What to do in the first 24 hours after credit card fraud

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Online fraud

In the first 24 hours after credit card fraud, the order of your actions decides how much you recover. Block the card and the app, report the fraud on 1930 or cybercrime.gov.in to trigger a freeze, and file a written complaint with your bank. Everything else follows from those three steps.

The first day after credit card fraud is not a day for reflection. Three things decide how much of the money comes back: stopping the card so no further debits can be made, getting the fraud reported fast enough for the banks to freeze the destination accounts, and putting a written complaint on the record before anyone forgets the timeline. Do them in that order, and do them today.

Most of the legal rights that protect you are triggered by when you notified, not by how sympathetic your story is. The RBI's directions on unauthorised electronic transactions, the freeze mechanism behind the 1930 helpline, and the police's own record all run on timestamps.

Minutes one to ten: block the card

Stop the bleeding first. Use the bank's app to freeze the card, and telephone the bank's twenty-four hour helpline to have it blocked officially. Freezing it yourself in the app works immediately, but the telephone call creates a record with a complaint or reference number, and you will need that number later. If the card is linked to a wallet, a subscription or a UPI mandate, cancel or suspend those mandates too, so a blocked card does not quietly keep funding them. Ask the helpline to confirm in writing, by e-mail or SMS, that the card was blocked at the time you called.

The first hour: report on 1930 and get a freeze

The 1930 helpline and the cybercrime.gov.in portal feed the Citizen Financial Cyber Fraud Reporting and Management System, through which banks act on a reported fraud and place holds on funds traceable to it. Speed here is the single most valuable thing you can do, because money that is still sitting in the beneficiary account can be frozen, and money that has been layered through five accounts usually cannot.

Have the transaction details ready before you call: the card number's last four digits, the amount, the date and time, the merchant or beneficiary details, and your bank account information. Report each fraudulent transaction separately, and note the acknowledgement reference for the portal entry. Where the fraud is a card-not-present fraud, the freeze is aimed at the receiving account; where the card was cloned and used at an ATM or a shop, the reporting still matters and the police can also seek the CCTV footage before it is overwritten.

The same day: the written complaint to the bank

Telephone blocking is not a complaint. The bank's liability is decided by the written complaint you make to it, and by when you made it. Send the complaint by e-mail to the bank's grievance address and, separately, to its designated nodal officer for unauthorised transactions. State the facts plainly: the card was in your possession, you did not authorise these transactions, here are the details, please reverse them and confirm the freeze.

Ask for a complaint number, ask for a written acknowledgement, and ask the bank to state which of the fraudulent transactions it treats as unauthorised. Keep every reply. Where the card was used at a merchant, ask the bank to raise a chargeback through the card network against the merchant's acquirer, and get the chargeback reference. A chargeback and a liability claim under the RBI framework are different things, and you can pursue both.

The RBI rule you are racing against

The RBI's directions on customer protection for unauthorised electronic banking transactions set a graded liability regime. Where the unauthorised transaction was caused by contributory fraud or negligence on the bank's part, or by a third-party breach in which the customer was not negligent, the customer's liability is nil. Where the loss was caused by the customer's own negligence, liability is limited as the framework provides. The framework also requires the customer to notify the bank without delay and, in any event, within three working days of receiving a communication about the unauthorised transaction, to claim the benefit of the zero-liability rule. Under the framework, where the customer's liability is nil, the bank is required to credit the amount within a fixed short period measured from the complaint.

That is why the written complaint, and its timestamp, is the heart of the case. A bank that receives the complaint on day four is entitled to ask why you waited.

What to do, hour by hour

When	What you do	Why it matters
First ten minutes	Freeze the card in the app and by telephone	Prevents further debits and creates a reference number
First hour	Report on 1930 or cybercrime.gov.in	Triggers a possible freeze on the destination accounts
First few hours	E-mail the bank's grievance cell and nodal officer	Starts the RBI liability process and the clock
Same day	Ask for the chargeback to be raised	Recovers from the merchant side where a card was used
Same day	Collect and back up all evidence	The evidence is time-stamped and hard to recreate later
Within a day or two	File the police complaint or FIR	Gives the freeze and the chargeback an investigating record

The police complaint and the FIR

Credit card fraud is a crime, not merely a service dispute. Inducing you to part with money by deception is cheating under section 318 of the BNS, 2023, and section 319 makes cheating by personation an offence. On the technology side, section 66C of the IT Act, 2000 punishes identity theft, the fraudulent use of another person's password or unique identification feature, and section 66D punishes cheating by personation using a computer resource. Where card data or a device was interfered with, section 43 of the IT Act and the compensation provisions around it also become relevant.

File the complaint at the police station with jurisdiction, or first online on cybercrime.gov.in and then at the station. Under section 173 of the BNSS, 2023, the police must register the information if it discloses a cognizable offence, and they must give you a free copy of the record. Take the receipted copy with you and keep it with the bank complaint.

Evidence to gather before the day ends

Every SMS and e-mail alert for each fraudulent transaction, forwarded to yourself and backed up.
A copy of the card statement showing the transactions, downloaded from net banking.
Screenshots of the app, the phishing message, the fake payment page or the caller's number.
The bank's acknowledgement and the 1930 or portal reference number.
The chargeback reference, if one has been raised.
A short written note of what you did, and at what time, on the day of the fraud.

Mistakes in the first 24 hours

Waiting for the monthly statement before reporting, which can push you past the framework's reporting condition.
Sharing an OTP, PIN or CVV with a caller who claims to be from the bank or from a fraud-prevention team. No genuine bank officer asks for these.
Reporting only in the app and never in writing to the nodal officer.
Deleting the phishing message or the alert SMS after forwarding it.
Paying a "recovery agent" who promises to get the money back.
Assuming the bank will treat a verbal call centre complaint as a formal complaint.

If the card was used at an ATM or at a shop

A card that was physically misused, whether cloned at an ATM or skimmed at a shop, leaves evidence that will not wait. Ask the bank, in writing, to preserve the transaction logs and the location data for those transactions, and ask the police to seek the camera footage at the ATM or the merchant's premises. Such footage is often overwritten within a few weeks, which is why the request belongs in the first complaint rather than in a reminder weeks later. Note the machine's location and the exact time of each transaction.

If the bank refuses the claim

A refusal is the beginning of the next stage, not the end. Ask the bank for its decision in writing, and for the finding on which it relies. Under the RBI directions the bank is expected to state whether it treats the transaction as unauthorised, and whether it finds the customer negligent. If the answer is a form letter that asserts negligence without a finding, that letter is itself the material for an escalation to the RBI Ombudsman under the Integrated Ombudsman Scheme, 2021. A deficiency in service can also be pursued before a consumer commission under the Consumer Protection Act, 2019, which is often the more affordable route.

What recovery actually looks like

Recovery is not one event. It comes from three places, and they pay out differently. The bank reverses or credits the unauthorised debits where your liability under the RBI framework is nil, usually after an internal enquiry. A chargeback through the card network recovers from the merchant side where the card was used at a merchant. Criminal restitution, if it happens at all, depends on the offender being traced and convicted, and it can take years. Assemble all three rather than betting on one, and remember that the first two depend on how fast you reported.

Card protection plans and insurance

Some banks and card networks sell protection plans that cover certain unauthorised use or provide assistance services. A plan does not replace the RBI liability framework, and it does not excuse the bank from its own obligations, but where you hold one it is worth checking its terms on the same day and notifying the insurer or assistance service as well. Read the exclusions before you rely on it; negligence on the cardholder's part is commonly excluded, and the same facts that defeat a liability claim can defeat a plan claim.

If the same card is hit again

Repeated unauthorised debits after you have reported the first one are significant, and they should not be treated as a nuisance. They suggest the instrument is still compromised, or that a stored credential or mandate is still live. Block or reissue the card rather than simply unblocking it afterwards, remove stored card details from shopping sites and wallets, and put the repeat incidents into a fresh written complaint. A pattern of repeat debits on a card the bank has already been told about strengthens the argument that the deficiency, and therefore the liability, sits with the bank.

When to involve a lawyer

A lawyer is not needed to block a card, but is worth involving once the bank refuses the claim in writing, once the amounts are large, or once the same card or account is hit repeatedly, which points to a breach the bank may be responsible for. A refusal letter should be answered with the RBI framework, not with a fresh call to the call centre, and where the refusal continues the RBI Ombudsman route and the consumer route open up. Our overview of cyber crime law explains how these claims are structured, and the cyber crime work in Kolkata page sets out how the police and bank tracks are run together. You can contact the chamber once you have the bank's written answer.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What should I do first after credit card fraud?

Block the card immediately, both in the bank's app and by telephone to the twenty-four hour helpline, and note the reference number. Blocking first prevents any further unauthorised debits. Then report the fraud on the 1930 helpline or on cybercrime.gov.in, because that report is what allows banks to freeze funds traceable to the fraud.

How long do I have to report credit card fraud to my bank?

Under the RBI's directions on unauthorised electronic transactions, you must notify the bank without delay and, in any event, within three working days of receiving a communication about the unauthorised transaction, to claim the benefit of the zero-liability rule. Reporting later does not end your rights, but it weakens the claim considerably.

Is credit card fraud a police matter or a bank matter?

Both. The bank handles the reversal, the chargeback and the RBI liability claim. The police handle the crime, because inducing a person to part with money by deception is cheating under section 318 of the BNS, 2023, and misuse of card credentials attracts sections 66C and 66D of the IT Act, 2000. File on both tracks the same day if you can.

Can the bank refuse to refund an unauthorised card transaction?

Only where the evidence actually supports a finding of customer negligence. Under the RBI framework, liability is nil where the deficiency was the bank's or where a third-party breach occurred without customer negligence. Banks sometimes refuse by asserting negligence without making that finding, and such a refusal can be challenged before the RBI Ombudsman.

What evidence should I preserve after credit card fraud?

Keep every transaction alert and e-mail, a downloaded copy of the card statement, screenshots of the phishing message or fake page, the bank's acknowledgement, the 1930 or portal reference number, and any chargeback reference. Also write a short dated note of what you did and at what time. This evidence is time-stamped and difficult to recreate later.

Will the police recover my money after credit card fraud?

Recovery depends mainly on speed. Banks act on a reported fraud to place a hold on funds still sitting in the destination accounts, which is why the 1930 report in the first hours matters more than anything the police can do later. Once the money has been layered through several accounts, recovery becomes very difficult, regardless of the investigation.

Should I share an OTP with a bank official to stop the fraud?

Never. No genuine bank officer, fraud-prevention team or police officer will ask for your OTP, card PIN or CVV. Sharing one of these makes the transaction look authorised and gives the bank a strong argument that the loss was caused by your own negligence, which moves you from nil liability to limited liability under the RBI framework.

What is a chargeback in a credit card fraud case?

A chargeback is a reversal raised through the card network against the merchant's acquirer, used where the card was debited at a merchant. It is separate from the RBI liability claim against your own bank, and you can pursue both. Ask your bank to raise the chargeback on the day you report the fraud, and keep the reference number it gives you.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact