Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
For Indian online shopping, a credit card has the clearer regulator-backed safeguard in one defined situation: an unauthorized domestic card-not-present transaction that took place without required additional-factor authentication. That is not a guarantee that a card payment can be reversed whenever a purchase goes wrong. UPI offers in-app complaint tools and a route to the bank, but the official guidance cited here does not establish a universal UPI reimbursement promise equivalent to that specific card safeguard.
The right response depends first on what happened: an unauthorized debit, a failed payment, a purchase you authorized after being deceived, or a dispute with the seller. Those cases follow different routes. The rules and complaint options below concern India; your bank or issuer’s terms may affect the handling of an individual claim.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
At a glance
| Name | Best for | Key protection | Complaint route | Checked |
|---|---|---|---|---|
| Credit card | Online purchases where you want the clearer cited safeguard for a qualifying unauthorized domestic card-not-present transaction | RBI says domestic card-not-present transactions require additional-factor authentication; if a transaction occurred without it and the customer says it was unauthorized, the issuer must reimburse the loss | Card issuer; use its official card controls to restrict the card or change online limits | November 2026 |
| UPI | Payments where you want an in-app transaction complaint route and bank escalation | NPCI says users can raise transaction complaints in the app and directs users with fraudulent transactions to their bank; the cited sources do not establish a universal UPI liability promise equivalent to the card rule above | Payment app and bank | November 2026 |
Which offers better fraud protection for online shopping?
A credit card has the better-defined protection in the narrow case of an unauthorized domestic card-not-present payment made without the additional authentication required by RBI. For other situations—including a payment you approved after being tricked, a failed transaction, or a problem with the goods—the evidence does not support calling either method an across-the-board winner.
RBI’s credit-card operations FAQ says domestic card-not-present transactions require additional-factor authentication. It also says that when a customer reports a transaction as unauthorized and it occurred without that authentication, the issuer must reimburse the loss without demur. “Card-not-present” generally describes a remote payment, such as an online checkout, rather than a card physically presented to a merchant.
Popular on Amazon
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
That rule is important, but it is not a blanket card-purchase refund policy. It addresses a specified authentication failure and an unauthorized transaction. It does not say every card purchase can be reversed because an order was late, the product was disappointing, or a buyer regrets paying.
UPI has complaint facilities, but a complaint button is not the same thing as a promise of repayment. NPCI’s UPI Help guidance describes raising transaction complaints in the app and says users should contact their bank about fraudulent transactions. The official sources cited here do not set out a universal UPI liability commitment equivalent to RBI’s specific missing-authentication card protection.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSo the practical choice is conditional: if your main concern is the clearest stated protection for a qualifying unauthorized online card transaction, the credit card has an advantage. If something goes wrong, however, classify the incident and report it quickly rather than assuming the payment method alone decides whether you get money back.
What kind of payment problem are you dealing with?
Start by separating unauthorized activity from a failed payment or a purchase dispute. The word “fraud” is often used for all three, but the RBI rules and remedies differ.
| What happened | How to describe it | What the cited rules address |
|---|---|---|
| A debit or charge you did not make or permit | Unauthorized transaction | RBI’s customer-liability rules and, for a qualifying domestic card-not-present transaction, the card additional-authentication rule |
| Your account was debited, but the merchant did not receive confirmation | Failed payment | RBI’s failed-transaction reversal timelines for the described card e-commerce and UPI merchant-payment cases |
| You approved payment after a scammer misled you | Authorized payment following deception | The cited sources do not promise an automatic refund; report the facts accurately and ask the bank or issuer to assess the case |
| You paid the seller, but the order was not delivered or differed from its listing | Merchant or purchase dispute | The cited failed-payment timelines do not establish a refund or chargeback entitlement for a completed purchase dispute |
This distinction is especially important when you contact your bank. If you personally approved a payment because someone deceived you, do not report it as a transaction you never made. Explain what you authorized, what the other party told you, and why you believe the payment was fraudulent. The cited official material does not settle every social-engineering or merchant-misconduct scenario, so a bank’s review of the specific facts matters.
Also popular on Amazon
How does RBI’s credit-card protection work?
The key protection combines an authentication requirement for domestic card-not-present transactions with RBI’s separate rules on customer liability for unauthorized electronic transactions. Whether a customer has zero liability can depend on who was at fault and how quickly the customer reports the incident.
RBI’s Master Directions on customer protection set out liability rules for unauthorized electronic banking transactions. They say a customer has zero liability when the bank is at fault. In a specified third-party-breach case where neither the bank nor the customer is at fault, the customer must notify the bank within three working days of receiving the bank’s communication about the transaction to qualify for zero liability under that rule.
If the customer shared payment credentials, the directions say the customer bears the loss up to the point of notifying the bank; losses after notification are borne by the bank. The directions also require the bank to provide provisional credit within 10 working days after notification and to resolve the complaint within no more than 90 days. These are handling timelines in the cited framework, not a guarantee that every claim will be decided in the customer’s favor.
The three-working-day period is not a reason to wait. RBI’s financial-awareness guidance advises customers to notify the bank immediately and says the bank should acknowledge the complaint. Report a suspicious transaction as soon as you discover it, keep the complaint reference, and ask the bank what documentation it needs.
The cited liability directions concern unauthorized electronic banking transactions and their application can vary by fault and account category. Read the relevant rule as protection for defined circumstances, not as a general promise that a card issuer must refund any online-shopping loss.
Also popular on Amazon
Does UPI provide the same protection?
The sources support a clear complaint path for UPI, but not the same universal reimbursement promise. Raise the transaction complaint through the payment app and contact the bank promptly if the transaction was fraudulent.
NPCI’s UPI Help material says users can raise a complaint against a transaction in the app and specifically directs users reporting fraudulent transactions to their bank. RBI’s Online Dispute Resolution directions require an in-app dispute facility for UPI third-party app providers, initially covering failed-transaction disputes. That requirement helps users lodge and track covered disputes; it does not, on its own, prove that a user will recover an authorized payment made to a scammer or a seller.
UPI payments also involve an app and a bank, so make sure you report the issue through both relevant channels: the app’s transaction complaint facility and the bank associated with the account. Do not share your UPI PIN with anyone claiming to help resolve a complaint. Save the transaction ID and the app’s complaint reference.
The absence of a universal promise in these cited sources should not be read as proof that a particular UPI complaint cannot succeed. It means the available official guidance does not justify claiming that every UPI user has the same guaranteed outcome across apps, banks, and types of incident.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →When does the T+5-day reversal rule apply?
RBI’s T+5-day maximum applies to the failed-payment examples specified in its circular—not to every debit that a customer wants refunded. For the described case where a card e-commerce account is debited but the merchant does not receive confirmation, the cited maximum reversal time is T+5 days; the same maximum is stated for the corresponding failed UPI merchant-payment case.
Also popular on Amazon
Here, “T” is the transaction date. If the merchant received the payment and the order was completed, the payment is not automatically a failed transaction just because the goods have not arrived or are not as described. Those are purchase disputes, and the failed-payment circular does not create an automatic refund right for them.
If your account was debited but the merchant says it did not receive confirmation, keep the transaction ID and any reference supplied by the app or bank. Report it as a failed transaction and ask the bank or provider to trace or reverse it under the applicable process. Avoid describing it as an unauthorized transaction unless you did not make or permit the payment.
The relevant RBI failed-transaction circular is dated September 20, 2019. Its timelines concern specified payment failures; they should not be confused with the separate customer-liability rules for unauthorized transactions.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat should you do if an online payment looks fraudulent?
Contact the bank or card issuer immediately through an official channel. The first priority is to report the transaction accurately, limit further risk, and create a record of your complaint.
- Identify the transaction. Note the amount, date, merchant or payee, transaction ID, and whether you made or approved the payment. Decide whether it was unauthorized, failed, or a completed purchase dispute.
- Notify the bank or issuer. Use the contact route in the official banking app, on the bank’s website, or on the card. Say plainly what happened and when you noticed it. Ask for a complaint reference and retain it. RBI guidance says to report promptly and says the bank should acknowledge the complaint.
- For a card, restrict further use if needed. Use the issuer’s official controls to block or restrict the card and review online transaction limits. RBI’s card FAQ says cardholders may set and modify online transaction limits. If you need a setting not shown in the app, ask the issuer what controls are available.
- For UPI, complain in the app and contact the bank. Use the transaction-specific complaint route in the payment app, then report a suspected fraudulent transaction to the bank as NPCI advises. Never disclose your UPI PIN to someone contacting you about the complaint.
- If the debit was from a failed payment, request a trace or reversal. Explain that the account was debited but the merchant did not receive confirmation, if that is what happened. Save the transaction ID and complaint reference while the bank or provider investigates under the applicable failed-payment process.
- Escalate if the response is unsatisfactory. Follow the bank’s published grievance process. For covered digital-payment disputes, RBI’s ODR framework provides dispute-lodging and tracking facilities. Keep copies of the original complaint, responses, and evidence so the escalation has a clear timeline.
When reporting, be precise about authentication and consent. Whether you entered a one-time code, approved a prompt, shared credentials, or made the payment yourself after being misled may affect how the bank assesses liability. Do not omit those details; explain the circumstances and ask the bank to assess them under the applicable rules.
Also popular on Amazon
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
How should you choose between a card and UPI?
Choose based on the risk and the protections you can actually use—not on a blanket claim that one method is always safer.
- Prioritize a credit card if you want the specific RBI-backed safeguard for an unauthorized domestic card-not-present transaction that occurred without required additional-factor authentication. Keep the issuer’s contact and card-control options accessible.
- UPI remains a practical payment method if you are comfortable using its app complaint route and contacting your bank when something goes wrong. Use it only with the understanding that an in-app complaint is not itself a reimbursement guarantee.
- For either method, act quickly. Prompt reporting is material under the customer-liability framework, and early reporting gives the bank or issuer the chance to restrict access and investigate.
- For seller problems, preserve purchase evidence. Keep the order confirmation, listing, seller messages, delivery status, and payment record. A non-delivery or quality complaint is not automatically an unauthorized transaction or a failed payment.
No payment method removes the need to protect credentials or scrutinize payment requests. A card’s clear safeguard in one specific CNP scenario should not be mistaken for a promise to reverse an authorized scam payment; likewise, UPI’s complaint process should not be mistaken for a guarantee that every claim will be reimbursed.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Frequently Asked Questions
Does the card’s missing-authentication rule mean every online card payment is refundable?
No. RBI’s stated safeguard concerns a transaction reported as unauthorized that occurred without required additional-factor authentication for a domestic card-not-present payment. It does not create a general refund right for a completed purchase, delivery delay, or product-quality complaint.
Can I change the online limit on my credit card?
RBI’s card FAQ says cardholders may set and modify online transaction limits. The available controls and how to access them depend on the issuer, so use its official app or contact channel.
Is an app complaint enough if I suspect UPI fraud?
Use the app’s transaction complaint route, but also contact your bank: NPCI’s UPI Help guidance specifically directs users reporting fraudulent transactions to the bank. Keep both complaint references and the transaction ID.
