Credit Card Fraud in India 2026: Common Scams and the RBI Rule That Decides Who Pays

By Nitish Bharadwaj · Published Aug 24, 2026 · 7 min

Most Indian credit card fraud succeeds through social engineering — fake bank calls, phishing links, and QR scams — not technical hacking. RBI's liability framework ties your exposure directly to reporting speed: zero liability if you report within 3 working days of the bank's alert, a capped liability if you report in 4–7 days, and your bank's own policy deciding everything after that. This guide covers the scams to watch for, the exact reporting window that protects you, and what to do in the first 60 minutes after you spot an unauthorised transaction.

A phone call from someone claiming to be your bank's "fraud prevention team," warning that a suspicious transaction just hit your card and asking you to read out the OTP to "block" it, works more often than any technically sophisticated hack. It succeeds by manufacturing panic in the ninety seconds before your caution kicks in. Knowing exactly which scams work on Indian cardholders, and how RBI's liability rules split the loss between you and your bank, matters far more than a generic "never share your OTP" warning.

The Scams That Actually Work on Indian Cardholders

Card fraud in India rarely involves breaking encryption — it almost always involves convincing you to hand over what encryption is supposed to protect. Here are the five patterns that account for most cardholder complaints in 2026.

RBI's Liability Rule: Who Actually Pays

RBI's limited liability framework for unauthorised electronic transactions applies to credit cards, debit cards, and prepaid instruments alike. Your liability is decided almost entirely by how fast you report the fraud after your bank alerts you to it — not by how the fraud happened.

What to Do in the First 60 Minutes

1. Call your bank's 24x7 fraud helpline immediately to block the card — use the number on the back of your card or the bank's official app, never a number from the suspicious SMS itself.
2. Follow up the call with a written complaint through net banking, the bank's app, or email. RBI's 3-day zero-liability clock counts from when the bank informed you of the transaction, not from when you called.
3. File a parallel complaint on the National Cybercrime Reporting Portal (cybercrime.gov.in) or call 1930 — this creates an official record independent of the bank's own process.
4. Get a written acknowledgment number for your complaint. You will need it if you have to escalate to the RBI Banking Ombudsman after 30 days without resolution.
5. Request a fresh card and PIN rather than continuing to use the compromised number, even once the disputed transaction is reversed.

Everyday Habits That Close Most of These Gaps

• Set a low default transaction limit and raise it only when you actually need to — most banking apps let you do this in seconds; see our guide on lowering your contactless transaction limit for exactly how.
• Turn on SMS or app alerts for every transaction, including failed attempts — a failed attempt is often the first sign someone already has your card details.
• Avoid saving full card details on unfamiliar shopping sites. RBI-mandated tokenisation means your actual card number no longer sits on a major platform's servers once you use "save card" there.
• If you hold more than one card, keep a separate, lower-limit card set aside specifically for online spending — it caps your worst-case exposure if that card alone is compromised.

When the Bank Still Says No

If your bank rejects a genuinely unauthorised claim or drags the resolution past 30 days, you have two formal routes: a chargeback dispute through the card network for the specific transaction (our credit card chargeback guide covers the exact process and documentation banks expect), or an escalation to the RBI Banking Ombudsman citing the unresolved complaint. Keep every complaint reference number and written communication — banks that back down usually do so once a customer shows they know the actual RBI timeline rather than just being upset.

It's also worth knowing what RBI has tightened on the sales side of card fraud: banks can no longer push you into an unsolicited card upgrade or a fresh card sale over a single unsolicited call, under the one-click credit card sales ban — a rule introduced for the same reason phishing works, because a rushed decision on a call is exactly when mistakes happen.