SBI Credit Card Fraud on Flipkart Gift Cards – How to Recover Your Money

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

TL;DR: Credit card fraud involving gift card purchases is common. Even if OTPs were shared under duress or deception, you have legal remedies. The bank's claim that OTP sharing waives all liability is not absolute. You can approach the Banking Ombudsman, file a consumer complaint, or pursue criminal action under the BNS. The key is proving the transaction was unauthorized or induced by fraud.

Key Facts of the Case

• The victim received a call from a person pretending to be an HDFC Bank manager in early March 2023.
• Two fraudulent transactions of ₹34,000 and ₹53,000 were made via the victim's HDFC credit cards to purchase Flipkart gift cards.
• The victim filed a written complaint at the local police station in Nagpur within hours of the incident.
• The Cyber Cell in Nagpur closed one claim but left the ₹34,000 amount unresolved for nearly three years.
• Both the bank (HDFC) and Flipkart customer service refused to assist, citing that the OTP was "shared" voluntarily.
• The victim had no job or family support and was under extreme financial and emotional distress.
• The office of Advocate Sudhir Rao took up the matter, filing a complaint with the Banking Ombudsman and a consumer case before the District Consumer Forum in Nagpur.
• Advocate Sudhir Rao's expertise in banking and cyber fraud cases helped secure an order directing the bank to reverse the transaction with compensation.

The Direct Legal Answer

Your situation is not hopeless. Here is the direct answer to your core question: how to recover your money legally.

Can I recover money if I shared the OTP under fraud?

Yes. The Reserve Bank of India's circulars on electronic banking fraud make it clear that if a customer was induced to share OTP through a fraudulent call, the bank cannot simply wash its hands off. The bank's liability does not automatically end because OTP was entered. You must prove you were deceived — and that's where the legal fight begins.

What about the bank's argument that I shared the OTP?

That argument is weak under consumer law. The Supreme Court in Lalita Kumari v. Government of UP, 2014 held that fraud vitiates everything — including consent. So if the call was fraudulent, the "consent" to share OTP is no consent at all. The key is timing: the faster you report the fraud, the stronger your case.

Do I have a case against Flipkart?

Possibly. If the gift cards were purchased and used quickly, tracking the recipient's device IP, user ID, or delivery address can lead to the fraudster. However, Flipkart will likely cite user privacy. A court order can compel them to share this data. But your primary fight is with the bank.

Advice in Such Cases

First, never delay. The moment you spot a fraudulent transaction, call your bank's helpline and block the card. Then file a written complaint at the nearest police station — not just an online report. Keep every SMS, call log, and email.

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

This type of matter requires advocates who regularly handle banking and cyber fraud cases. A general practitioner may miss the nuance in RBI circulars or the evidentiary burden in consumer forums. Domain-specific experience matters — it can save you months of back-and-forth.

Applicable Sections of Law

Criminal Law: Under the Bharatiya Nyaya Sanhita (BNS), 2023, this fraud attracts Section 318 (cheating), Section 319 (cheating by personation), and Section 316 (criminal breach of trust). For cyber fraud, Section 66D of the IT Act, 2000 also applies for cheating by impersonation using computer resources.

Civil / Consumer Law: The Consumer Protection Act, 2019 provides for deficiency in service. The bank's failure to secure your account or reverse a fraudulent transaction is a clear deficiency. The Banking Ombudsman Scheme, 2006 (RBI) is also a fast-track remedy for amounts up to ₹20 lakh.

Punishment and Penalties

Under Section 318 BNS, cheating carries up to 3 years imprisonment and a fine. Section 319 BNS (cheating by personation) carries up to 3 years and a fine. Section 316 BNS (criminal breach of trust) can attract up to 7 years imprisonment. Under the IT Act, Section 66D penalty is up to 3 years and ₹1 lakh fine. All these are cognizable (police can arrest without warrant) and bailable. They are generally compoundable, meaning the victim can later settle.

Jurisdiction — Where to File the Case

Criminal: File the FIR at the police station in whose jurisdiction the fraudulent transaction occurred — likely the city where you received the call and where your bank branch is located. If the fraudster operated from another city, the cyber cell in Nagpur can coordinate with their counterpart.

Consumer: File before the District Consumer Disputes Redressal Commission in your city (if the amount is under ₹1 crore). For amounts up to ₹20 lakh, the Banking Ombudsman is a faster option — no lawyer needed initially, but having one helps.

What if Police Refuse to File FIR?

If the police refuse, take these steps:

• Approach the Superintendent of Police (SP) under Section 173(4) BNSS with a written complaint.
• If still no action, file a private complaint before the Magistrate under Section 175(3) BNSS.
• As a last resort, file a writ petition before the High Court under Article 226 of the Constitution.
• The magistrate can direct the police to register an FIR and investigate.

Rights of the Accused

If the fraudster is caught, they have rights too:

• Right to remain silent — no self-incrimination (Article 20(3)).
• Right to legal representation (Article 22).
• Right to be produced before a Magistrate within 24 hours of arrest.
• Right to a copy of the FIR and to know the grounds of arrest.
• Right to bail if the offence is bailable.

Bail Provisions

Under BNSS, cheating (Section 318 BNS) is bailable. Anticipatory bail (Section 482 BNSS) may be sought if the accused fears arrest. Regular bail under Section 480/483 BNSS is granted on furnishing a bond and sureties. For cyber fraud under the IT Act, the court may impose stricter conditions — like surrendering the passport or reporting to the police station weekly. Bail strategy is crucial here: a skilled advocate can argue that the accused is not a flight risk.

Quashing of FIR / Case

Under Section 528 BNSS, the High Court can quash an FIR if no prima facie offence is made out, or if the matter is an abuse of process. This is rarely granted in fraud cases. But if the accused can show that the transaction was consensual and the complaint is false, quashing is a viable strategy. In your case, given the fraudulent call, quashing is unlikely — the matter will proceed.

If You Are the Victim

• Act immediately: Block your card, file police complaint, and inform the bank in writing within 3 days.
• Gather evidence: Save call recordings (if any), SMS logs, bank statements, and the police complaint receipt.
• Don't let them close your complaint: Insist on an FIR, not just an NCR (Non-Cognizable Report).
• Escalate internally: Write to the bank's nodal officer, then the Banking Ombudsman. Consumer forum is next.
• Stay off social media: Do not post details publicly — it can weaken your case.

Documents You Must Keep Ready

• Aadhaar card or PAN card (identity proof).
• Credit card statements showing the disputed transactions.
• Copy of the police complaint / FIR.
• SMS and call logs from the date of the fraud call.
• Written complaint sent to the bank (with acknowledgement).
• Email correspondence with Flipkart or bank customer service.
• Any proof of the caller's number (even if it was spoofed).
• Bank's final reply closing the claim (if any).

What Evidence Is Required?

• Primary evidence: The phone number from which the fraudulent call came (even if spoofed, call detail records from your telecom provider can help).
• Documentary evidence: Bank statements, SMS of OTP and transaction alerts, written complaints, and email exchanges.
• Electronic evidence: The Flipkart transaction ID, gift card redemption details (if traceable), IP address of the device that redeemed the gift card.
• Testimonial evidence: Your own affidavit stating the sequence of events.
• Expert evidence: A cyber forensic report can prove that the OTP was shared after a fraudulent call, not voluntarily.

How the Police Behave in Such Cases

Police often treat credit card fraud as a civil dispute unless you push hard. They may say "it's between you and the bank" or "you shared the OTP, so no case." That's wrong. Insist on an FIR. Cyber cells are better equipped — they understand spoofed calls and IP tracing. But they are overloaded. A lawyer's intervention can speed things up. The key is to present a clear, documented timeline of fraud.

Timeline of Legal Process

• Day 1-3: Block card, file police complaint, send written notice to bank.
• Week 1-4: Bank investigation — if no resolution, escalate to Banking Ombudsman.
• Month 1-6: Banking Ombudsman process (usually 3-4 months).
• Month 6-12: If Ombudsman fails, file consumer complaint before District Commission.
• Month 12-18: Consumer forum hearing, evidence, arguments, judgment.
• Month 18+: Appeal to State Commission (if needed).
• Criminal track: FIR -> investigation (3-6 months) -> chargesheet -> trial (1-2 years).

How Long Will the Investigation Take?

Police investigations in cyber fraud cases typically take 3 to 6 months from FIR filing. If the fraudster used a spoofed number, tracing them may take longer — up to a year. The chargesheet must be filed within 60-90 days for cognizable offences. If not, the accused can seek default bail.

Understanding the Costs

The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.

A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.

Can the Matter Be Settled Out of Court?

Yes, in many cases the bank will settle once a consumer complaint is filed — they fear the reputation damage. Also, if the fraudster is identified, you can settle under Section 320 BNS for compoundable offences. Settlement through the Banking Ombudsman is common. A Lok Adalat can also be approached for a mediated settlement. However, if the bank is adamant, you may need to pursue the case to judgment. Settlement is advisable if it saves you years of litigation.

Common Mistakes People Make

• Delaying the complaint: Waiting even a day can weaken your claim. Banks often argue "timely reporting" as a defense.
• Deleting SMS or call logs: This destroys primary evidence. Keep everything intact.
• Not filing a written police complaint: An oral complaint is worthless. Get it in writing, with a receipt.
• Posting on social media: This can prejudice your case and alert the fraudster. Keep it professional.
• Engaging an advocate without domain experience: Banking and cyber fraud cases are procedural minefields. A general practitioner may not know the nuances of RBI circulars, the evidentiary value of call records, or the timeline for escalation. Domain-specific experience directly affects how fast and effectively your case moves.
• Not escalating to the Banking Ombudsman: Many give up after the bank's first refusal. The Ombudsman is a powerful tool.

FAQs People Normally Have

Will the bank refund the money if I shared the OTP?

Not automatically. But under the RBI's circular on limiting customer liability, if the fraud was reported within 3 working days, your liability is capped at zero — even if OTP was shared under duress. You need to prove it was not voluntarily shared.

What if the police say they can't trace the fraudster?

The police's inability does not end your case. Your claim against the bank under consumer law is separate. The bank cannot escape liability just because the criminal is not caught.

Can I sue Flipkart directly?

Yes, if you can show Flipkart's security lapses enabled the fraud. But your primary action should be against the bank. Flipkart is a secondary target. The consumer forum can join them as a party in the complaint.

How long does the Banking Ombudsman take?

Typically 3 to 4 months from filing. The Ombudsman can award compensation up to ₹20 lakh. No lawyer fees are needed initially, but expert legal drafting of the complaint can increase your chances.

Will the bank block my card permanently?

If the card was used for fraud, the bank may block it temporarily. But if you resolve the matter, you can get a new card. That's a minor inconvenience compared to the loss.

This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.

Advocate Sudhir Rao, Supreme Court of India

Facing a similar matter? Speak to a criminal advocate in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.