Cyber Fraud on Credit Card: Legal Remedies When Bank Denies Liability

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

TL;DR: If your credit card is used fraudulently after your email ID was changed without your knowledge or OTP, you have strong legal grounds to challenge the bank's negligence. You should escalate to the RBI Ombudsman if the bank denies liability, and ensure the police investigate how the email was changed without proper verification.

A client from Nagpur contacted the office of Advocate Sudhir Rao after a severe cyber fraud incident. In early March 2025, fraudsters called the client, posing as the verification team from HDFC Bank. During a video call, they asked him to show his PAN card and briefly hold up his HDFC Bank credit card. He did not click any links, download apps, share OTPs, or grant remote access. Using the information obtained, the fraudsters changed the registered email on his credit card account to one they controlled. That meant all future OTPs and transaction alerts went to them, not him. Within a span of 7 minutes, 11 unauthorized transactions totaling ₹5.3 lakhs were made. The client immediately reported it to HDFC Bank, filed a complaint on the National Cyber Crime Reporting Portal, and after initial resistance from the local police, got an FIR registered. HDFC Bank rejected his dispute, citing "customer negligence." Advocate Sudhir Rao's expertise in cyber fraud and banking regulations was critical in building a strong case. He argued that the bank's failure to verify a critical credential change without OTP and its lack of real-time fraud alerts established clear negligence on its part. The RBI Ombudsman then directed the bank to reconsider, leading to a full reversal of the fraudulent charges in the client's favour.

Key Facts of the Case

• The fraudsters changed the registered email ID on the credit card account without sending any OTP to the client's existing registered contact.
• The client did not click any link, download any app, share any OTP, or grant remote access — his actions were limited to showing his PAN and card on a video call.
• 11 unauthorized transactions, totalling ₹5.3 lakh, were executed within a 7-minute window.
• HDFC Bank's fraud detection system did not trigger any alert or call to the client despite multiple high-value transactions from a new device/location.
• The bank rejected the chargeback claim, asserting "customer negligence" without providing any written explanation for how the email change was authorised.
• An FIR was registered only after the client used personal connections to compel the local police.
• The RBI Ombudsman found the bank's verification process deficient and directed a full refund.

The Direct Legal Answer

Can I recover my money if the bank says it's my negligence?
Yes. The bank's argument of "customer negligence" is weak here because you did not share OTPs, install apps, or grant remote access. The law, particularly the RBI's Master Directions on Digital Payment Security, requires banks to have robust verification for credential changes like email. If the bank changed your email without sending an OTP to your existing contact, that is a clear failure of their security system. You can approach the RBI Ombudsman under the Banking Ombudsman Scheme, 2006, and the Ombudsman can direct the bank to refund the amount plus compensation for the harassment.

Should I pay the bill or not?
Do not pay the bill for disputed transactions, as that may be seen as acceptance of liability. However, you risk late fees and negative credit reporting if you don't pay. The safest course is to pay the undisputed portion and write to the bank explicitly stating that you are paying the disputed amount under protest, reserving your right to claim a refund. A formal letter or email with this clear statement protects your position.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

File a complaint with the RBI Ombudsman as soon as the bank rejects your dispute or fails to respond within 30 days. Do not rely solely on the bank's internal process — escalate immediately. Also, preserve all evidence: call recordings, emails, messages, and screenshots of the bank's denial. Cyber fraud cases hinge on digital evidence, and a lawyer experienced in this area knows exactly what to preserve and how to present it to the police and the Ombudsman. General practitioners often miss the procedural nuances of the RBI Ombudsman scheme or the specific data preservation orders needed from the police under Section 94 BNSS.

Applicable Sections of Law

• Section 318(4) BNS (Bharatiya Nyaya Sanhita): Cheating by personation using computer resource — covers impersonation and unauthorized access to a bank account.
• Section 319 BNS: Cheating and dishonestly inducing delivery of property — directly applies to the unauthorized transactions.
• Section 66C of the Information Technology Act, 2000: Identity theft — covering the use of the client's PAN and card details to commit fraud.
• RBI Master Direction on Digital Payment Security, 2021: Requires banks to implement multi-factor authentication for critical account changes — violation of this is a strong basis for a complaint.
• Banking Ombudsman Scheme, 2006: Provides for resolution of complaints against banks for deficiency in service, including failure to prevent unauthorized transactions.

Punishment and Penalties

• Section 318(4) BNS: Imprisonment of either description for a term which may extend to three years, and fine.
• Section 319 BNS: Imprisonment of either description for a term which may extend to seven years, and fine.
• Section 66C IT Act: Imprisonment up to three years and fine up to one lakh rupees.
• Offence Nature: Cognizable (police can arrest without warrant), non-bailable (bail is at court's discretion), and compoundable (can be settled with the victim's consent).

Jurisdiction — Where to File the Case

The police complaint (FIR) should be filed at the police station having territorial jurisdiction over the place where the fraud occurred — typically where the client resides or where the bank account is located. For the RBI Ombudsman complaint, you approach the Ombudsman's office that covers the bank's branch where the credit card account was issued. Consumer complaint can be filed at the District Consumer Disputes Redressal Commission with pecuniary jurisdiction up to ₹1 crore. Jurisdiction matters because filing in the wrong forum wastes time and the case may be returned, delaying relief.

What if Police Refuse to File FIR?

Police refusing to register an FIR for cyber fraud is unfortunately common. Here are the steps to take:

• Approach the Superintendent of Police (SP) under Section 173(4) BNSS with a written complaint and seek a direction to register the FIR.
• If the SP refuses or delays, file a private complaint before the jurisdictional Magistrate under Section 175(3) BNSS. The Magistrate can order the police to investigate.
• As a last resort, file a writ petition before the High Court to compel the police to perform their duty.
• Document every interaction — time, date, name of the officer, and reason given for refusal.

The key is to not give up at the police station. A lawyer experienced in criminal procedure can navigate these provisions efficiently.

Rights of the Accused

Even in a cyber fraud case, the accused has fundamental rights:

• Right to remain silent and against self-incrimination under Article 20(3) of the Constitution — the accused is not obliged to be a witness against himself.
• Right to legal representation under Article 22(1) — the accused must be informed of the right to consult a lawyer.
• Right to be produced before a Magistrate within 24 hours of arrest under Article 22(2) and Section 58 BNSS.
• Right to a copy of the FIR and to know the grounds of arrest under Section 50 BNSS.
• Right to bail if the offence is bailable — but here, since the offence is non-bailable, bail is at the court's discretion.

Bail Provisions

Since the offence under Section 319 BNS is non-bailable, the accused does not have an automatic right to bail. However:

• The accused can apply for regular bail under Section 483 BNSS before the trial court.
• For a pre-arrest scenario, anticipatory bail can be sought under Section 482 BNSS if the accused fears arrest. This is common in white-collar and cyber fraud cases where the accused is not a flight risk.
• The court will consider factors like the nature of the fraud, the amount involved, the accused's criminal record, and the likelihood of tampering with evidence.
• Usually, in cyber fraud cases, bail is granted on the condition that the accused cooperates with the investigation, does not leave the country without permission, and surrenders their passport.

Quashing of FIR / Case

An FIR can be quashed by the High Court under its inherent powers in Section 528 BNSS. This is a remedy usually sought by the accused, not the victim. However, a victim should be aware that if the FIR lacks a prima facie case or is filed maliciously, it may be quashed. Grounds include:

• No prima facie offence is disclosed on the face of the FIR.
• The dispute is purely civil in nature and has been given a criminal colour.
• Continuation of the case would be an abuse of the process of court.
• The offence is compoundable and the parties have settled.

In the client's case, the FIR was solidly grounded with evidence of unauthorized credential changes and multiple transactions, so quashing was never a realistic risk.

If You Are the Victim

• Immediately report the fraud to your bank and place a transaction block on the card. Do not wait for a formal investigation to begin.
• File a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) within 48 hours — it helps preserve digital trail.
• Get an FIR registered at the local police station; if refused, escalate to the SP or to a Magistrate.
• Do not engage with the fraudsters further. Preserve all call recordings, screenshots, and communication.
• Approach the RBI Ombudsman if the bank rejects your claim, and do not pay the disputed amount without a clear written protest.

Documents You Must Keep Ready

• Aadhaar card and PAN card for identity verification.
• Credit card statements and transaction history showing the unauthorized charges.
• Copy of the complaint filed with the bank and the bank's reply (if any).
• Screenshot of the FIR and any police correspondence.
• Any communication with the merchant (Custcap Solutions in this case) about voucher delivery details.
• Screenshot of the cybercrime portal complaint acknowledgment.
• Bank's email/letter rejecting the chargeback with reasons.

What Evidence Is Required?

• Primary evidence: Transaction logs showing the 11 transactions, the timestamp of the email change, and the account activity log from the bank.
• Digital evidence: Call recordings (if the client recorded the fraud call, though often illegal without consent), screenshots of OTP messages received (if any), and the cybercrime portal complaint acknowledgment.
• Documentary evidence: The bank's written response denying liability and the FIR copy.
• Bank's internal records: Logs showing how the email change was authorized — particularly if no OTP was sent. This must be obtained through a police notice under Section 94 BNSS.
• Merchant records: Communication from Custcap Solutions showing which email IDs and mobile numbers the vouchers were delivered to — this links the fraudsters.
• Secondary evidence: The client's own note detailing the sequence of events immediately after the fraud, which can be used to refresh memory in testimony.

How the Police Behave in Such Cases

Police attitude toward cyber fraud complaints is often dismissive. They may say the case is too technical, or that they need "proof" from the bank, or that no FIR can be registered unless the accused is known. This is legally wrong — under Section 173 BNSS, police must register an FIR for a cognizable offence like cheating. A lawyer's intervention is often required to compel registration. Once registered, the police will typically issue notices under Section 94 BNSS to the bank and the merchant for data preservation. The investigation involves tracing the IP addresses, email accounts, and mobile numbers used by the fraudsters. Cooperation from the bank is crucial, and if the bank delays, the lawyer must push through the police or even the Magistrate.

Timeline of Legal Process

• FIR Registration: 1–7 days (with legal push).
• Police Investigation: 2–4 months for chargesheet; can extend if data from bank is delayed.
• Chargesheet Filing: After investigation, police file a chargesheet before the Magistrate within 90 days from arrest or 60 days otherwise.
• Cognizance and Summons: 1–2 months after chargesheet for the court to take cognizance and issue summons to the accused.
• Trial: Can take 1–3 years for a simple cyber fraud case, depending on court backlog.
• RBI Ombudsman Process: Typically 3–6 months from complaint to final order.
• Consumer Complaint: 6–18 months at the District Forum.

How Long Will the Investigation Take?

Police investigation for a cyber fraud case of this nature generally takes 2 to 4 months. The investigation involves collecting transaction logs from the bank, tracing IP addresses and email IDs, and examining the merchant's delivery records. If the accused is identified through digital footprints, the police may make arrests. Chargesheet must be filed within 60 days if the accused is not in custody, or 90 days if arrested.

Understanding the Costs

The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.

A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.

Can the Matter Be Settled Out of Court?

Cyber fraud cases are criminal in nature, but the victim can settle with the accused if the accused is willing to return the money. However, the offence under Section 319 BNS is compoundable (can be settled with the victim's permission), meaning the court can accept a settlement and acquit the accused. This is practical only if the accused is identified and willing to cooperate. In many cases, the fraudsters are never caught. The more practical route is to pursue the bank through the RBI Ombudsman or consumer court, where a settlement is possible if the bank agrees to refund the amount. Mediation before the consumer forum is also an option. Settlement is advisable only if it fully recovers your losses and you do not want to spend further time on litigation.

Common Mistakes People Make

• Delaying the complaint: Waiting even a day gives banks room to argue that you did not act promptly. Report immediately.
• Engaging a lawyer without domain expertise: Cyber fraud cases involve specific procedural steps under BNSS, IT Act, and RBI regulations. A general civil lawyer may miss the deadline for Ombudsman complaint or fail to get the right data preservation orders from the police. An expert lawyer knows exactly what evidence to demand and which forum to approach first.
• Paying the disputed bill without a protest: This can be seen as acceptance of liability. Always pay under protest in writing if you must pay on time.
• Ignoring the RBI Ombudsman remedy: Many victims stop at the bank's internal complaint. The Ombudsman is a powerful, cost-free remedy that can reverse the bank's decision.
• Sharing personal details during verification: Legitimate banks never ask you to show your card or PAN on a video call. Knowing this can prevent fraud entirely.
• Posting about the case on social media: This can prejudice the police investigation and may be used by the bank or the accused to argue that you are not serious.

FAQs People Normally Have

Can I approach the RBI Ombudsman if the police haven't filed an FIR?

Yes. The RBI Ombudsman complaint is a civil remedy independent of the criminal process. You do not need a pending FIR to approach the Ombudsman. However, having an FIR strengthens your claim of unauthorized transactions.

What if the bank says I was negligent for showing my card on video?

Showing your card on a video call does not authorize the bank to change your email or process transactions. Negligence requires a direct link to the loss — like sharing an OTP or granting remote access. The bank's failure to secure the credential change is the cause here, not your action.

How long does the RBI Ombudsman take?

Typically 3 to 6 months from filing the complaint. The Ombudsman first tries mediation, and if that fails, issues a binding award. The award can be challenged by either party in a civil court, but banks rarely do so unless the amount is very high.

Can I sue the bank in consumer court?

Yes. You can file a consumer complaint before the District Consumer Disputes Redressal Commission under the Consumer Protection Act, 2019 for deficiency in service and unfair trade practice. You can claim the refund of the fraudulent amount plus compensation for harassment and legal costs.

What if the merchant (Custcap Solutions) refuses to cooperate?

The police can issue a summons under Section 94 BNSS to the merchant to preserve and produce records. If the merchant still refuses, the police can take coercive action. Separately, you can name the merchant as a party in a civil suit for assistance and recovery.

This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.

Advocate Sudhir Rao, Supreme Court of India

Facing a similar matter? Speak to a criminal advocate in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.