Credit Card Fraud? What to Do in the First Hour (Step by Step)

You get an SMS for a transaction you didn't make. What you do in the next hour matters most, both for stopping further losses and for protecting your legal right to a refund. Follow these steps in order.

Step 1: Block the card (minutes 0–5)

• Open your bank app and use Block card or Hotlist card. Most apps also let you instantly switch off online, international and contactless use.
• If you can't access the app, call the bank's 24x7 helpline from the back of your card or the official website. Don't use numbers from search ads or messages.
• Blocking stops new transactions. It doesn't cancel pending ones. Report those in step 2.

Step 2: Report the unauthorised transaction to your bank (minutes 5–20)

Report every fraudulent transaction through the app's dispute option, phone banking, email or a branch, and note the complaint or reference number. This matters because RBI's customer-liability rules depend on when you report:

The bank should credit the disputed amount to your account (a "shadow credit") within 10 working days of your report while it investigates. Fraud caused by your own negligence, such as sharing an OTP, may not qualify for zero liability.

Step 3: Call 1930 or report on cybercrime.gov.in (minutes 20–60)

If money has been taken, report it to the government's cyber fraud system:

• Call 1930, the national cyber fraud helpline, which is toll-free and available 24x7. Your complaint is logged in the Citizen Financial Cyber Fraud Reporting and Management System, which alerts banks and can help freeze funds before they're moved.
• File online at cybercrime.gov.in, the National Cybercrime Reporting Portal. If you called 1930 first, complete the written complaint on the portal using the acknowledgement number you receive.

Speed matters. The sooner the complaint is logged, the better the chance that funds can be frozen in the fraudster's account.

Step 4: Document everything

• Screenshots of the fraud SMS or emails, the transaction list and any calls or messages from the fraudster.
• Your bank complaint number, 1930 acknowledgement number and cybercrime portal complaint ID.
• A timeline: when you got the alert, when you blocked the card, when you reported.

Step 5: Secure your other accounts

• If you shared details or clicked a link, change your net banking and email passwords and check for unfamiliar logins.
• Uninstall any app a caller asked you to install. Screen-sharing and remote-access apps are common in card fraud.
• Check your other cards and accounts for unusual activity.

What happens next

1. Shadow credit: the bank should reverse the amount within 10 working days while investigating.
2. Investigation: the bank investigates and, where it's a card transaction, may raise a chargeback with the card network. See our dispute guide.
3. Replacement card: the bank issues a new card with a new number.
4. If the bank doesn't resolve it: after 30 days, or if you're unhappy with the reply, escalate to the RBI Ombudsman. It's free, and under RB-IOS 2026 it can award compensation of up to ₹30 lakh plus ₹3 lakh for harassment.

How to prevent card fraud

• Never share an OTP, PIN, CVV or full card number with anyone, including callers claiming to be from your bank, RBI or the police.
• Turn on SMS and email alerts for every transaction.
• Set limits for online, international and contactless use in your bank app, and switch off what you don't use.
• Use tokenised saved cards rather than typing card details on unfamiliar sites. See tokenisation explained.
• Learn the common scams. See our guide to credit card scam calls and SMS.

FAQs

Sources

• National Cybercrime Reporting Portal (I4C, MHA)
• PIB: Cyber frauds helpline 1930
• Business Standard: RBI limits customer liability on bank frauds
• RBI: Integrated Ombudsman Scheme, 2026 FAQ