Credit Card Fraud: Provisional Credit Reversed by the Bank? How to Fight the Reversal

Who this guide is for

This guide is for any credit card holder in India who:

• Reported an unauthorised or fraudulent transaction and received a provisional or temporary credit while the bank investigated, and
• Later saw that credit reversed and the amount re-debited, with the bank saying the transaction was "genuine", "authenticated", "successful", or "OTP-verified", and
• Believes the transaction was fraud, because they never made it, never received or shared any OTP, or never received the goods or services charged.

It is useful whether your card is from a public sector bank, a private bank, a card-issuing company, or an NBFC, because the consumer and RBI routes apply to all of them. The fastest, most powerful tools here are your written dispute, the card-network chargeback, and the RBI Ombudsman, not RTI.

Who this guide is NOT for

This guide does not cover billing disputes where you accept that you made the purchase but disagree on the amount, EMI conversion, or fees. For those, see our guides on a wrongly billed annual fee or a reversed EMI conversion. It also does not cover situations where you knowingly shared your card details, OTP, or PIN with someone you trusted, as RBI's framework treats customer negligence differently. If the loss is very large, or you suspect organised fraud, also lodge a complaint on the National Cyber Crime Reporting Portal and consider professional legal help alongside the steps below.

What you can do this weekend

Friday evening

Pull your credit card statement and find the disputed transaction. Note the merchant name, the amount, and the exact date and time. Then find the date you first reported the fraud, because this single date drives your liability protection. Search your phone and email for any OTP message, transaction alert, or bank SMS around that transaction. Take screenshots of everything. If no OTP message exists, that absence is itself evidence. Also locate the complaint or ticket reference number the bank gave you when you first reported.

Saturday

Write a short, factual dispute and send it to the bank's official grievance email. State the transaction details, the date and time you first reported, your complaint reference number, and one clear line: that the transaction was not authorised by you and that you did not receive or share any OTP. Ask three things in writing: the exact reason for reversing the provisional credit, a copy of the authentication or 3-D Secure log relied on, and confirmation that the chargeback has been raised with the card network. Use the template lower down. Keep the sent email as proof, because it starts your 30-day clock for the RBI Ombudsman.

Sunday

Organise one folder, named by date, holding your statement, the reversal message, your written dispute, all OTP and alert screenshots, and any proof of where you were when the transaction happened. If the amount is large or you suspect a wider scam, file a complaint on the National Cyber Crime Reporting Portal and save the acknowledgement number. By Monday you will have a clean evidence file and a written dispute on record, which is exactly what the card-network dispute and the Ombudsman need.

Documents and evidence checklist

Step-by-step action plan

Step 1 — Report the fraud and lock the date

If you have not already, report the unauthorised transaction immediately, both by phone and in writing. The date and time you first report drive how much of the loss you may have to bear under RBI's limited-liability framework for unauthorised electronic transactions. The general principle is simple: the faster you report, the more you are protected, and delay can shift more of the loss onto you. Get a complaint reference number, note the exact reporting date and time, and follow up any phone call with an email so there is a timestamped record. Ask the bank to block the card if it is not already blocked.

Step 2 — Get the reversal reason in writing

When the bank reverses the provisional credit, do not accept a vague "transaction found genuine" line. Ask in writing for the precise basis. The most common reason is that the transaction was authenticated, often through an OTP or a 3-D Secure step. So ask the bank to share the authentication log, the channel used, and the merchant details. If you never received or shared any OTP, state that clearly and ask the bank to prove that an OTP was generated, delivered to your registered number, and entered. The OTP versus non-OTP distinction matters: a transaction that bypassed proper authentication, or where the OTP never reached you, points to a system or third-party failure rather than your negligence.

Step 3 — Assemble your chargeback evidence

A chargeback is the formal mechanism by which your bank claws back a disputed amount from the merchant's bank through the card network. Strong evidence wins chargebacks. Put together one file: the statement entry, your fraud-report date and reference number, all OTP and alert messages or proof none arrived, your location or circumstances at the transaction time, and any police or cybercrime complaint. If the charge is for goods or services you never received, add order and delivery records. Keep it factual and dated. This same file later serves your Ombudsman complaint.

Step 4 — Push the card-network dispute (Visa, Mastercard, RuPay)

You cannot approach Visa, Mastercard, or RuPay directly as a cardholder. The dispute goes through your issuing bank, which raises a chargeback under the relevant network's rules. Ask the bank in writing to raise or, if it already closed the case, re-raise the chargeback with the correct reason code for fraud or an unauthorised transaction, and to share the network's response. If the bank says the chargeback "failed" or was "represented" by the merchant, ask for the documents the merchant submitted, so you can rebut them. A reversal of your provisional credit is often the result of a lost chargeback that you were never shown.

Step 5 — Demand the bank's investigation findings in writing

Escalate from the call centre to the bank's grievance or nodal officer. Send a formal grievance citing RBI's limited-liability principle for unauthorised electronic transactions and demand: the exact reason for the reversal, the authentication or 3-D Secure log, the chargeback outcome and reason code, the merchant details, and the clause of the bank's board-approved liability policy relied on. A written demand puts the bank on notice and creates the record you need. If the bank does not respond properly, that silence or refusal is itself a deficiency you can carry to the Ombudsman.

Step 6 — Escalate to the RBI Ombudsman at cms.rbi.org.in

If 30 days pass after your written complaint without a satisfactory resolution, or the bank rejects your dispute, file a free complaint with the RBI Ombudsman at cms.rbi.org.in under the Reserve Bank-Integrated Ombudsman Scheme. This covers credit cards issued by banks and many NBFCs. Upload your statement, fraud report with reference number, the reversal message, your written grievance, and all evidence. You do not need a lawyer. Read our RTI filing guide and the broader Banking and Finance practical guides for related steps. The exact compensation limits and timelines are set by RBI, so check the current position on the official portal.

Step 7 — File an RTI only for a public sector bank issuer

If your credit card is issued by a public sector bank (such as SBI, PNB, Bank of Baroda, Canara Bank, or Union Bank of India), you can file an RTI with the bank's Public Information Officer for the records that relate to your own dispute: the authentication log, the chargeback correspondence, and the basis for the reversal. You can also file an RTI with the RBI to confirm your Ombudsman complaint was received and to ask about action taken. For private card issuers, RTI does not apply; use the Ombudsman route instead. See how to file an RTI online.

Escalation ladder

Copy-paste complaint template

Replace the text in square brackets with your own details before sending.

When RTI can help

The RTI Act, 2005 applies to public authorities. Public sector banks — those substantially owned or controlled by the Central Government — are public authorities under the Act. If your credit card is issued by a PSU bank, you can file an RTI with the bank's Public Information Officer to:

• Obtain the authentication or 3-D Secure log relied on to call the transaction "genuine" in your own case.
• Get the chargeback correspondence and reason code exchanged with the card network for your dispute.
• Ask for the basis and the policy clause used to reverse your provisional credit.
• Find out the status and movement of your own complaint file within the bank.

The RBI itself is a public authority under the RTI Act. You can file an RTI with the RBI's Central Public Information Officer to confirm whether your complaint at cms.rbi.org.in was received and registered, and to ask about action taken on bank complaints of a given category. An RTI to a PSU issuer creates a formal paper trail that must be answered within the prescribed time, and the reply can be used as evidence in your Ombudsman complaint. For the process, read our guide to filing an RTI online, and see how to file a first appeal if the bank does not respond on time.

When RTI will not help

Private card issuers: HDFC Bank, ICICI Bank, Axis Bank, Kotak Mahindra Bank, IndusInd Bank, and card-issuing companies such as SBI Cards are not public authorities under the RTI Act. You cannot file an RTI directly against them. For these issuers, use the bank's grievance and nodal escalation, and then the RBI Ombudsman at cms.rbi.org.in. You can still file an RTI with the RBI about action taken on your complaint.

The card networks: Visa, Mastercard, and RuPay are not public authorities you can RTI for your transaction records, and you cannot approach them directly as a cardholder. The dispute must run through your issuing bank, which is why your written demand to the bank for the chargeback outcome matters.

What RTI cannot do: RTI gives you information; it does not order the bank to re-credit your money. The records you obtain — the authentication log, the chargeback reason code, or proof that no proper OTP reached you — are evidence you use in the Ombudsman complaint, a consumer commission, or court. The order to refund comes from those forums, not from the RTI reply. See the CPGRAMS and RTI guide for how grievance and information tools work together for PSU bodies.

Common mistakes to avoid

• Treating the reversal as final. Provisional credit is interim. A reversal is a finding you can contest with fresh evidence, not a closed door. Always ask for the reason in writing and respond to it point by point.
• Reporting late or only by phone. The date you first report drives your liability protection. Report immediately and always confirm in writing, so you have a timestamped record and a reference number.
• Accepting a vague "transaction found genuine". Demand the authentication log. If the bank claims an OTP was used, ask it to prove the OTP was generated, sent to your registered number, and entered. If no OTP reached you, that absence is your strongest point.
• Not asking for the chargeback outcome. A reversed provisional credit often follows a lost chargeback you were never shown. Ask for the reason code and the merchant's documents so you can rebut them.
• Going to the wrong forum. You cannot RTI a private bank or contact Visa or Mastercard directly. Use the bank's grievance cell and the RBI Ombudsman; use RTI only for a PSU issuer or the RBI itself.
• Sharing the OTP or card details and then disputing. RBI's framework treats customer negligence, such as sharing an OTP, differently from a bank or system failure. Be accurate about what happened; do not claim you never shared an OTP if you did.
• Missing the escalation window. File with the Ombudsman within the time allowed after the bank's reply or the expiry of the 30-day response window. Waiting too long can cost you this free remedy.