One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: Paying a disputed credit card amount under protest, specifically to stop interest and protect your credit score, does not automatically mean you accepted liability. If the RBI Ombudsman later rules in your favour, the bank can be directed to refund that money and reverse all related charges. The real battle is about forcing the bank to produce technical evidence — not just claiming an OTP was used.
Rohan Gupta, a Jaipur-based professional, discovered unauthorised credit card transactions worth nearly ₹4.2 lakh in February 2025. He immediately alerted his bank, HDFC Bank, filed a cyber crime complaint, and lodged an FIR. The bank initially provided a temporary credit, then abruptly reversed it and rejected his dispute. Their entire reasoning? “OTP was used — customer liable.” But they never shared a single authentication log, IP trace, device fingerprint, or any technical investigation report. The matter dragged. Rohan’s family eventually paid the outstanding amount under protest to stop daily finance charges and prevent a CIBIL nosedive. While his RBI Ombudsman complaint was still pending, he approached the Chamber of Advocate Sudhir Rao, Supreme Court of India, after earlier efforts with a non-specialist adviser seemed to be going nowhere. Make no mistake, the pivot was right there. Advocate Sudhir Rao and his office argued that the bank’s failure to furnish underlying evidence, while simply stating “OTP used,” constituted a clear deficiency in service and an unfair trade practice under the Consumer Protection Act. The Ombudsman directed the bank to produce the technical records. HDFC couldn’t. The final award ordered a full refund of the disputed sum, reversal of interest and late fees, and even compensation for the mental agony caused. The payment under protest, backed by a clear written communication, did not affect the outcome at all.Key Facts of the Case
- Unauthorised credit card transactions totalling around ₹4.2 lakh appeared on Rohan Gupta’s HDFC Bank card in February 2025.
- The fraud was reported instantly, and both a cyber crime complaint and a formal FIR were registered.
- HDFC Bank granted temporary credit but reversed it, rejecting the dispute solely on the ground that “OTP was used.”
- Despite repeated demands, the bank never produced authentication logs, device details, IP addresses, or any technical investigation report.
- Rohan’s family paid the full outstanding amount under protest to avoid mounting interest and protect the credit score, while the RBI Ombudsman complaint was alive.
- Advocate Sudhir Rao’s chamber argued that a bare “OTP” assertion without supporting evidence is a deficiency in service and cannot shift liability onto the customer.
- The RBI Ombudsman directed the bank to produce the missing records; the bank failed to do so, resulting in an award ordering a complete refund plus compensation.
The Direct Legal Answer
Does paying the disputed amount while the RBI Ombudsman complaint is pending weaken the case?
No, it doesn’t — provided you’ve made it crystal clear in writing that the payment is “under protest” and solely to minimise further financial damage. Courts and Ombudsman forums draw a sharp line between accepting liability and making a protective payment. Rohan’s case proved exactly that.
Can the bank later argue that payment amounts to acceptance of liability?
A bank might try that argument. But here’s the thing — the entire factual matrix matters. If your contemporaneous communication states you are paying to avoid interest, not because you agree the transactions were genuine, the argument collapses. Keep the paper trail.
If the Ombudsman rules in my favour, can the bank be directed to refund the disputed amount and reverse charges?
Yes. The Banking Ombudsman can award a refund of the amount wrongfully debited along with a reversal of interest, late fees, and often compensation for mental harassment. That’s precisely what happened in Rohan’s matter once the bank failed to produce evidence.
Has anyone successfully challenged a bank where the main issue was failure to produce evidence — not just an “OTP was used” statement?
Absolutely. The RBI’s own instructions mandate that banks must provide a reasoned response and, where the dispute involves technical authentication, share relevant forensic evidence. Merely stating “OTP was used” without the underlying session logs, device binding data, or IP details is not a valid investigation. The Ombudsman’s award in Rohan’s case turned precisely on this gap.
Is there anything else I should do while waiting for the RBI Ombudsman’s decision?
Keep safe every shred of communication — bank emails, complaint acknowledgements, the FIR copy, and importantly, your written protest letter. Do not let the bank close the complaint unilaterally. If the Ombudsman seeks a reply, respond thoroughly. And consult a lawyer who regularly handles banking fraud cases; the procedural edge matters.
Advice in Such Cases
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
First, immediately send a written communication (email is best) stating that you are paying “under protest” to contain finance charges and credit score damage — not as an admission. Second, preserve every OTP alert, SMS, and email; these form the backbone of your challenge. And here’s something many miss: general practitioners often underestimate how deeply technical banking fraud disputes can get. Engaging an advocate with domain-specific experience in RBI Ombudsman and consumer protection matters can mean the difference between a dismissed complaint and a full refund with compensation.
Applicable Sections of Law
The RBI Integrated Ombudsman Scheme, 2021, governs complaints against banks and provides the power to award compensation for deficiency in service. Under the Consumer Protection Act, 2019, a “deficiency in service” under Section 2(11) read with Section 35 (complaint to consumer forum) applies squarely when a bank fails to investigate a fraud properly or refuses to share material evidence. The Indian Contract Act, 1872 — particularly Section 2(d) and Section 17 (defining fraud) — can also be invoked if the bank’s concealment of authentication data amounts to wilful misrepresentation. For limitation purposes, Article 100 of the Limitation Act, 1963 typically gives two years from the date of cause of action to approach a consumer forum.
Jurisdiction – Where to File the Case
The first stop is the RBI Ombudsman under the Integrated Ombudsman Scheme — you file online, and it’s cost-free. If the award is not satisfactory or if the grounds are complex, you can escalate to the District Consumer Disputes Redressal Commission if the claim value is up to ₹50 lakh, or the State Commission for claims between ₹50 lakh and ₹2 crore. Pecuniary jurisdiction matters: Rohan’s ₹4.2 lakh claim fell squarely within the District Commission. Territorial jurisdiction lies where the bank branch is located or where the complainant resides. Filing in the wrong forum can get the case returned, so get this right.
Limitation Period
Under Section 69 of the Consumer Protection Act, 2019, a complaint must be filed within two years from the date on which the cause of action arises. The cause of action in a credit card fraud case arises the moment the bank reverses the provisional credit and finally rejects the dispute. Missing this deadline can be fatal, though the consumer forum may condone a delay if you show sufficient cause. Don’t test that leniency — act fast.
Interim Reliefs Available
When the matter moves to a consumer commission, you can seek interim orders under Section 38(8) of the Consumer Protection Act, 2019, such as a direction to the bank not to report adverse CIBIL remarks during the pendency, or a stay on recovery proceedings. Attachment before judgment under Order 38 CPC isn’t typical here, but a temporary injunction restraining the bank from selling the debt to a recovery agent while the fraud dispute is alive can be a powerful shield. This is precisely why early legal strategy matters — interim relief can save your credit profile while the main case drags on.
If You Are the Victim
- Notify the bank in writing immediately and block the card.
- File a cyber crime complaint on the National Cyber Crime Reporting Portal and get an FIR registered.
- Do not miss a single EMI or payment — but make it explicitly “under protest” with a written declaration.
- Escalate to the RBI Ombudsman without waiting for the bank’s internal resolution, if you have sufficient grounds.
- Keep a chronological file: bank complaints, Ombudsman reference number, police reports, and all technical evidence you have.
Documents You Must Keep Ready
- Aadhaar card and PAN card for identity verification.
- Copies of the credit card statements showing the disputed transactions.
- The written fraud complaint you filed with the bank, with acknowledgment.
- Any email or letter where you explicitly stated the payment was “under protest.”
- Copy of the cyber crime complaint acknowledgment and the FIR.
- All SMS and email alerts received during the fraudulent transactions.
- RBI Ombudsman complaint reference number and the bank’s reply (or lack of it).
- Any call recordings or screen captures of the bank’s mobile app if they show device logins unknown to you.
What Evidence Is Required?
- Your own mobile device’s location data at the time of the transactions — to show you weren’t at the merchant’s location, if relevant.
- Call detail records demonstrating no OTP was received on your registered number (if that’s your case).
- Authentication logs from the bank — session times, IP addresses, device fingerprints — which you can demand under the RBI’s ‘reasonable evidence’ standard.
- Copies of the police investigation report, if any progress has been made.
- Screenshots of the bank’s app showing unrecognised devices logged in (if available).
- Any expert opinion on how a SIM swap or malware might have intercepted OTPs, if that’s the suspected fraud mechanism.
- Correspondence where the bank merely repeated “OTP was used” without supporting logs — this itself is primary evidence of deficiency.
How Courts Typically Approach Such Cases
Consumer forums and the Ombudsman are increasingly unwilling to accept blanket “OTP equals customer liability” defences without accompanying technical proof. They examine whether the bank followed RBI’s strict guidelines on customer protection and limited liability, and whether it produced forensic evidence. If the bank has simply stonewalled, the forum often draws an adverse inference. Rohan’s case was no different — the moment the bank failed to produce logs, the scales tipped heavily in his favour. However, forums also look at whether the customer reported the fraud promptly and cooperated. So keep your timeline airtight.
Timeline of Legal Process
- Fraud reporting to bank: within 3 working days of noticing the unauthorised transaction — zero liability possible under RBI rules if reported immediately.
- Bank’s internal investigation: ideally 90 days; they must provide a reasoned response.
- RBI Ombudsman complaint: file as soon as the bank rejects the dispute or 30 days after no satisfactory reply. A decision usually takes 90–120 days, though it can stretch.
- Consumer Commission filing: if the Ombudsman’s award isn’t satisfactory, you can approach the District Consumer Commission under the two-year limitation period.
- Admission, notice, and reply: 30–45 days for the bank to file a written version; framing of issues and evidence thereafter.
- Final arguments and judgment: can take 12–18 months in a District Commission, shorter if the case is strong and documents are clear.
- Appeal: to the State Commission within 45 days of the order.
Understanding the Costs
The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.
A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.
Can the Matter Be Settled Out of Court?
Yes, and often it makes sense. Before the RBI Ombudsman, a mutually acceptable settlement — where the bank agrees to refund a portion or all of the disputed sum and waive charges — can be recorded, and the complaint closed. Mediation is also available under Section 37 of the Consumer Protection Act after a case is filed. However, settlement does not mean the bank admits fraud; you’ll need to decide whether a discounted refund without an admission is acceptable. In Rohan’s case, the bank eventually settled on the Ombudsman’s suggestion, paying the full amount, which avoided a prolonged consumer forum battle.
Common Mistakes People Make
- Delaying the fraud report: RBI’s zero-liability protection vanishes if you don’t report within three working days. Speed is everything.
- Paying without protest: If you pay the outstanding bill but leave no written trail that it’s under protest, the bank may successfully argue you accepted the debt.
- Destroying digital evidence: Deleting SMS alerts, uninstalling the bank’s app, or losing access to the device that received the OTPs can cripple your defence.
- Posting details on social media: While you vent, you might inadvertently reveal facts the bank later uses against you. Keep quiet until your lawyer advises otherwise.
- Not demanding technical logs: Many people accept the bank’s verbal “OTP was used” statement. A formal written demand for authentication records is critical.
- Engaging a lawyer without domain experience: Banking fraud matters hinge on RBI circulars, forensic evidence demands, and complaint drafting that a general practitioner may not be fully familiar with. A specialist can spot the evidentiary gaps an ordinary lawyer might miss, dramatically shortening the path to a favourable award.
FAQs People Normally Have
Will paying the credit card bill affect my Ombudsman case?
Not if you have paid under protest with proper documentation. The Ombudsman evaluates the bank’s conduct, not whether you made a pragmatic payment to avoid ruinous interest.
Can I get compensation if the bank didn’t give me any evidence?
Yes, the Ombudsman can award compensation up to ₹20 lakh for mental agony and harassment. And if the deficiency is gross, the consumer commission can award even higher amounts.
What if the bank says OTP was delivered — but I never received it?
Immediately demand the delivery report or SMS gateway logs from the bank. A SIM swap, call forwarding, or malware could have intercepted it. The burden of proving delivery to your device remains on the bank.
Does filing an FIR automatically help my Ombudsman complaint?
It strengthens your case significantly. An FIR shows you aren’t fabricating the fraud — it adds a layer of credibility that the Ombudsman takes seriously.
What’s the time limit for filing an Ombudsman complaint?
You have to file within one year from the date you received the bank’s final reply rejecting your dispute. Don’t wait — the clock ticks from the rejection, not from when you paid.
This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.
Advocate Sudhir Rao, Supreme Court of India