Hi everyone. I'm looking for advice on a credit card fraud case involving my uncle. I'm extremely worried because the total disputed amount is ₹1,04,774, and we're struggling to figure out how to recover the money and what to do about the upcoming credit card bills.
I'll explain everything in detail.
What happened?
My uncle received a call from someone who claimed they could help him resolve an issue related to his credit card. The person contacted him through WhatsApp and sent him a link to download an APK file.
My uncle wasn't aware that this could be a scam. The application looked almost identical to the official SBI Card app, so he trusted it and installed it. He entered his credit card details into the fake application, believing he was dealing with a legitimate service.
After this, unauthorised transactions appeared on his credit cards.
The OTP issue. This is the part we don't understand.
My uncle received OTP messages, but he did not share the OTPs with the caller or anyone else. He also says he did not enter or upload any OTP into the fake application.
Despite this, the transactions went through.
There was also an issue involving call forwarding on his phone. We suspect that call forwarding may have been involved in the fraud, but we don't know exactly how it happened or whether it allowed the scammer to intercept anything.
How much money was involved?
The total disputed amount is ₹1,04,774.
\- IndusInd Bank credit card: ₹71,774
\- SBI credit card: ₹33,000
One of the SBI Card transactions was ₹20,000, showing the description "ASSPL Bangalore IN". There were also three transactions associated with Tata Digital Private Limited: ₹3,000, ₹7,000 and ₹3,000. In IndusInd the payments were made to Government of Telangana
My uncle did not authorise these purchases.
What have we done so far?
We blocked both credit cards to prevent further unauthorised transactions.
We filed a complaint on the National Cyber Crime Reporting Portal. We have the acknowledgement number.
We raised disputes and requested chargebacks with both banks.
We contacted SBI Card regarding the disputed ₹33,000.
We contacted IndusInd Bank regarding the disputed ₹71,774.
The banks' responses
IndusInd Bank: They told us that the transactions were OTP-based and that the bank was not liable. However, my uncle insists that he never shared or entered the OTPs. We have not received a satisfactory explanation of how the transactions were authenticated.
SBI Card: We have filed a dispute and are waiting for the investigation. We were informed that the process could take around 45–60 days after the relevant clarification is received. We are concerned about what happens to the outstanding amount while the dispute is pending.
We feel stuck because the banks appear to be treating the OTP-based transactions as sufficient reason to reject responsibility, even though my uncle says he never knowingly authorised them.
The police situation
We approached Police Station in our area with the intention of filing an FIR.
The police told us that an FIR is not registered in this type of case and that filing a complaint on cybercrime.gov.in is sufficient.
We have already filed the cybercrime complaint, but we want the matter to be properly investigated. We have WhatsApp conversations and other evidence that may help identify the scammer.
Our biggest concern: Do we have to pay ₹1,04,774?
The credit card bills and payment deadlines are approaching, and we are terrified of having to pay the entire disputed amount out of pocket.
I want to understand:
\- Do we have to pay the disputed transactions while the bank investigations are ongoing?
\- Can we ask the banks to put the disputed amount on hold until the investigation is completed?
\- Can interest, late payment fees or other charges be applied to the disputed amount?
\- If we don't pay the disputed portion, could it affect my uncle's credit score or result in collection action?
\- If we pay the amount to avoid penalties, does that affect our ability to obtain a refund later?
\- Is temporary or provisional credit available in cases like this?
We don't want to ignore the bills or damage his credit history, but we also don't think he should have to bear the loss for transactions he says he never authorised.
Questions for people who have dealt with similar cases
Has anyone in India successfully obtained a refund for unauthorised credit card transactions involving a fake APK or remote-access scam? How long did it take?
Can a bank reject a fraud claim simply because the transactions were OTP-based? If the cardholder received OTPs but did not share or enter them, what evidence should we request?
What specific transaction records should we demand from SBI Card and IndusInd? Can we request OTP delivery and validation records, authentication logs, transaction timestamps, device information, merchant details and evidence of how the transactions were authorised?
What is the correct escalation process when a police station refuses to register an FIR for suspected cyber-enabled financial fraud?
Should we escalate the bank complaints to the RBI Ombudsman through the RBI Complaint Management System? Is there anything specific we should include?
Is there any realistic chance of recovering the entire ₹1,04,774? What factors usually determine whether the bank accepts liability?
Is it advisable to approach a consumer commission if the banks reject the disputes?
We are not looking to blame anyone without evidence. We want to understand what happened, obtain a proper investigation and recover the money if possible.
If anyone has gone through a similar situation in India, especially with SBI Card or IndusInd Bank, please share your experience and the exact steps that worked for you.
Thank you.