One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: If money moved off your card through an online cab rental fraud and you never entered the OTP, the bank cannot close the matter by simply asserting that you did. You are entitled to the authentication logs, and you can escalate through the bank's grievance officer, then the RBI Ombudsman, while marking the amount as disputed. Do not ignore the bill, do not pay silently, and put everything in writing.
Key Facts of the Case
- The client, a Pune resident, tried to book an outstation cab through a rental website he found in a search result.
- He typed his credit card details into the payment page but stopped at the OTP screen and closed the browser tab.
- The page displayed a payable amount of ₹150. The card was debited ₹1.5 lakh instead.
- He reported the transaction to his bank and to the cyber crime authorities the same day.
- The bank later took the position that the OTP had been entered and the transaction was genuine.
- He had earlier bought a phone on the same card, and the bank had called to confirm before allowing it. On this occasion, the bank called during the transaction but he could not pick up, and the payment still went through.
- The bill carrying the disputed amount had a payment due date of 5 November 2025.
The Direct Legal Answer
Do I have to pay the disputed amount while the case is ongoing?
You should pay the undisputed portion of the bill on time. For the disputed ₹1.5 lakh, write to the bank formally marking it as disputed and ask, in writing, how it will be treated while the dispute is pending. Ignoring the bill entirely invites interest and a hit to your credit score. Paying the whole amount under written protest does not, by itself, mean you accept liability, but it does weaken your position. Get the bank's answer in writing before you decide.
Can the bank simply say the OTP was entered?
No. A bank's assertion is not evidence. The authentication logs, the IP address, the device record and the payment gateway trail all sit with the bank and the merchant's payment processor, not with you. Under the RBI's framework on limiting customer liability for unauthorised electronic transactions, the burden of showing that a customer authorised a payment and was negligent rests with the bank. So demand the records.
What should I do first after an online cab rental fraud?
Report on the National Cyber Crime Reporting Portal the same day, keep the acknowledgement, write a dated complaint to your bank's grievance officer quoting the transaction reference, and ask specifically for the OTP and authentication records. Everything in writing. Phone calls leave no trail.
Advice in Such Cases
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
Put every communication in writing and keep a dated file. A phone call with the bank's customer care proves nothing two months later; an email with a reference number does.
Pay the undisputed part of the bill before the due date. Then take written confirmation from the bank on how the disputed portion will be reported to credit bureaus while the dispute is alive.
Escalate in sequence: bank grievance officer, then the RBI Ombudsman. Skipping a stage usually sends you back to the beginning.
Card fraud and bank liability disputes are a niche. They turn on the RBI's liability framework, chargeback rules and the evidentiary weight of authentication logs, and general practitioners often miss these procedural and evidentiary points. An advocate who handles such matters regularly tends to move faster and cleaner.
Applicable Sections of Law
The fraudulent debit is prosecuted as cheating and as a computer-related offence. The relevant provisions are:
- Cheating — Section 318, Bharatiya Nyaya Sanhita, 2023. A person was induced to part with property by deception. The fake payment page is the means; the ₹1.5 lakh debit is the loss.
- Cheating by personation — Section 319, BNS. Where the site held itself out as a business it was not.
- Identity theft — Section 66C, Information Technology Act, 2000, and cheating by personation using a computer resource — Section 66D. These are the two provisions built specifically for online payment fraud.
- Unauthorised access to a computer resource — Section 43 read with Section 66, IT Act.
- Forgery — Section 336, BNS, if the merchant account behind the page was opened on fabricated papers. That is a question for the investigation. We cannot assume it.
- Common intention — Section 3(5), BNS. A website, a payment gateway merchant account and a set of accounts to receive the money are rarely run by one person.
Note what is not on that list. The bank is not, on these facts, the accused. The bank is answerable on a different footing altogether — its own failure of authentication and its handling of the complaint. Mixing the two up is the single most common mistake in these matters, and it is why so many people spend months filing a criminal complaint that recovers nothing while the billing clock keeps running.
The RBI framework decides who has to prove what
Two years before this transaction, the
Facing a similar matter? Speak to a criminal advocate in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.