You get an SMS at 11:47 PM. It looks like HDFC Bank. It says your card will be blocked in 30 minutes. There is a link. You click. You type your card number, expiry, CVV, and the OTP that just arrived. By the time you finish breakfast, ₹78,000 is gone from your credit limit.
This is one of 12 credit card fraud types in India that millions face every single day. Some are old. Some are brand new. All of them work because most people only learn about a scam after they fall for it.
This guide walks you through every major type, how to spot each one, what RBI rules guarantee you, and what to do in the first 60 minutes if it happens to you.
What Is Credit Card Fraud? A Quick Definition
Credit card fraud in India is any use of your card or card details without your permission. It happens in three ways. Someone takes the physical card. Someone gets the card numbers and uses them online. Or someone uses your identity to get a new card in your name.
The result is the same. Charges show up that you did not make. Money you did not spend leaves your account.
Credit card complaints jumped over 20% in FY25 under the RBI Ombudsman Scheme. Card grievances are now the second-largest category of banking complaints in India. The scale is real.
The 3 Big Families of Credit Card Fraud in India
Most articles list 8 or 10 scams in a random order. That makes it hard to remember any of them. A cleaner way is to group all credit card fraud in India into three families, based on what the thief is actually stealing.
| Family | What the thief takes | Common examples |
| Physical fraud | The card itself | Lost card, stolen card, skimming, cloning |
| Digital fraud | Your card details | Phishing, vishing, SIM swap, malware, online fraud |
| Identity fraud | Your personal identity | Application fraud, account takeover |
Once you see this split, every news story about a new scam fits into one of the three buckets. That makes it easier to spot one early.
The 12 Types of Credit Card Fraud in India (Explained)
Here are the 12 ways credit card fraud happens in India today. For each one, you get what it is, how it works in real life, and the one red flag that gives it away.
1. Phishing Scams on HDFC, SBI, and Indian Banks
A scammer sends you an email or SMS that looks like it is from your bank. The message says something urgent. Your card is blocked. A big transaction needs approval. KYC is pending. There is always a link.
You click the link. It opens a page that looks just like the real bank website. You type in your card details. The scammer now has everything needed to drain your card. Phishing impersonating HDFC, SBI, ICICI, and Axis Bank is the most reported credit card fraud type in India.
Red flag: Any link in an SMS or email that asks for card number, CVV, or OTP. Banks never send those links.
2. Vishing (Voice Call Credit Card Scams in India)
Your phone rings. The caller says they are from your bank, RBI, or the card network. They say there is a problem with your card. To “verify” you, they ask for your card number, CVV, and the OTP you will receive in a minute.
The OTP they want is for a transaction they are doing right now. You read it out. The money is gone before the call ends.
Red flag: Any phone call asking for an OTP. Real banks and RBI never ask for OTPs over the phone. Ever.
3. Smishing (Fake SMS Bank Fraud)
This is the SMS version of phishing. The message often says “Click here to update your PAN” or “Your account will be deactivated, click here.” The link goes to a fake page.
India sees a lot of this because most people read every SMS that arrives. Scammers use sender IDs like “BANK-HDFC” or “RBIIND” to look real.
Red flag: Urgency plus a short link. Real banks send links from verified app or domain names, never bit.ly or tinyurl.
4. ATM Card Skimming Fraud
A skimmer is a small device fitted onto an ATM card slot, fuel pump, or shop POS machine. When you swipe your card, the skimmer copies the data on the magnetic strip. A hidden camera sometimes records your PIN at the same time.
The thief then puts your data on a blank card and uses it. In one Mumbai case, criminals fitted skimmers on fuel-station pumps and stole details from hundreds of cards before being caught.
Red flag: Anything loose, plastic, or out of place on an ATM slot or PIN pad. Wiggle the card reader before you insert your card.
5. Card-Not-Present (CNP) Online Credit Card Fraud
The thief has your card number, expiry, and CVV but not the physical card. They use the details for online purchases on sites that do not need an OTP, or they hit foreign sites where Indian OTP rules do not apply.
CNP fraud is one of the most common credit card fraud types in India because it does not need any contact with you at all. Your data leaks from a website hack, and the fraud happens months later.
Red flag: Small “test” charges of ₹1 or ₹10 you did not make. Scammers test the card with a tiny amount before the big hit.
6. SIM Swap Fraud in India
The fraudster calls your mobile operator. They pretend to be you. They claim your SIM is lost and ask for a duplicate. Once it activates, your phone shows “No service” and every OTP now goes to the thief’s phone.
From there, they reset your bank password, log in, and authorise transactions using the OTP that lands on their device. The whole thing can finish in 30 minutes.
Red flag: Your phone suddenly stops working with no reason. If your phone shows “No service” for more than an hour, call your bank to freeze the card right away.
7. Credit Card Account Takeover Fraud
The thief gets into your net-banking or card account using stolen login details. The first thing they do is change your registered phone number and email. Now every OTP and alert goes to them, not you.
You learn about it only when the bill arrives, or when a real transaction of yours gets declined.
Red flag: SMS or email saying “Your contact details have been updated” when you did not update anything. Call the bank that minute.
8. Application Fraud Using Stolen PAN or Aadhaar
Someone uses your PAN, Aadhaar, or stolen documents to apply for a credit card in your name. The card gets delivered to an address they control. They run up bills. You find out only when you check your credit report or a collection call lands.
This works because Indians throw away photocopies of ID without shredding them. Old credit card statements, address proofs, and form-fillers’ offices are all leak points.
Red flag: A card or welcome kit you did not apply for. Or an unexpected drop in your CIBIL score.
9. Lost or Stolen Card Fraud
The oldest credit card fraud type in India. Your card falls out at a movie theatre or gets pulled from your wallet on a crowded train. The thief uses it before you notice. Contactless cards make this worse, because the first few small purchases need no PIN.
Cards stolen in transit (between the bank and your home) also fall in this bucket. The card arrives in the post, gets taken from the mailbox, and you never see it.
Red flag: Any time you cannot find your card. Do not wait to “look one more time.” Block it through the app immediately. Banks reissue cards for free.
10. Keystroke Logging and Malware Fraud
You click a sketchy link or download a “free PDF” from a random site. A small program installs on your laptop without you knowing. It records every key you press. When you next type your card number on a shopping site, the program sends it to the thief.
Public computers (in cyber cafés, hotels, and shared offices) are the worst place for this. So is any “cracked” software you download.
Red flag: Sudden slowness on your computer, strange pop-ups, or browser pages that redirect on their own. Run a virus scan and avoid card use on that machine until it is clean.
11. Counterfeit Cards and Cloning Fraud
Once a thief has your magnetic-strip data from a skimmer, they copy it onto a blank card. That blank card now works at older machines that read the magnetic strip and not the chip.
Most Indian cards now use the chip and EMV system, which makes cloning much harder. But cloned cards still work at petrol pumps and older POS machines, especially in tier-2 and tier-3 cities.
Red flag: Charges from a city you have never visited. Cloned cards are often used far from where the original was skimmed.
12. Friendly Fraud and Chargeback Abuse
This is the only fraud where the “thief” might be someone you know. A family member borrows your card with your okay, buys something, and you later raise a dispute claiming you did not make the purchase. The bank refunds you. The merchant loses the money.
It is also called chargeback fraud. Indian banks are now flagging this more aggressively. Repeat offenders get their cards closed and find it hard to get new ones from any bank.
Red flag: If you let someone use your card, you own that charge. Disputing it later is fraud, not a free refund.
Red Flags: How to Spot Credit Card Fraud Early
Most fraud victims notice the problem two or three days late. That delay costs them money and often costs them their zero-liability protection. Here are the early signs to watch for.
- Charges on your statement you do not recognise, even small ones
- OTPs arriving for transactions you did not start
- SMS or email saying “Your contact details have been updated” when you did not update them
- Login alerts from a city or device you do not use
- Your card gets declined even though you have credit limit available
- A welcome kit, PIN mailer, or card you never asked for
- A sudden drop in your CIBIL score with no reason you can think of
- Collection calls for a bill you never created
- Your phone stops getting signal for an hour or more
Any one of these is a reason to call the bank. Two or three together mean fraud is already in motion.
RBI Guidelines for Credit Card Fraud and Customer Liability
This is the part most people skip and most articles get wrong. The RBI guidelines for credit card unauthorized transaction are clear on who pays when fraud happens. The number that matters most is how fast you report it.
The faster you report, the less money you lose. Here is the RBI liability ladder.
| When you report | Who pays |
| Within 3 working days | You pay nothing. The bank refunds the full amount. |
| Between 4 and 7 working days | You pay a capped amount, usually between ₹5,000 and ₹25,000 depending on card type. |
| After 7 working days | Liability follows the bank’s policy. Often the full amount falls on you. |
| Fraud caused by bank or third-party negligence | You pay nothing, no matter when you report. |
The third row is the painful one. People wait two weeks because they think the bank will “just sort it out.” By then, the law no longer protects them.
Beyond RBI rules, the IT Act 2000 and the Consumer Protection Act 2019 give you the right to claim compensation if the bank fails to handle your case properly. The Banking Ombudsman (escalation path at rbi.org.in) is the route if your bank drags its feet for more than 30 days. For cybercrime cases, the official portal is cybercrime.gov.in, and the national helpline number is 1930.
How to Report Credit Card Fraud Online in India: The 60-Minute Action Plan
Most people freeze in the first hour. They check the SMS three times, hope it is a mistake, and then call a friend. Every minute spent doing that is a minute the thief keeps spending. Here is exactly how to report credit card fraud online in India, step by step.
- Minute 0 to 5: Block the card. Open your bank app and freeze the card. Most banks (HDFC, ICICI, Axis, SBI, Kotak, IDFC First) have a one-tap freeze. No call needed.
- Minute 5 to 15: Call customer care. Report the fraud over the phone and note down the complaint number. Without a complaint number, the 3-day clock does not start.
- Minute 15 to 30: File a dispute form. Most banks have a digital dispute form in the app. Fill it with the exact transaction date, amount, and merchant name.
- Within 24 hours: Lodge a cybercrime complaint. Go to cybercrime.gov.in and file a report. You can also call the national helpline 1930.
- Within 72 hours: File an FIR. Do this if the amount is large or if a physical card was stolen. The FIR copy is needed for some disputes.
- Within 7 days: Send a written complaint letter for credit card fraud. Email the bank with the dispute reference, transaction details, and proof of your earlier reports. Keep a paper trail.
- If no resolution in 30 days: Escalate. Take the case to the Banking Ombudsman at rbi.org.in.
- Monitor for 6 months. Check your CIBIL report every month. Fraud often comes back in a second wave.
If you do steps 1 to 4 within 60 minutes, you are inside the 3-day window. The RBI zero-liability rule protects you.
Complaint Letter for Credit Card Fraud: What to Include
Your written complaint letter for credit card fraud should be short, factual, and easy for the bank’s grievance team to act on. Include these 7 things.
- Your full name, registered mobile number, and email
- Card number (last 4 digits only) and the bank branch you belong to
- Date, time, amount, and merchant of every fraudulent transaction
- The exact date and time you first noticed the fraud
- The complaint reference number the bank gave you on the phone
- The cybercrime.gov.in acknowledgement number
- A clear request to refund the disputed amount and confirm in writing within 7 working days
Send it from your registered email to the bank’s official grievance email. CC the nodal officer if 7 days pass without a clear reply.
How to Prevent Credit Card Fraud: A Practical Checklist
Prevention is just a set of small habits. Most of these take less than a minute to set up and pay off for years.
- Never share OTP, CVV, PIN, or card number with anyone, even “bank officials”
- Memorise your CVV, then scratch it off the back of the card
- Turn on SMS and email alerts for every transaction, not just large ones
- Set per-transaction and daily spend limits in your bank app
- Switch off international and online usage when you are not using them
- Use the virtual keyboard on public or shared computers
- Check the ATM card slot and PIN pad before you insert the card
- Tokenise saved cards on shopping sites (RBI rule, your real card number stays hidden)
- Shred old statements and ID copies before throwing them out
- Review your card statement once a week, not just on bill date
- Keep your phone OS and antivirus updated
- Use a different password for your bank than for your email or shopping sites
The single most useful one is the alert for every transaction. A ₹15 SMS fee per month is worth it for a one-minute warning that someone is using your card.
Does Credit Card Fraud Affect Your CIBIL Score?
Fraud itself does not hurt your CIBIL score. A charge you did not make does not pull your number down. But what happens next can.
If the fraudulent charge sits unpaid past the bill date, it gets reported as a missed payment. That hurts CIBIL by 30 to 80 points. Even after the bank refunds the money, the missed-payment mark can take 30 to 60 days to clean up on your report.
The fix is to flag the charge with the bank before the bill due date. Ask in writing that the disputed amount be kept on hold and not reported as overdue. Most banks will agree if you raise the dispute on time.
If your CIBIL report already shows damage from a fraud, write to both the bank and to CIBIL with the dispute resolution letter. They have 30 days to update the report.
Frequently Asked Questions (FAQ)
Will the bank refund my money if I am a fraud victim?
Yes, in most cases. If you report the fraud within 3 working days, RBI’s zero-liability rule means the bank refunds the full amount. The refund usually happens within 7 to 10 working days after the dispute is filed.
Is it my fault if I shared the OTP?
It can be, and this is where many people lose money. RBI guidelines for credit card unauthorized transaction count sharing OTP as customer negligence in many cases. If the bank shows you willingly shared the OTP, you may have to pay the full amount. But if the OTP was intercepted through a SIM swap or malware, that counts as third-party negligence and the bank pays.
Can credit card fraud damage my CIBIL score?
Not directly. But an unpaid fraudulent charge can show up as a missed payment and drag the score down. Always raise the dispute before the bill due date to keep the charge from being marked overdue.
What is zero liability under RBI rules?
It means you pay nothing for unauthorised transactions, as long as you report them within 3 working days of getting the bank’s notification (SMS or email). Zero liability also applies if the fraud was caused by the bank or a third-party data breach, no matter when you report.
How long does the bank take to refund fraud charges?
RBI gives banks 90 days to fully resolve fraud complaints. In practice, a clean case with quick reporting often gets resolved in 10 to 20 days. Complex cases (large amounts, multiple transactions, FIR involved) can take the full 90 days.
How do I report credit card fraud online in India?
Block the card through your bank app, call customer care for a complaint reference, file a dispute form in the app, and then lodge a complaint at cybercrime.gov.in or call 1930. If the amount is large, also file an FIR within 72 hours.
Can I sue my bank if they refuse to refund?
Yes. First, take the case to the Banking Ombudsman at rbi.org.in. This is free and the Ombudsman gives a binding ruling. If that does not work, you can file a case under the Consumer Protection Act 2019 in a consumer court.
Does insurance cover credit card fraud?
Many Indian credit cards come with built-in fraud insurance, often called “card protection” or “lost card liability cover.” It usually covers fraud done in the 24 to 48 hours before you report the card lost. Cover amounts range from ₹50,000 to ₹5 lakh depending on the card. Check your card’s terms and conditions to know what you have.
What is the difference between fraud and a billing dispute?
Fraud is a charge you did not authorise at all. A billing dispute is a charge you made but disagree with (wrong amount, item not delivered, double-charged). Both go through the dispute process, but fraud cases get faster handling and zero-liability protection. Billing disputes do not.
The Verdict
Credit card fraud in India is not one problem. It is 12, and the methods change every year as banks fix old holes. The cards have not become less safe. The criminals have become more creative.
The good news is the rules are tilted in your favour, as long as you act fast. Report within 3 working days and you owe nothing. Wait two weeks and the law stops protecting you. Set up SMS alerts, review your statement weekly, and never share an OTP. Those three habits stop 80% of the credit card fraud types in India described above before they start.