Credit card stolen and money spent: Will the bank refund the loss, or will you have to pay the bill?

Imagine losing your credit card during a busy day. You realise it is missing only later hours later, open your banking app and discover that someone has already used it to make several purchases. The immediate question is obvious: Do you have to pay that money back or will the bank refund it?

The answer is not always straightforward.

Your credit card was stolen and money was spent. Who bears the loss?

A fraudulent transaction does not automatically become the cardholder’s responsibility. It depends on how the fraud happened and when the bank was informed, Ashish Lath, Founder and CEO of SaveSage told ET Wealth Online.

The number of days taken to report the transaction can also determine the customer’s liability.

Suppose a person loses their credit card at a shopping centre. Before they notice it is missing, someone uses the card to make purchases worth thousands of rupees. The customer then spots the transactions and immediately informs the card issuer.

What happens next largely depends on the circumstances surrounding the unauthorised transactions.

Once the loss or theft of a card is reported and the card is blocked, any subsequent unauthorised transaction should ordinarily be borne by the bank, said Aditya Soni, Founder and CEO of CheQ. For transactions made before the loss is reported, however, liability is determined according to the Reserve Bank of India (RBI) guidelines and the card issuer’s customer protection policy.

What do RBI rules say?

The RBI has laid down rules aimed at limiting a customer’s liability in cases involving unauthorised electronic banking transactions. Under the framework, a customer may have zero liability where there is fraud, negligence or a deficiency on the part of the bank. Zero liability may also apply in a third-party breach where neither the bank nor the customer is at fault, provided the customer notifies the bank within three working days of receiving communication about the unauthorised transaction.

The three-working-day rule, however, should not be treated as an automatic refund guarantee in every case.

If the customer was negligent — for instance, by sharing payment credentials — the customer may bear the loss until the unauthorised transaction is reported to the bank. Losses occurring after the transaction has been reported are to be borne by the bank under the RBI framework.

For cases reported between four and seven working days after the customer receives communication about the transaction, liability may be limited according to the RBI’s prescribed caps and the nature of the account. Beyond seven working days, the liability is determined under the bank’s Board-approved policy. The RBI also places the burden of proving customer liability on the bank.

“If you report such a charge within three working days, there’s nothing you owe, and the bank would cover whatever amount was spent using your card,” Lath said, while cautioning that the three-day rule is not a blanket guarantee.

What should you do when you realise your card has been stolen?

The first step is to block the card immediately. Customers should use the issuer’s mobile app, internet banking, dedicated helpline or another available reporting channel and should not wait until they have gathered every detail about the theft.

RBI directions require card issuers to block a lost card immediately after being informed by the cardholder. Issuers must also provide multiple 24×7 channels for reporting the loss, theft or unauthorised use of a card and must send confirmation after the card is blocked.

Customers should also check recent transactions, report every unauthorised charge and retain complaint or reference numbers. The timing of the report can be critical if there is a dispute over who should bear the loss.

For a cardholder who has just discovered a stolen credit card, speed can therefore make a significant difference. Reporting the theft promptly may not only stop further misuse but could also determine whether the fraudulent spending ends up on the customer’s bill or is ultimately borne by the bank.