HDFC Credit Card Fraud via Amazon Pay Gift Cards – Recovering Money Without Sharing OTP

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

Rohan Gupta, a salaried professional based in Pune, woke up on the morning of 18 February 2025 to a barrage of OTP messages on his registered mobile number. His HDFC Bank credit card was being used to purchase Amazon Pay gift cards in rapid succession. He had shared the OTP with nobody. Within eleven minutes, ₹37,000 had vanished across seven transactions.

Rohan acted fast. He blocked the card through the HDFC mobile app, logged out of all linked devices, called the bank's helpline, and filed a complaint on the National Cyber Crime Portal the same day. Despite all of this, HDFC Bank told him the liability rested with him. Amazon's customer support offered no meaningful response either. For nearly six weeks, he got nowhere.

A colleague referred him to Advocate Sudhir Rao's office. What changed wasn't luck — it was the approach. A formal legal notice was dispatched to HDFC Bank citing RBI's circular on limiting customer liability in unauthorised electronic transactions. A complaint was simultaneously drafted before the RBI Banking Ombudsman under the Integrated Ombudsman Scheme, 2021. The cyber crime FIR was followed up procedurally, and a structured escalation path was mapped out. Within weeks, the matter moved decisively. Rohan's case is a reminder that the right procedural handling, by someone familiar with how banking fraud disputes actually work, can shift outcomes significantly.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

File on the Cyber Crime Portal Immediately: Report the fraud at cybercrime.gov.in without delay. Note down the acknowledgment number carefully — it becomes a critical document in all subsequent proceedings.

Write to the Bank in Writing: Don't rely on phone calls alone. Send a written complaint by email and registered post to the bank's nodal officer. RBI's circular DBR.No.Leg.BC.78/09.07.005/2017-18 places a limited liability framework on banks where fraud occurs without customer negligence. Citing this specifically in your letter puts the bank on notice. And here's the thing — a phone call leaves no trail, but a registered letter does.

Escalate to RBI Ombudsman: If the bank doesn't resolve your complaint within 30 days, you can approach the Reserve Bank of India's Integrated Ombudsman Scheme. It's free, it's accessible, and banks take it seriously. Now, before you act, understand that this process involves procedural nuances around limitation windows, complaint framing, and documentary evidence that advocates with domain-specific experience handle with considerably greater precision than a general practitioner.

Applicable Sections of Law

This case is predominantly criminal in nature, involving unauthorised access, identity theft, and financial fraud through digital means. The following provisions apply:

• Section 318 BNS (Cheating): Dishonestly inducing a person to deliver property — applicable to the fraudsters who exploited the card credentials.
• Section 319 BNS (Cheating by Personation): Cheating by pretending to be someone else, directly applicable where the fraudster impersonated the cardholder during the transaction process.
• Section 66C of the Information Technology Act, 2000 (Identity Theft): Fraudulently or dishonestly making use of an electronic signature, password, or any other unique identification feature of any other person.
• Section 66D of the Information Technology Act, 2000 (Cheating by Personation using Computer Resource): Cheating someone by personating through a communication device or computer resource, punishable with imprisonment up to three years and fine up to ₹1 lakh.

Frankly, most victims don't realise that Section 66C and Section 66D of the IT Act run independently of the BNS cheating provisions. Both sets of charges can apply simultaneously.

Punishment and Penalties

• Section 318 BNS (Cheating): Imprisonment up to three years, or fine, or both.
• Section 319 BNS (Cheating by Personation): Imprisonment up to five years, or fine, or both.
• Section 66C IT Act: Imprisonment up to three years and fine up to ₹1 lakh.
• Section 66D IT Act: Imprisonment up to three years and fine up to ₹1 lakh.
• Cognizable and non-bailable in nature for offences under the IT Act and under Section 319 BNS.
• Offences under Section 318 BNS are cognizable and bailable.
• None of these offences are compoundable without court permission.

Jurisdiction — Where to File the Case

Cyber crime FIRs can be filed at any cyber crime police station or the nearest police station, regardless of where the accused is located — this is a specific provision under Section 13 of the IT Act. The territorial jurisdiction of courts follows the place where the offence was committed or where its effects were felt, which in digital fraud cases typically means the victim's city.

For consumer complaints against HDFC Bank, the District Consumer Disputes Redressal Commission having jurisdiction over Pune would apply. Pecuniary jurisdiction depends on the amount claimed. Make no mistake — filing in the wrong forum wastes months.

What if Police Refuse to File FIR?

This happens more often than it should in cyber fraud cases. Here's what you can do:

• Submit a written complaint to the Superintendent of Police (Cyber Crime) under Section 173(4) BNSS, requesting directions to register the FIR.
• File a private complaint directly before the competent Magistrate under Section 175(3) BNSS — the Magistrate can take cognizance and direct registration.
• If both approaches fail, approach the High Court under Article 226 of the Constitution for a writ of mandamus directing the police to register the FIR.
• Keep all written records of your attempts — dates, receipts, email confirmations — as they form part of your case record before the Magistrate or High Court.

Rights of the Accused

Where an accused is arrested in connection with such fraud, the following rights apply:

• Right against self-incrimination under Article 20(3) of the Constitution — no person can be compelled to be a witness against themselves.
• Right to legal representation under Article 22 — the accused is entitled to consult an advocate of their choice at arrest.
• Right to be produced before a Magistrate within 24 hours of arrest, excluding travel time, under Article 22(2) and Section 57 BNSS.
• Right to a copy of the FIR and to be informed of the grounds of arrest — confirmed in Arnesh Kumar v. State of Bihar, 2014.
• Right to bail consideration — even in non-bailable offences, bail is not automatically refused. D.K. Basu v. State of West Bengal, 1997 remains the foundational authority on arrest safeguards.

Bail Provisions

Offences under Section 319 BNS and Sections 66C and 66D of the IT Act are non-bailable. Bail can't be granted as a matter of right at the police station and must be sought before the Magistrate or Sessions Court.

• Regular bail can be applied under Section 480 BNSS before the Magistrate or under Section 483 BNSS before the Sessions Court.
• Anticipatory bail under Section 482 BNSS is available before the Sessions Court or High Court where there is apprehension of arrest.
• Typical bail conditions include surrender of passport, periodic reporting to the police station, and restrictions on contacting witnesses.
• Courts generally consider the nature of the offence, the accused's antecedents, and the risk of evidence tampering when deciding bail in cyber fraud matters.

Quashing of FIR / Case

Under Section 528 BNSS, the High Court has inherent power to quash an FIR where continuation of the proceedings would amount to an abuse of process of court, or where no prima facie case is made out on the face of the FIR.

In cyber fraud cases, quashing is rarely granted. Unless the complaint is demonstrably false, the parties have genuinely settled the dispute, or the allegations taken at face value don't constitute an offence, the High Court won't entertain it. The Supreme Court in State of Haryana v. Bhajan Lal, 1992 laid down the categories where quashing is appropriate. And here's the thing — attempting to quash an FIR without those grounds firmly established is an exercise that typically backfires.

If You Are the Victim

• Block your card immediately through the bank's app or helpline — document the exact time you reported it.
• File a complaint on the National Cyber Crime Portal (cybercrime.gov.in) and save the acknowledgment number.
• Send a written complaint to the bank's nodal officer by email and registered post within 3 days of the fraud — this is critical for triggering the RBI limited liability framework.
• If the bank does not respond within 30 days, escalate to the RBI Integrated Ombudsman through cms.rbi.org.in.
• Consult an advocate familiar with cyber banking fraud matters before the 30-day window closes — early legal structuring of the complaint significantly improves the outcome.

Documents You Must Keep Ready

• Aadhaar card and PAN card (identity proof)
• Credit card statement showing the fraudulent transactions
• SMS/OTP records with timestamps from your registered mobile number
• Screenshots of all transactions and bank notifications
• Written complaint copies sent to the bank (email + postal receipt)
• National Cyber Crime Portal acknowledgment number and complaint copy
• Any communication received from the bank in response to your complaint
• Device usage logs or call logs if available

What Evidence Is Required?

• Transaction records: Bank-certified statement showing the disputed transactions — this is primary documentary evidence.
• OTP delivery logs: SMS records from your telecom provider confirming OTPs were sent to your number but not initiated by you.
• IP address logs: Obtained from the bank or e-commerce platform via legal notice — shows where the transaction was initiated from.
• Device binding records: Bank records showing which device was registered for the account at the time of the transaction.
• Cyber crime portal complaint: The acknowledged complaint establishes the date and time of reporting.
• Communication trail: All emails and letters exchanged with the bank form secondary evidence of the bank's denial of liability.
• Expert opinion: In contested matters, a certified forensic auditor's report on the transaction trail can be decisive.

How the Police Behave in Such Cases

Slow. That's the honest answer in most cities. Cyber crime cases frequently run into procedural delays at the investigation stage, and many police stations simply don't have dedicated cyber cells. Even where they exist, technical expertise varies widely. Officers may initially be reluctant to register an FIR, particularly where no physical accused is identifiable. Follow-up is essential. Once an FIR is registered, banks and payment platforms respond to Section 91 BNSS production orders far more promptly than they do to individual complaints. Investigations involving gift card fraud typically require coordination with the e-commerce platform's fraud team, which adds time. Realistic expectations and consistent follow-up with the investigating officer make a material difference.

Timeline of Legal Process

• Day 1-3: Card blocked, cyber crime portal complaint filed, written bank complaint dispatched.
• Week 1-2: FIR registered at cyber crime police station (or follow-up if refused).
• Week 2-4: Legal notice sent to bank; bank's 30-day response window begins.
• Month 1-2: If bank denies liability, RBI Ombudsman complaint filed simultaneously with consumer forum complaint.
• Month 2-6: Police investigation, Section 91 BNSS notices to bank and platform, IP address and device data collected.
• Month 6-12: Chargesheet filed if accused identified; consumer forum hearing progresses.
• Month 12-24: Trial proceedings; consumer forum typically disposes of matters within 12-18 months.
• Appeal stage: State Consumer Commission or High Court if outcome is challenged.

How Long Will the Investigation Take?

Where the accused is unidentified, cyber fraud investigations can take anywhere from six months to over a year. The primary bottleneck is obtaining IP address logs and device data from banks and platforms, which requires formal legal process. Where the fraudster is traced through digital footprints, chargesheets have been filed within three to four months in active cyber cells like those in Pune, Bengaluru, and Hyderabad. Victim cooperation and consistent follow-up with the investigating officer genuinely matters — cases where victims stay engaged move faster than those where they don't.

Facing a similar matter? Speak to a criminal advocate in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.