Credit Card Fraud of ₹1.84 Lakhs: Legal Remedies and Steps to Follow

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

TL;DR: If you've been scammed into sharing OTPs and lost money via a credit card, act fast. Immediately call the cyber crime helpline 1930, block your card, and file an FIR at your local police station. Then submit the FIR, a signed dispute form, and supporting documents to your bank. The bank's liability depends on when you reported the fraud, but prompt action gives you the best chance of a reversal.

The client, a software professional from Indore, received a call in early March 2025. Someone claiming to be from HDFC Bank's credit card division offered an instant limit increase. Believing it was genuine, the client shared card details and an OTP. Within minutes, a transaction of ₹1.84 lakhs was processed. Panicked, the client called HDFC customer care. The card was blocked and a fraud complaint was lodged. But the bank said the transaction was already settled. Initial follow-ups went nowhere. That's when the client approached the Chamber of Advocate Sudhir Rao. The office of Advocate Sudhir Rao immediately guided the client to file a formal complaint on the National Cyber Crime Reporting Portal and register an FIR at the cyber crime police station. Expert handling by Advocate Sudhir Rao ensured the FIR captured all relevant facts — including the scammer's phone number and the time stamps — which banks rely on for chargebacks.

Key Facts of the Case

• The scam occurred on 5 March 2025 via a phone call impersonating an HDFC Bank representative.
• The client voluntarily shared credit card details (number, CVV, expiry) and an OTP — this is a critical weakness in the bank's liability argument.
• The fraudulent transaction of ₹1,84,000 was completed and settled within minutes.
• The client reported the fraud to the bank immediately — within 30 minutes — and blocked the card.
• The bank initially refused a reversal, stating the transaction was "authenticated" via OTP.
• The FIR was registered at the Indore Cyber Crime Police Station under Section 318 BNS (cheating) and relevant IT Act provisions.
• The bank's dispute process required: a signed dispute form, FIR copy, Aadhaar, and a self-declaration.

The Direct Legal Answer

Can the transaction be reversed?

Yes — but it depends on timing. Under RBI's circular on limiting customer liability, if you report the fraud within three working days, your liability is capped at ₹10,000 for a credit card. Since the client reported it immediately, the bank must reverse the full amount unless they prove gross negligence on your part.

What should I do right now?

Three things. First, call 1930 — the national cyber crime helpline. Second, file an FIR at your local police station or cyber crime cell. Third, submit the dispute form to your bank with all supporting documents. Keep every email and reference number.

Is the bank responsible?

Yes — if you've not been negligent. However, voluntarily sharing an OTP weakens your position. Banks often argue that OTP sharing equals authorisation. That's why an FIR and a strong legal notice from an advocate are essential to challenge this.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

This type of matter involves both criminal law (cheating, IT Act) and consumer law (bank liability). An advocate who regularly handles banking frauds knows how to approach the bank's internal ombudsman, RBI's complaint portal, and the consumer forum simultaneously. General practitioners often miss these procedural steps.

Also, do not rely only on customer care — send a formal email to the bank's Nodal Officer and Principal Nodal Officer (PNO) with all evidence. Always keep written records.

Applicable Sections of Law

• Section 318 BNS — Cheating: Whoever deceives a person and fraudulently induces them to deliver property. Punishable with imprisonment up to 7 years and fine.
• Section 319 BNS — Cheating by personation: Using someone else's identity to commit fraud. Attracts stricter penalties.
• Section 66D of the Information Technology Act, 2000 — Cheating by personation using computer resource: Punishable with imprisonment up to 3 years and fine up to ₹1 lakh.
• RBI Master Direction on Digital Payment Security Controls — Mandates zero liability for customers if fraud is reported within 3 working days, unless gross negligence is proved.

Punishment and Penalties

• Section 318 BNS: Imprisonment up to 7 years and fine. Cognizable and non-bailable.
• Section 319 BNS: Same punishment as above. Also non-compoundable — meaning the case cannot be settled privately.
• Section 66D IT Act: Imprisonment up to 3 years and fine up to ₹1 lakh. Cognizable and bailable.
• All these offences are cognizable (police can arrest without warrant) and non-compoundable.

Jurisdiction — Where to File the Case

For a cyber crime like credit card fraud, you can file an FIR at the police station where you received the call, where your bank account is located, or where the fraudulent transaction originated. The Indore Cyber Crime Police Station would have jurisdiction in this case. For a consumer complaint, you file before the District Consumer Disputes Redressal Commission based on the value of the goods/services (up to ₹1 crore). Pecuniary jurisdiction matters — don't file in the wrong forum, or your case gets dismissed on technical grounds.

What if Police Refuse to File FIR?

Police sometimes refuse to register an FIR for online fraud, calling it a "civil matter." That's incorrect. Here's what you do:

• Approach the Superintendent of Police (SP) under Section 173(4) BNSS with a written complaint requesting direction to register the FIR.
• If that fails, file a private complaint before the Judicial Magistrate under Section 175(3) BNSS. The Magistrate can order the police to investigate.
• As a last resort, file a writ petition before the High Court seeking a direction to register an FIR.
• Always keep copies of all complaints and acknowledgments.

Rights of the Accused

• Right against self-incrimination (Article 20(3)): The accused cannot be compelled to be a witness against themselves.
• Right to legal representation (Article 22): The accused has the right to consult and be defended by a lawyer of their choice.
• Right to be produced before a Magistrate within 24 hours of arrest (Article 22(2), Section 57 BNSS).
• Right to a copy of the FIR and to know the grounds of arrest (Section 175(2) BNSS).
• Right to bail if the offence is bailable, or to seek regular/anticipatory bail for non-bailable offences.

Bail Provisions

Credit card fraud under Section 318 BNS is non-bailable. This means bail is not a matter of right — the accused must apply and satisfy the court. Here's how it works:

• Anticipatory bail under Section 482 BNSS: The accused can apply before the Sessions Court or High Court if they fear arrest. Courts typically grant it if the accused cooperates with the investigation and has no criminal antecedents.
• Regular bail under Section 480/483 BNSS: Applied after arrest. The court considers the nature of the offence, evidence, and flight risk.
• Bail conditions often include surrendering the passport, furnishing a surety, and not tampering with evidence.
• Strategy: An advocate experienced in cyber crimes knows how to negotiate bail terms — especially when the accused is a first-time offender.

Quashing of FIR / Case

If the accused believes the FIR is false or lacks evidence, they can approach the High Court under Section 528 BNSS (inherent powers) for quashing. Grounds include:

• No prima facie offence is made out.
• The FIR is an abuse of the legal process.
• The matter is purely civil in nature, not criminal.
• Compromise between parties if the offence is compoundable (though Section 318 is non-compoundable).
• Quashing is a viable strategy only when the FIR lacks any substance — not when the fraud is proven.

If You Are the Victim

• Call 1930 immediately — the national cyber crime helpline works 24/7 for financial frauds.
• Block your credit/debit card via mobile app or customer care.
• File an FIR at your nearest cyber crime police station — do it within 24 hours.
• Submit the dispute form to your bank along with the FIR, Aadhaar, and a self-declaration. Keep the reference number.
• Escalate to the Banking Ombudsman or RBI if the bank does not reverse the amount within 30 days.

Documents You Must Keep Ready

• Copy of your Aadhaar card and PAN card for identity verification.
• The credit card statement showing the fraudulent transaction.
• Copy of the FIR and the acknowledgment receipt.
• The signed dispute form provided by the bank.
• All email and SMS communications with the bank (including customer care chat logs).
• Screenshot of the scammer's phone number if available.
• A self-declaration stating the transaction was unauthorized.

What Evidence Is Required?

• Primary evidence: Your sworn affidavit and the FIR.
• Documentary evidence: Bank statements, credit card transaction history, and the dispute form.
• Electronic evidence: Call recordings (if any), SMS records, and screenshots of the scam call.
• Circumstantial evidence: Timing of the call, the fact that you never initiated a limit-increase request, and the immediate reporting.
• Witness testimony: Your own statement and any family member who witnessed the call.
• Digital evidence is admissible under the Indian Evidence Act — but it must be preserved without tampering.

How the Police Behave in Such Cases

Cyber crime police in cities like Indore, Pune, and Bangalore are generally responsive for online frauds. They will record your statement, take the evidence, and file a chargesheet. But expect delays — investigation can take 2-6 months. Some officers may try to dismiss it as a "bank issue" and ask you to approach the bank directly. Don't accept that. Insist on an FIR. If they refuse, go to the SP or Magistrate. The key is to be persistent and have legal representation.

Timeline of Legal Process

• FIR registration: Same day — if you go to the right police station with evidence.
• Investigation: 2 to 6 months — the police trace the scammer via phone records, bank accounts, and digital trails.
• Chargesheet: Filed within 60-90 days of arrest (or 6 months if accused is not arrested).
• Cognizance by Magistrate: 1-2 months after chargesheet.
• Trial: 6 months to 2 years — depends on court workload and accused's cooperation.
• Judgment: Can take 1-3 years from the date of FIR.
• Appeal (if any): An additional 1-2 years in the Sessions Court or High Court.

How Long Will the Investigation Take?

The investigation typically takes 2 to 6 months, depending on the complexity of the digital trail. The police need time to trace the scammer's phone number, frozen bank accounts, and IP addresses. In urban areas like Indore, cyber crime cells work faster. However, if the scammer used virtual numbers or international servers, the investigation can stretch beyond 6 months.

Understanding the Costs

The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.

A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.

Can the Matter Be Settled Out of Court?

Criminal offences like cheating under Section 318 BNS are non-compoundable — meaning they cannot be settled privately and withdrawn. However, if the scammer returns the money and the victim is satisfied, the court may consider this as a mitigating factor during sentencing or bail. For the civil aspect (recovery of money from the bank), settlement through mediation or a consumer forum is possible. The bank may offer a settlement to avoid litigation costs. A Lok Adalat can also resolve the dispute if both parties agree.

Common Mistakes People Make

• Delaying reporting: Every hour counts. Reporting within 24 hours makes the bank liable for the full amount under RBI rules.
• Not saving evidence: Deleting the scam call log or SMS before filing the FIR weakens your case.
• Speaking to the opposite party without counsel: Don't engage with the scammer or the bank's recovery agents without legal advice.
• Posting on social media: Public posts can prejudice your case if the bank's lawyers use them against you in court.
• Engaging a lawyer without domain expertise: A general practitioner may not know the RBI circulars, the dispute form process, or the cyber crime police protocols. An advocate who regularly handles banking frauds knows the procedural shortcuts — like approaching the Banking Ombudsman directly, filing a consumer complaint alongside the FIR, and ensuring the police record the correct sections. This saves months of delays.

FAQs People Normally Have

Will I definitely get my money back?

Not guaranteed, but if you reported the fraud within 3 working days, the bank is liable to reverse it unless they prove gross negligence (like sharing OTPs). An FIR and legal pressure significantly improve your chances.

Can I file a case against the bank?

Yes — you can file a consumer complaint before the District Consumer Commission for deficiency in service. The bank's failure to reverse the transaction despite your immediate reporting could be grounds.

What if the scammer is caught?

You can recover the amount as part of the criminal proceedings. The court may order the scammer to pay compensation under Section 357 BNSS. But don't rely on this — focus on the bank's liability.

Is the bank's dispute form enough?

No — the dispute form is just the first step. You need the FIR and all supporting documents. Without the FIR, the bank may reject the claim saying it's not a "genuine fraud."

This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.

Advocate Sudhir Rao, Supreme Court of India

Facing a similar matter? Speak to a Delhi criminal defence lawyer — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.