to your workplace require your consent. No third party — neighbours, family, employer — may be told about your debt. Recovery agents must identify themselves by name, agency and ID. Contact records must be maintained by the agency. Multiple calls in a single day are abusive; there is a frequency limit. The bank is responsible for the recovery agent's conduct — outsourcing does not transfer liability.

Common harassment patterns — multiple daily calls, calls to family or employer, threatening language, threats of arrest (debt is civil, no arrest for non-payment), public shaming through visits to workplace or social media, late-night calls, impersonation of police or court officials, sending goons — are all violations. Your rights are to demand written communication only, record calls under the BSA 2023 one-party consent framework, complain to the bank's nodal officer, escalate to the RBI Banking Ombudsman which handles harassment grievances, file an FIR for criminal intimidation (Section 351 BNS), trespass (Section 328 BNS), or extortion (Section 308 BNS) depending on facts, and pursue Consumer Commission or civil suit for damages including mental harassment awards routinely between ₹50,000 and ₹5 lakh.

Settlement options include One-Time Settlement — the bank often accepts 60-80% of dues, sometimes 30-50% for very old NPAs, marking the account "settled"; this preserves an outcome but is worse than "closed" for your credit score (150-200 point impact). Restructuring converts credit card debt to EMI with lower interest and extended tenure; personal insolvency under IBC 2016 exists for genuinely unmanageable debt. Lok Adalats often result in 20-50% discounts and binding compromise; banks routinely participate. The bank can legally send written demand notices, pursue Lok Adalat, file civil suit for recovery, file a cheque dishonour case under Section 138 if you issued cheques, and report default to credit bureaus. What the bank cannot do: arrest, forcefully take possession, publicly shame, disclose to third parties, resort to violence or continuous harassment, or misrepresent legal position. Credit card debt is unsecured so SARFAESI does not apply. Debt becomes time-barred after 3 years from last acknowledgement or payment (subject to acknowledgement restarting the clock); the bank cannot sue on time-barred debt though it may still attempt recovery. Senior citizens, terminally ill patients and families of the deceased have RBI-directed sensitive handling; estates are liable only to the extent of assets inherited. Retain all communications, escalate methodically, and engage a consumer or banking lawyer if harassment persists.