The Statement That Did Not Add Up
The credit-card statement arrives on the 5th of the month. Three transactions stand out — a Rs. 38,000 charge to a merchant in Cyprus, a Rs. 17,000 charge to a marketplace you have never used, and a Rs. 9,800 EMI conversion you never asked for. You did not lose your card. The plastic is sitting in your wallet. You did not get a single transaction OTP — until you scroll back and find one buried under a flood of "promotional" messages: a single OTP that you never typed in, but that was somehow "successfully verified" at 11:08 PM the night you took a phishing call about an "expired reward".
This article is the calm guide for that moment. The path from "this is not my charge" to "the money is back" is paved with five things — fast block, written dispute, FIR, evidence file, and a refund route under the RBI customer-protection framework. The earlier you start, the shorter the path.
Which Laws Cover Online Card Fraud?
Section 43 read with Section 66 IT Act
Section 43 of the Information Technology Act, 2000 creates civil liability for unauthorised access to a computer or computer system, downloading data, damaging the system, or accessing a computer resource without permission. Section 66 turns it into a criminal offence when done dishonestly or fraudulently, with imprisonment up to three years or fine up to five lakh rupees, or both. The IT Act commentary explains that Section 43 "covers everybody" — individuals, banks, payment gateways. When a fraudster pulls money via your card without your permission, the unauthorised-access framework applies.
Section 66C — identity theft
Section 66C punishes the fraudulent or dishonest use of someone's electronic signature, password or "any other unique identification feature". The commentary stresses that the words "any other unique identification feature" are deliberately broad and futuristic — they cover card numbers, CVVs, OTPs, biometric authentication and any other credential that uniquely identifies a person on a computer or communication device. Punishment: up to three years imprisonment and fine up to one lakh rupees.
Section 66D — cheating by personation using a computer
Section 66D punishes "cheating by personation" using a computer resource or communication device. The commentary points out that 66D imports the IPC concept of cheating by personation (Section 416) into the digital world. A fake "Customer Care", a fake reward portal, a phishing site mimicking your bank — each is personation. Punishment: up to three years and fine up to one lakh rupees.
The Forgery Layer — Sections 463 to 471 IPC
What separates ordinary cheating from sophisticated card fraud is forgery. The IPC defines forgery in Section 463 (making a false document or false electronic record with intent to cause damage or to commit fraud) and Section 464 (which spells out who is said to make a false document). Section 467 punishes forgery of a valuable security or a will with imprisonment up to life or up to ten years. Section 468 punishes forgery for the purpose of cheating. Section 471 punishes the use of a forged document or electronic record as genuine.
The commentary on Section 463 walks through illustrations — including a person who fraudulently fills up a blank cheque, or who endorses a Government promissory note with a forged endorsement. Each illustration maps neatly onto modern card-fraud techniques. A fraudster who creates a fake merchant page, a counterfeit electronic invoice, a cloned magnetic stripe or a forged "card present" entry has made a false electronic record. When that record is used as genuine to clear a transaction, Section 471 is also attracted.
An FIR for serious online card fraud should plead Section 66C and 66D IT Act, Section 420 IPC, and where forgery is shown, Sections 467, 468 and 471 IPC together.
Cheating and Inception of Intent
The IPC defines cheating in Section 415 — deception of any person, dishonest inducement to deliver property, with damage or harm. Section 420 punishes cheating where property is dishonestly delivered, with imprisonment up to seven years and fine. Indian courts have repeatedly held that for Section 420 to apply, fraudulent or dishonest intention must exist at the inception. As the Supreme Court explained in Hridaya Ranjan Pd. Verma v State of Bihar (2000), dishonest intention "at the beginning of negotiations" is essential. In Inder Mohan Goswami v State of Uttaranchal (2007), the Court repeated that mere failure to keep a promise is not cheating; the intent must be present when the inducement starts.
Apply that to a phishing call or a fake reward page. The fraudster set up the page, the call and the look-alike domain to deceive you from the very first contact. The intent to cheat exists at the inception of the transaction. This is exactly the kind of fact-pattern Section 420 was meant to capture, and the FIR should plead it explicitly.
Chargeback vs RBI Customer-Protection Framework
Chargeback
Chargeback is a card-network mechanism (Visa, Mastercard, RuPay, AmEx, Diners) where you raise a dispute through your issuer, and the issuer charges the amount back to the merchant's bank if the dispute is upheld. Reason codes include "fraudulent transaction — no cardholder authorisation", "merchandise not received", "cancelled recurring transaction" and others. The window is typically 60 to 120 days from the statement date. Submit the dispute on the issuer's official form, attach the statement and screenshots, and ask for a temporary credit pending resolution.
RBI customer-protection framework
The Reserve Bank of India's circular on customer protection in unauthorised electronic banking transactions covers credit cards along with other account-based products. Three buckets:
- Zero customer liability — bank's own contributory fraud or negligence (irrespective of customer reporting), or third-party breach with the loss reported within prescribed working days where neither bank nor customer is at fault.
- Limited customer liability — third-party breach where the customer reported promptly. Liability capped at small statutory amounts.
- Full liability up to date of reporting — customer's own negligence (sharing the OTP / card details). After reporting, further loss shifts to the bank.
Run both routes — chargeback and RBI customer-protection — together. Chargeback works on the merchant side, the customer-protection circular works on the issuer side.
Evidence Checklist for the Refund File
A clean evidence file is the difference between a refused dispute and a quick credit. Save and back up:
- The credit-card statement showing the disputed transaction, with reference / approval codes.
- The SMS / email transaction alert and your inbox showing the date and time of the alert.
- The merchant name and ID exactly as it appears on the statement.
- Your dispute form, all written communications and the issuer's reasoned reply.
- The 1930 acknowledgement number and cybercrime.gov.in complaint ID.
- A copy of the FIR with the section list.
- The phishing message / call recording / fake link, if the fraud started there.
- Any device or location logs you can pull — your travel records, your phone's location history, anything that shows you could not have made the transaction yourself.
- Your CIBIL report — a fraudulent loan or new card opened in your name strengthens the identity-theft claim under Section 66C.
Also pull the bank's transaction-monitoring records and IP / device logs of the disputed transactions through a written request. If the bank refuses, push the request through the RBI Banking Ombudsman or the District Consumer Commission for banking deficiency in service.
Filing the FIR and Pushing the Investigation
The FIR is registered under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (the new code that replaced Section 154 of the old CrPC). The FIR commentary describes it as the foundation of the criminal investigation — the document that triggers the police's powers under the procedural code. Visit the cyber police station with bank statements, screenshots, the 1930 acknowledgement, the cybercrime portal complaint ID, and your ID proof.
Ask for the FIR to be registered under Sections 66C, 66D of the IT Act, Section 420 IPC for cheating, and Sections 467, 468 and 471 IPC where forgery of documents or electronic records is shown. Where the fraud also misused your KYC to open new accounts or take loans, add the same offences with separate transaction-by-transaction particulars.
If the SHO refuses, escalate by registered post to the SP/SSP under Section 173(4) BNSS (corresponding to Section 154(3) CrPC). If the police still do nothing, file a complaint to the Judicial Magistrate under Section 175(3) BNSS (corresponding to Section 156(3) CrPC) — the route confirmed by the Supreme Court in Sakiri Vasu v State of Uttar Pradesh (2008). The Magistrate can direct the police to register and investigate, and even monitor the progress.
What Should I Actually Do Now?
- Block the card through the issuer's app or 24×7 fraud-helpline number. Note the block reference number.
- Submit the dispute form on the issuer's portal within 24 hours, citing each transaction by amount, date and merchant.
- Call 1930 and file at cybercrime.gov.in. Note acknowledgement numbers.
- Lodge the FIR at the cyber police station within 48 hours under Sections 66C, 66D IT Act, 420 IPC, and 467, 468, 471 IPC where forgery is involved.
- If the FIR is refused, escalate to the SP/SSP under Section 173(4) BNSS, then to the Magistrate under Section 175(3) BNSS.
- Send a structured legal letter to the issuer by email and registered post, quoting Section 66C, 66D IT Act, the RBI customer-protection circular and demanding reasoned reply within 30 days.
- If the issuer refuses, escalate to the Internal Ombudsman, the RBI Banking Ombudsman, and the District Consumer Commission.
- Pull a CIBIL report after two weeks to confirm no fraudulent loan or card has been opened in your name.
- Change every password — net banking, email, OTP delivery number — and enable two-factor authentication everywhere.
- Maintain the timeline file. Every call, every reference number, every reply — single document, dated.
When a Lawyer's Letter Tilts the Table
A well-drafted lawyer's letter often shifts a stalled credit-card-fraud dispute back into motion. It does three things at once — quotes the right RBI circular paragraphs, the right IT Act and IPC sections (especially the forgery layer that issuers rarely engage with), and a clean route to the Internal Ombudsman, the Banking Ombudsman and the Consumer Commission. At Pinaka Legal we have helped clients close out card-fraud disputes at the bank stage and, where necessary, taken matters into the District Consumer Commission with full restitution and compensation. If you have a refusal letter from the bank in hand, a single consultation can map the next thirty days.
A Fight Worth Finishing
Online credit-card fraud has a way of feeling shameful even when nothing about it is your fault. The system that took your money has a system that gives it back — chargeback rules built into the card networks, a customer-protection circular built by the RBI, and a stack of IT Act and IPC sections built into the criminal law. The catch is that nobody runs that system for you automatically. The block, the dispute, the FIR, the evidence, the escalations — they are all manual. Walk through them with a clear head and a dated file. The credit goes back faster than you fear, and your statement next month is a quieter document.
Frequently Asked Questions
What should I do first if my credit card has been used fraudulently online?
Block the card immediately through the issuer's app or 24×7 hotline, then dispute the transaction in writing within working days. Call 1930, file at cybercrime.gov.in, and lodge an FIR at the cyber police station under Sections 66C, 66D of the IT Act and Section 420 IPC, adding 467, 468 and 471 IPC where forged documents or screenshots are involved. The order matters: block first to stop further use, then escalate to dispute, refund and FIR. Keep every reference number — block ticket, dispute number, 1930 acknowledgement and FIR copy.
What evidence do I need to claim a refund for online card fraud?
Save the credit card statement showing the disputed transaction, the SMS / email alert, the merchant name and ID, the date and time, the IP / device record where available, your dispute form, written replies from the issuer, the FIR copy, the 1930 acknowledgement and the cybercrime portal complaint ID. If the fraud started with a phishing call or message, save that too. The clearer the evidence trail, the easier it is to push the issuer through the chargeback or the RBI customer-liability framework.
Which sections will the police use in an FIR for credit-card fraud?
The standard package is Section 66C of the IT Act (fraudulent use of unique identification features such as your card number, CVV and OTP), Section 66D (cheating by personation using a computer resource), and Section 420 IPC (cheating by inducing delivery of property). Where the fraudster used forged screenshots, fake KYC, fake merchant pages or counterfeit cards, Sections 467, 468 and 471 IPC for forgery, forgery for cheating, and use of forged documents are added. Section 43 read with Section 66 IT Act covers any unauthorised access to your computer or account.
What is a "chargeback" and how does it differ from an RBI refund?
A chargeback is a card-network mechanism (Visa, Mastercard, RuPay, AmEx) where you dispute a transaction through your issuer, and the issuer charges the amount back to the merchant's bank if the dispute is upheld. The RBI customer-protection framework is a domestic regulatory mechanism that limits a customer's liability for unauthorised electronic banking transactions based on how quickly the customer reports. Use both — the chargeback for merchant-side disputes, the RBI framework for unauthorised-transaction disputes with your own issuer.
Can the bank refuse refund saying the OTP was used?
Banks try, but the position is not as final as their letter suggests. Where the OTP was extracted by Section 66D cheating-by-personation — the fraudster pretending to be the bank, the merchant or a courier — the customer's consent is vitiated by deception, as the IPC defines cheating in Section 415. The RBI customer-liability framework also caps loss for prompt-reporting third-party-breach cases. Demand reasoned written reasons, escalate to the Internal Ombudsman, then to the RBI Banking Ombudsman, then to the District Consumer Commission.
How does the RBI customer-liability framework apply to credit cards?
The RBI's framework on customer liability for unauthorised electronic banking transactions covers credit cards alongside other account-based products. Three buckets apply: zero liability where the bank's own fraud or negligence caused the loss, limited liability where a third party caused the breach and the customer reported promptly, and full liability up to the date of reporting where the customer's own negligence caused the loss. After reporting, further loss shifts to the bank. The exact thresholds and time windows are set out in the circular itself.
What if a fraudster used my card on an international merchant?
International transactions still pass through your issuer and the card network — the same chargeback and RBI customer-protection routes apply. Insist on a chargeback under the relevant network's reason code (fraudulent transaction, no cardholder authorisation), and a parallel dispute under the RBI customer-liability circular. Indian police can register the FIR under Section 66C, 66D IT Act and Section 420 IPC even when the merchant is foreign, because the offence is committed by misuse of your credentials in India.
How long do I have to dispute a fraudulent credit card transaction?
As soon as possible. Card-network chargeback rules typically require disputes within 60 to 120 days of the statement, depending on the dispute reason. The RBI customer-liability circular ladders your liability on the day of reporting — the sooner you tell the issuer, the smaller your liability cap. The simplest rule: report within minutes of the SMS / email alert, get a written acknowledgement of date and time of complaint, and submit the formal dispute form within the issuer's stipulated working days.
Should I lodge an FIR even if my issuer is processing the dispute?
Yes. The dispute and the FIR run on different tracks. The dispute is between you and the issuer about money. The FIR under Section 173 BNSS triggers the criminal investigation that traces the offender, freezes mule accounts, and creates evidence the issuer cannot ignore. Many issuers ask for a copy of the FIR or the 1930 acknowledgement before crediting the disputed amount. An FIR also protects you if the issuer eventually refuses and you have to escalate to the Banking Ombudsman or the District Consumer Commission for banking-service deficiency.
What if my card was cloned or skimmed offline and used online?
Cloning and skimming attract Section 43 (unauthorised access to a computer resource) read with Section 66 IT Act, plus Section 66C (identity theft) and Sections 463, 464, 467, 468 and 471 IPC for forgery and use of forged electronic record. The illustrative examples in the IPC commentary on forgery — including making a false document with intent to cheat — fit cloned-card cases neatly. Add Section 420 IPC for the cheating layer. The FIR should specifically describe how and when the card details could have been compromised.
Can I claim compensation beyond just the disputed amount?
Yes, in the right forum. Before the District Consumer Commission, you can claim refund of the disputed amount, interest from the date of debit, compensation for mental harassment and loss of credit standing, and litigation costs. The RBI Banking Ombudsman can also direct compensation for deficiency in service. In a parallel criminal case under Section 420 IPC, the Magistrate at sentencing can direct restitution. Document the harm — denied transactions, EMI bounce, CIBIL impact — to push the compensation number higher.
What if the bank takes too long to refund or dispute the transaction?
Push back in writing. The RBI circular and the bank's grievance-redressal policy set deadlines. Keep escalation receipts: branch, grievance cell, Nodal Officer, Internal Ombudsman. After the bank's stipulated period or 30 days from the first complaint — whichever is earlier under the circular — file a complaint with the RBI Banking Ombudsman through cms.rbi.org.in. If service deficiency continues, file before the District Consumer Commission. The bank cannot use its own delay against you; your liability is fixed at the date of your complaint.
For more articles on Indian law, visit the Pinaka Legal Blog. For queries, call +91 8595704798 or email info@pinakalegal.com.