Documents needed to file a credit card fraud complaint

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Online fraud

Filing a credit card fraud complaint needs roughly eight papers: the card statement, the transaction alert, your written dispute to the bank, a copy of the FIR, ID proof, and proof of the complaint numbers the bank gave you. Missing any one of them is the most common reason a bank treats the claim as unproved and pushes the loss back onto you.

If your credit card was used without your authority, your complaint will be judged on documents, not on how convincing you sound. Banks decide liability from a written dispute backed by the statement and the alerts, and the police register a case from a narrower set of records plus a first information report. No statute lays down a fixed list of papers, so what follows is the practical set that Indian card issuers and cyber crime cells repeatedly ask for.

Two legal tracks run side by side. Your liability to the issuer is governed by the Reserve Bank of India directions on limiting customer liability in unauthorised electronic banking transactions, in circular DBR.No.Leg.BC.78/09.07.005/2017-18 dated 6 July 2017. The criminal case, which is separate and yours to pursue, is registered under the Bharatiya Nyaya Sanhita, 2023 for cheating (section 318), cheating by personation (section 319) and forgery (section 336), together with the Information Technology Act, 2000, most often sections 66C for identity theft and 66D for cheating by personation using a computer resource. The bank file and the police file overlap, but they are not the same file.

What you actually have to establish

There are only three things to prove, and every document on the list exists to prove one of them. The first is that the transaction was not authorised by you. The second is that you reported it promptly, measured from the date the issuer first communicated the transaction to you. The third is the amount involved and the number of transactions. A paper that proves none of these three things does not help; it thickens the file and slows the officer reading it.

Notice what is missing from that list. You do not have to prove who did it, you do not have to name a suspect, and you do not have to show how the card data leaked. Those are investigation questions. The bank cannot demand them from you as a condition of accepting a complaint, and if it does, that demand is itself worth recording in writing.

The bank file: what your card issuer needs

Keep a single indexed folder and a scanned copy of everything. Send the same set twice if you like, once through the app or net banking and once by email to the bank's nodal officer, so that the timestamp is visible on two channels.

Your written dispute. A short letter or the bank's dispute form stating the last four digits of the card, the date, amount and merchant of each disputed transaction, and the words that matter: that you did not authorise them and that you deny the charge.
The card statement covering the disputed transactions. The full statement for the billing cycle, not a screenshot of one line.
Transaction alerts. The SMS and email alerts for each disputed transaction, with the sender, date and time visible.
Proof of the report to the bank. The complaint reference number, the acknowledgement email or SMS, and the call log or recording reference if you telephoned.
Proof that the card was blocked. The request to hotlist or block the card, and the confirmation.
ID proof and the card itself. A copy of the card front and back is commonly asked for so the issuer can verify that the physical card is in your possession.
Any proof that the card was physically with you. A location record, an office attendance record, a travel ticket, a witness statement from a person present with you at the time.
Merchant-side papers, if the transaction was at a merchant. The order confirmation, delivery details, and any exchange with the merchant in which the sale was denied.

The police file: what the cyber cell or station needs

The police need less paper but more formality, and the order of the steps matters because a complaint filed before the bank is notified is often returned for that reason. The sequence that works is this.

Block the card first, so no further transaction can occur. Note the time of the block.
Report on the national cyber crime portal, cybercrime.gov.in, or by telephoning 1930, and keep the acknowledgement number.
Inform the bank's nodal officer in writing and obtain a complaint number.
Approach the police station with jurisdiction, or any station if the offence was committed outside its limits, and hand over a signed written complaint.
Produce a copy of the FIR, once registered, together with your letter and the bank papers.
Attach the card statement, the alerts and the acknowledgement numbers from steps two and three.

On the criminal side, the ordinary rule is that a first information report may be given orally or by electronic communication to the officer in charge of any police station, irrespective of the area where the offence was committed. Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 carries that rule, and it is what makes a zero FIR possible. If you give the information electronically, it must be signed by you within the period the provision allows for it to be taken on record, so the written follow-up is not optional.

Which document proves what

Document	What it establishes	Where it goes
Written dispute to the issuer	That you deny the transaction	Bank, then FIR
Card statement for the cycle	The amount, date and merchant	Bank and police
Transaction alerts	The date you received notice of it	Bank and police
Complaint and reference numbers	That you reported it, and when	Bank and police
Card block confirmation	That further loss was prevented	Bank and police
Proof the card was with you	That you did not make the transaction	Police, and bank if disputed
FIR copy	That a criminal case exists	Bank, insurer, court
ID proof	That the complaint is yours	Both

The order in which to assemble the file

Speed matters because the customer liability rules are built around when the issuer communicated the transaction to you, not around when you discovered it. The working days in those rules are counted on the working schedule of your home branch, excluding the day you received the communication. So the practical order is: block, report, notify the bank, then assemble the paper. Do not spend three days collecting documents before you make the first call.

Block the card and note the time.
Report to 1930 or the national portal and save the reference.
Write to the bank and save the acknowledgement.
Download the statement and the alert messages in full.
Draft the dispute letter with transaction-wise details.
File the police complaint and collect the FIR copy.
Index everything and keep two copies.

What decides whether the papers are accepted

Four things decide it. First, whether the disputed transaction is described transaction by transaction rather than as a lump sum. Second, whether the date on which the issuer communicated the transaction is documented, because the entire liability framework turns on the working days counted from that date. Third, whether the physical card was in your possession, which is usually the difference between a fraud claim and a claim of negligence. Fourth, whether the file is internally consistent, because a statement, an alert and a complaint that disagree on the amount will be treated as unreliable as a set.

It is worth being plain about the limits here. Whether the forged signature on a charge slip was checked, whether the merchant verified the card, and whether the issuer's fraud monitoring should have caught the pattern are matters on which the law is not fully settled, and different adjudicators weigh them differently. Build the file so that none of those questions needs an answer from you.

Documents only the bank or the police can obtain

Some of the most useful material is not in your hands at all, and the quickest way to lose a claim is to assume it will surface on its own. Ask for each item below in writing, and keep the request with the file so that the date of the demand is visible.

The issuer's alert delivery log. This shows the exact date the bank communicated the transaction to you, which is the date every working-day calculation runs from.
The bank's complaint log. The date your dispute was received, the officer handling it, and the reference number under which it sits.
The merchant transaction detail. The authorisation code, the entry mode, whether chip, contactless or card-not-present, and the terminal details. Only the issuer or the acquiring bank can pull this out.
The delivery and consignee details for goods fraudulently bought in your name, which sit with the merchant or the platform.
CCTV footage covering an ATM or terminal transaction. It is overwritten fast, so it must be demanded early, and only the investigating officer can secure it from the bank or the merchant.
Subscriber and call data records linked to a fraud telephone number, which the investigating officer obtains from the service provider.

When you write to the bank, keep the covering letter to one page and attach the index. State the card number in masked form, the transaction-wise list, and the one sentence that does the real work: that you did not authorise these transactions and that you deny them. Do not argue about fault in that letter. The dispute letter is not the place for legal argument; it is the record that you denied the charge at a date the bank cannot later dispute.

One point of law is worth stating plainly here, because it is frequently quoted wrongly. Section 66A of the Information Technology Act, 2000, which once criminalised offensive online messages, was struck down in 2015 and is not a live provision. It cannot be cited in your complaint or in any reply you write. If a demand letter you receive brands your conduct under that section, that alone tells you the letter was not drafted with care.

Mistakes that cost victims money

Reporting to the police but not to the bank, or the reverse. The two tracks do not feed each other automatically.
Sending screenshots instead of the full statement and the full alert text.
Describing the loss as one figure when there were four separate transactions, which makes the per-transaction analysis impossible.
Deleting the alert messages to clean up the phone before any copy is saved.
Waiting to file anything until the bank has replied. The reporting date is what the liability rules use.
Discarding the physical card once a replacement arrives. It is evidence of possession.

If your card was used online without the physical card, the same documents apply, with the addition of the account and delivery details of the fraudulent order where they are visible to you. If the loss arose from a shared one-time password, expect the issuer to argue contributory negligence, because the framework places the entire loss on a customer who shared credentials, up to the moment of reporting.

When to involve a lawyer

Most first complaints do not need a lawyer. Doubt creeps in at three points: when the issuer rejects the claim and you have to escalate to the banking ombudsman, when the police decline to register an FIR and you need a magistrate's direction, and when the amount is large enough that the record you create now will be read later by a court. At those points the file you assembled in week one decides the case. A cyber crime lawyer in Kolkata can review the dispute letter and the FIR before they are filed, and if the matter reaches court, criminal defence representation and a civil recovery suit can run together against the same set of facts. The first step is still the one above: keep every paper, and keep the timestamps.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What documents are needed to file a credit card fraud complaint in India?

You need a written dispute to the card issuer, the full card statement for the disputed billing cycle, the transaction alerts, proof of the complaint number the bank gave you, confirmation that the card was blocked, and ID proof. Add proof that the card was physically with you and any merchant-side records. The police complaint uses the same set plus the written complaint and, once registered, the FIR copy.

Is an FIR necessary to get money back from the bank?

No. The bank's decision on your liability is made under the Reserve Bank of India directions on unauthorised electronic banking transactions, which turn on when you reported the transaction, not on whether an FIR exists. An FIR helps the criminal case and is often asked for by insurers and by courts, but a bank cannot refuse to process a fraud claim solely because no FIR has been registered.

Can the bank demand documents that I do not have?

A bank can ask for what it needs to verify the transaction and your denial, but it cannot require you to identify the fraudster or explain how your card data was compromised. Those are investigation matters. If an issuer makes acceptance of your complaint conditional on naming a suspect, put the demand in writing to the nodal officer and record the refusal.

What proof do I need that the card was with me at the time of the fraud?

Anything independent that places you elsewhere or shows the physical card was in your hands. A travel ticket, an office attendance record, a location log, a purchase made with the same card minutes after the disputed transaction, or a statement from a person who was with you. For online fraud without the physical card, the equivalent is proof that you did not receive the goods.

Do I need to give the original documents or copies?

Give copies and keep the originals. Statements, alerts and acknowledgements should be preserved in their original form, including the original messages on the phone and the original email in the mailbox. If a case later goes to court, the original electronic record and the certificate required under section 63 of the Bharatiya Sakshya Adhiniyam, 2023 will be needed.

How long does it take for a bank to decide a credit card fraud complaint?

Under the Reserve Bank framework the bank must credit the disputed amount to your account within ten working days of your notification, by a shadow reversal, and must resolve the complaint and establish liability within a period fixed in its board-approved policy, not exceeding ninety days from receipt of the complaint. If it cannot decide within that period it must still pay compensation as the framework provides.

Should I file the police complaint before or after telling the bank?

Tell the bank first, or at least at the same time. The liability framework measures working days from the date the issuer communicated the transaction to you, so the bank notification is the time-critical step. The police complaint follows immediately, and the bank complaint reference number strengthens it. Filing only with the police and not the bank can leave you outside the reporting window.

What if I no longer have the alert messages for the disputed transactions?

Ask the bank for the transaction log and the record of alerts it sent, and ask for the dispute record listing the exact date the transaction was communicated to you. The bank holds the delivery logs. State in your dispute letter that the alerts were received and that you are requesting the bank's own delivery records, so the gap is documented rather than silent.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact