Stay safe › Scams
Unknown charges on your card or account
A debit you didn't make? Report it to your bank within 3 working days. Under RBI rules you usually don't pay for it.
How it happens
Your card number, CVV or login can leak through a fake website, a data breach, a skimmer at a shop, or a phishing message. Fraudsters often try a tiny charge first to check the card works, then spend more. Sometimes the first you know of it is a debit SMS.
The RBI rule that protects you
The Reserve Bank of India’s 2017 circular on unauthorised electronic banking transactions says:
- Zero liability: if the fraud was the bank’s fault, or a third party’s with no fault by you or the bank, and you tell your bank within 3 working days of getting the bank’s alert, you don’t pay.
- Limited liability: if you report in 4 to 7 working days, your loss is capped at between ₹5,000 and ₹25,000, depending on your type of account or card.
- Refund in 10 days: the bank must put the money back in your account (as a “shadow” credit) within 10 working days of your report, while it investigates.
- The bank must prove it: the burden of proving that you were careless is on the bank, and complaints must be settled within 90 days.
If the loss happened because you shared your PIN, OTP or card details, the bank can hold you responsible for losses until you report it. That is one more reason to report straight away.
If the bank doesn’t help
Escalate to the bank’s grievance officer. If there is no reply in 30 days, or you are unhappy with it, you can complain to the RBI Ombudsman for free at cms.rbi.org.in. Don’t wait long: the scheme sets a time limit after that.
If it has already happened
- Block the card or UPI at once in your bank's official app, or by calling the number on the back of your card.
- Report the transaction to your bank in writing (app, email or branch) and note the complaint number. Do it within 3 working days.
- Call 1930 or report at cybercrime.gov.in, especially if a large amount was taken.
Protect yourself
- Turn on SMS and email alerts for every transaction, and read them.
- Switch off international and online use on cards you don't use for that, and set low limits in your bank app.
- Never share card numbers, CVV, OTP or PIN, and only pay on apps and sites you trust.
Say it simply
Every unknown debit SMS needs action the same day. Block first, ask questions later.
If you get a message about money you didn't spend, call your bank on the number on your card, not one from the message.
Where to report
- Your bank, directlyBlock your card or UPI, and report the transaction. Use the number on your card or the bank's official app, never one from a message.Number on your card
- Cybercrime helpline 1930Money has been taken or a payment was tricked out of you. Call at once: the sooner, the better the chance of freezing it.Call 1930
- National Cyber Crime Reporting PortalFile a complaint about any cyber fraud, harassment, sextortion or morphed images.cybercrime.gov.in
Learn more
Real banks never ask for your OTP
How fake KYC messages and "bank manager" calls trick people into sharing OTPs, the red flags to spot, and where to report in India.
Strong passwords, PINs and 2FA
Why a password built from public information is no lock at all, and how passphrases, password managers and two-factor authentication keep accounts safe.