When credit card theft occurs, immediate action is crucial for determining liability. According to Mint reports, customers must block their cards through the issuer's mobile app, internet banking, or dedicated helpline without delay. RBI directions require card issuers to block lost cards immediately after being informed by the cardholder, with issuers also providing multiple 24x7 reporting channels and sending confirmation after the card is blocked. The timing of the report can be critical if there's a dispute over who should bear the loss. As per Zee News, losing the card does not automatically put the liability on the cardholder - who bears the cost depends on the time of reporting the incident and how the incident happened.
The Reserve Bank of India has established clear guidelines for unauthorised electronic banking transactions that limit customer liability. As reported by Mint, customers may have zero liability where there is fraud, negligence, or deficiency on the bank's part. Zero liability may also apply in third-party breaches where neither the bank nor the customer is at fault, provided the customer notifies the bank within three working days of receiving communication about the unauthorised transaction. For cases reported between four and seven working days, liability may be limited according to RBI prescribed caps and account nature, while beyond seven working days, liability is determined under the bank's Board-approved policy. According to Zee News, in cases of negligence or unauthorised transactions linked in any way to the bank, the customer does not have to pay anything, irrespective of the duration taken to report the theft.
According to Mint reports, the number of days taken to report the transaction can determine the customer's liability. Ashish Lath, Founder and CEO of SaveSage, explained that fraudulent transactions do not automatically become the cardholder's responsibility and depend on how the fraud occurred and when the bank was informed. Once the loss or theft is reported and the card is blocked, any subsequent unauthorised transaction should ordinarily be borne by the bank, according to Aditya Soni, Founder and CEO of CheQ. However, for transactions made before the loss is reported, liability is determined according to RBI guidelines and the card issuer's customer protection policy. As per Zee News, for the refund to be guaranteed, it is important that there was no negligence on the part of the cardholder. If the customer has shared the credentials with a third party or handed over the card, he/she may have to bear the cost until the bank is notified about the unauthorised transaction.
Recent regulatory developments in Poland highlight the distinction between authorization and authentication in banking fraud cases. According to UOKiK (Polish Financial Supervision Authority) decisions, banks must consider possible third-party interference in transaction processes beyond just technical authentication data. The authority emphasizes that gross negligence on the consumer's part should not be equated with transaction authorization, though it may affect the scope of payer liability. Banks must first refund funds within statutory time limits under Article 46(1) of the Payment Services Act, with exceptions only for reasonable fraud suspicions reported to law enforcement authorities.
Customers must check recent transactions, report every unauthorised charge, and retain complaint or reference numbers when dealing with stolen credit cards. As reported by Mint, if the customer was negligent — for instance, by sharing payment credentials — the customer may bear the loss until the unauthorised transaction is reported to the bank. The RBI places the burden of proving customer liability on the bank, and customers should document all communication with the issuer regarding the theft and any subsequent disputes over liability. According to Zee News, it is better for the customer to keep records of unauthorised transactions, the timing of the complaint made, and the bank's response. Payment service providers should review their procedures for handling unauthorized transaction reports and ensure compliance with both domestic regulations and international banking standards. In case the bank does not promptly act, the customer has the provision to approach the RBI Ombudsman, with the bank having 90 days to resolve the complaint and prove the customer's liability, if any; otherwise, compensation is provided as per RBI's guidelines.
