How to protect yourself from unsolicited cards, fraudulent transactions

Follow this complaint escalation path: Bank's grievance cell, ombudsman, consumer commission, and then civil or criminal court

A recent case before the Delhi High Court has put the spotlight on how vulnerable customers are to unauthorised credit card transactions and poor grievance redressal by banks. After a New Delhi-based lawyer was harassed for refusing to pay charges on a credit card he never asked for, nor activated, and for fraudulent transactions he never made, the court stepped in with strong directions to protect customers, tighten bank accountability, and push the Reserve Bank of India (RBI) to overhaul its complaint-handling system. The case serves as a wakeup call for all credit-card holders. 

Cancelling unsolicited card 

According to legal experts, when an unsolicited credit card arrives, the customer must treat it as an uninvited financial risk. The RBI’s Credit Card and Debit Card Issuance Directions, 2022, prohibit such cards. Banks must cancel them immediately once the customer objects. 

“The safest step is to send a written protest, via email or letter, to the bank’s nodal officer and customer care the same day, clearly mentioning the card’s last four digits and demanding cancellation. Written communication is essential, as phone calls carry little weight. Until the bank cancels it in its system, the card can still be misused even if never activated, so a quick written objection protects the customer from future liability,” says Vishal Gehrana, partner designate, Karanjawala & Co. 

Proof of cancellation 

Customers should insist on written confirmation from the bank stating that the credit card account has been closed. The issuer must provide it within seven working days. “Customers should also check their credit report (in CIBIL and other bureaus) to ensure the card reflects a ‘closed’ status, and thereby confirm that no active credit line remains in their name,” says Rahul Sundaram, partner, IndiaLaw LLP. 

Handling fraudulent transactions 

Customers should immediately report the unauthorised transaction in writing — by email or letter — and file a formal complaint. “Under RBI rules on unauthorised electronic transactions, prompt reporting protects the customer and bars the bank from levying interest, late fees, or taking recovery action while the dispute is pending,” says Gehrana. 

“They should demand reversal of the charge and escalate it to the bank’s grievance cell, if needed. If the bank fails to act, the customer can approach the RBI Ombudsman under the Integrated Ombudsman Scheme,” adds Sundaram. 

Delay can be treated as implied acceptance, whereas a quick written objection forces the bank to review its authentication logs and strengthens the customer’s position. 

Proving unauthorised transactions 

Proof of unauthorised usage lies in the bank’s transaction data, which it must maintain under the Payment and Settlement Systems Act, 2007, and the RBI’s KYC (know your customer) and digital payments instructions. If the card was never activated, the bank must explain how the charge occurred. “For active cards, customers can request OTP (One-time password) logs, device IDs, IP addresses, merchant records, and any internal fraud-control flags. Misalignment with the customer’s usage shifts the burden to the bank, which must justify how the transaction passed its own security checks,” says Gehrana. 

Contesting fraudulent card charges 

Three steps are important to contest a fraudulent card charge. Dispute the transaction in writing without delay, so that the RBI framework on customer liability is triggered. 

“File a complaint with the bank’s grievance officer and escalate to the RBI Ombudsman if unresolved, ensuring forms and supporting documents are complete,” says Gehrana. 

Document and report any intimidation by recovery agents to the bank and regulator, as the RBI prohibits such conduct. Following these steps shifts the burden to the bank to prove the customer’s fault. If the bank cannot prove it, it means there is no liability. 

Escalate complaint to ombudsman 

If the bank fails to resolve a complaint within 30 days or responds unsatisfactorily, the customer can escalate it to the RBI under the Integrated Ombudsman Scheme. “This free, online forum handles grievances against banks and financial institutions, requires no lawyer, and is legally recognised as the proper next step when banks fail to act,” says Shankey Agrawal, partner, BMR Legal. 

Complaints to the RBI can be filed online, by email, or by post, but only after the bank has failed to respond within 30 days or rejected the grievance. The form requires account details, grievance description, bank correspondence, and supporting documents. “All mandatory fields must be filled accurately. Once submitted, a reference number is issued and the case is assigned to an RBI ombudsman. The process is user-friendly,” says Agrawal. 

Handling rejection by ombudsman 

The Delhi High Court clarified that complaints cannot be rejected based on minor technical errors. “If rejected, the customer should promptly correct and refile the complaint and submit a written representation challenging the rejection,” says Agrawal. 

“If the ombudsman rejects the complaint on technical grounds, the customer can seek a review, approach the consumer commission, or pursue civil or criminal action in fraud cases,” says Siddartha Karnani, partner, King Stubb & Kasiva, Advocates and Attorneys. 

The Delhi High Court has mandated that the RBI must allow defect correction and human review. “If the complaint is still unfairly dismissed, the customer can approach the High Court through a writ petition, as courts have now made it clear that technological gaps cannot defeat substantive justice,” adds Agrawal.

 

The writer is a New Delhi-based independent journalist