India / Banking

How to block a lost or stolen ATM or debit card

Tell your bank the moment the card is missing, through its app, net banking, SMS, helpline or branch. RBI requires the bank to block it at once and confirm the block. If money has already gone, report each unauthorised transaction immediately, because your liability depends on how fast you report.

Fee: RBI sets no fee for blocking; the replacement card charge varies by bank
Time: Block is immediate on reporting; fraud claims must be decided within 90 days
How: Bank's app, net banking, SMS, helpline or branch

Checked against official sources on 12 October 2026. See the 9 sources.

Quick answer

Block the card now using whichever is fastest: your bank's mobile app or net banking (card services), the bank's 24x7 helpline or IVR, its SMS block facility, or your home branch. RBI requires the bank to block a lost card immediately on being informed. Paperwork, if any, comes later.
Wait for the confirmation. The bank must immediately send you a confirmation that the card is blocked. Save it.
Check your account. If there is any transaction you did not make, report each one to the bank at once and get a complaint number.
For fraud, also report on cybercrime.gov.in or call 1930.

Speed decides who pays. Under the RBI rules in force today, a loss caused by a breach that was neither your fault nor the bank's costs you nothing if you report within three working days of the bank's alert. Whatever happens after you report is always the bank's loss.

Who can apply

Any cardholder can report their own card lost or stolen. You do not have to visit a branch: RBI requires banks to take the report by phone, SMS, email, website, net banking and app round the clock. If none of those work for you, report it at your home branch.

Documents you need

Nothing is needed to block. Keep these ready so the call or form goes quickly:

For	Keep ready
Blocking	Account number or registered mobile number, and the card number if you have it noted
Reporting an unauthorised transaction	Date, time and amount of each transaction, the SMS or email alert, and when you last used the card yourself
Follow up	The block confirmation and the complaint number with its date and time
Replacement card	Your consent, and KYC or address details if the bank asks

The bank may ask for further formalities after blocking. RBI says these can follow within a reasonable period defined in the bank's policy. They are not a condition for blocking.

Do not give your PIN, CVV, full card number or OTP to anyone in order to "block" a card. A genuine block request never needs them.

Steps

Block the card

Find the bank's official contact. Use the number on the back of another card from the same bank, your passbook, cheque book, a past SMS from the bank, or the bank's own website typed into the browser. Do not call a number that appears in search results or social media.
Use any channel the bank offers. RBI requires card issuers to provide multiple channels on a 24x7 basis: a dedicated helpline, a dedicated number for SMS, a dedicated email id, IVR, a clearly visible link on the website, internet banking and the mobile app.
Choose the option to block or hotlist the card and state that it is lost or stolen.
Note the reference number and keep the confirmation message.
If the same account is linked to UPI apps on a phone that was stolen along with the card, tell the bank about that as well.

Report an unauthorised transaction

Open the transaction alert SMS or email. Banks have to let you object by replying to the alert, or give a number in the alert to which you can reply.
Or use the "report unauthorised transaction" link that RBI requires on the home page of the bank's website, the helpline, or the home branch.
State clearly: "I did not make this transaction. I am reporting it as unauthorised." Give the date, time and amount.
Get the complaint number. The bank's system must acknowledge your report immediately with a registered complaint number, and it records the time your report was received. That time fixes your liability.
Report the fraud on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or the helpline 1930. From 1 January 2027 this becomes a condition for the new compensation described below.
Follow up in writing by email or at the branch, quoting the complaint number.

Get a replacement card

Ask for a new card through the app, net banking or branch. The bank can issue a replacement for a card blocked at your request only with your explicit consent, so it will not arrive unless you ask.

Fees

RBI's Directions do not set any fee for blocking a card. The charge for a replacement card is decided by each bank and appears in its schedule of charges. In a Basic Savings Bank Deposit (BSBD) account, the ATM or debit card carries no annual fee at issue or renewal.

How long it takes

Step	Time limit under RBI rules
Blocking a lost card	Immediately on being informed
Confirmation of blocking	Immediately
Bank credits the disputed amount to your account (rules in force today)	Within 10 working days of your report, value dated to the date of the transaction
Bank decides the complaint and your liability	Within the time in its policy, never more than 90 days. If it cannot decide in 90 days, it must pay you as per the rules
For transactions on or after 1 January 2027	Decision within 45 calendar days (60 for cross-border transactions)

Who bears the loss

These are the rules in force on 12 October 2026. They apply to debit cards, ATM withdrawals, net banking, mobile banking and other electronic transactions. Days are working days of your home branch, counted from the day after you received the bank's alert.

Situation	Your liability
Fraud, negligence or deficiency on the bank's side	Zero, whether or not you report it
Third party breach (fault of neither you nor the bank), reported within 3 working days	Zero
Third party breach, reported in 4 to 7 working days	The transaction value or the cap below, whichever is lower
Third party breach, reported after 7 working days	As per the bank's board approved policy
Your own negligence, such as sharing the PIN, OTP or card details	The entire loss until you report. Everything after you report is borne by the bank

Cap for the 4 to 7 working day case:

Account type	Maximum liability
BSBD account	Rs 5,000
Other savings accounts, prepaid instruments and gift cards, current or overdraft accounts of MSMEs, current accounts of individuals with average balance or limit up to Rs 25 lakh, credit cards with limit up to Rs 5 lakh	Rs 10,000
Other current, cash credit and overdraft accounts, credit cards with limit above Rs 5 lakh	Rs 25,000

The burden of proving that you were liable lies on the bank. You must not lose interest on the amount in a savings account while the matter is pending.

What changes on 1 January 2027

RBI issued amended rules on 24 June 2026. They apply to transactions made on or after 1 January 2027:

The time windows change from working days to calendar days. For a third party breach, liability is zero if you report within five calendar days of the transaction. After that, the bank's policy applies.
Bank side negligence stays zero liability. It now expressly includes not sending mandatory alerts and not providing 24x7 reporting channels.
Customer negligence is defined. It includes sharing a PIN, password or OTP, keeping the PIN written with the card, not telling the bank promptly about a lost card or fraud, ignoring a clear scam warning from the bank, downloading malicious apps, and not updating your mobile number with the bank.
Even where you were negligent, a one time compensation is introduced: for a loss up to Rs 50,000, an individual who is a genuine victim gets 85 per cent of the net loss, up to Rs 25,000, once in a lifetime. You must have reported to the bank and to the cybercrime portal or 1930 within five calendar days.
SMS alerts become mandatory for every electronic transaction above Rs 500.
The bank must decide within 45 calendar days (60 for cross-border), and must give reasons with supporting details if it rejects your complaint.

How to check status

Quote your complaint number on the bank's helpline, app or at the branch. If you later file with the RBI Ombudsman, track that complaint on cms.rbi.org.in with the complaint number and mobile number, or ask the RBI contact centre on 14448.

Common problems

No alert received, so you noticed late. Banks must send SMS alerts for electronic transactions. Not sending mandatory alerts is on the bank's side. Say so in your complaint.
Helpline keeps you waiting. Use the app, net banking, the SMS reply or the website link instead, or go to your home branch. Note the time of each attempt.
Bank says you shared the OTP. The burden of proof is on the bank. Ask for its finding in writing with reasons.
Bank asks you to wait for the insurance claim. Under the present rules the credit within 10 working days does not wait for settlement of any insurance claim.
No reply for 30 days, or the claim is rejected. File a free complaint with the RBI Ombudsman on cms.rbi.org.in within 90 days. You can also email crpc@rbi.org.in or post it to the Centralised Receipt and Processing Centre, Reserve Bank of India, Central Vista, Sector 17, Chandigarh 160017.
Card found after blocking. Ask the bank whether that card can be reactivated or whether a new card must be issued. This depends on the bank.
Mobile number changed. Update it with the bank. A bank cannot offer electronic transactions other than ATM cash withdrawal to a customer who has not given a mobile number, and from 2027 failing to update your number counts as negligence.

Fraud warning: people who have just lost a card are targeted by fake "customer care" numbers. The bank will never ask for your PIN, CVV or OTP to block a card or to refund money, and you never need to install a remote access or screen sharing app.

FAQ

How do I block my ATM card without going to the bank?

Use the bank's mobile app or net banking, call its 24x7 helpline or IVR, or use its SMS block facility. RBI requires these channels and requires the block to be immediate.

Will I get back money withdrawn before I blocked the card?

It depends on whose fault it was and how fast you reported. If the bank was at fault you get it all back. If it was a third party breach and you reported within three working days of the alert, your liability is zero. If you gave away your PIN or OTP, the loss before reporting is yours under the present rules.

What is the RBI 3 day rule?

For an unauthorised transaction caused by a third party breach, you have zero liability if you tell the bank within three working days of receiving the bank's communication about it. From 4 to 7 working days your liability is capped (Rs 10,000 for an ordinary savings account, Rs 5,000 for a BSBD account). For transactions from 1 January 2027 the window becomes five calendar days from the transaction.

How soon must the bank return the money?

Under the present rules the bank has to credit the amount within 10 working days of your report, and settle the complaint within 90 days at the most.

Do I have to file an FIR?

The RBI Directions opened for this guide do not make a police complaint a condition for blocking a card. Some banks ask for one in fraud claims under their own policy. Reporting on cybercrime.gov.in or 1930 is advised by RBI and, from 2027, is required for the new compensation.

Is there a charge for blocking a debit card?

RBI's rules set no blocking fee. The replacement card charge is in your bank's schedule of charges.

What if the bank does not respond?

After 30 days without a reply, or if you are unhappy with the reply, complain to the RBI Ombudsman on cms.rbi.org.in. It is free, and the Ombudsman can award compensation for consequential loss up to Rs 30 lakh and up to Rs 3 lakh for time, expenses and harassment.

Can the bank block my card on its own?

Yes, under its policy, but it must tell you immediately, with reasons, by SMS, email or other means.

Official links

Sources

Every fee, time limit, form and address above was read on these official pages on 12 October 2026.

RBI, Commercial Banks Credit Cards and Debit Cards Issuance and Conduct Directions, 2025 (page, updated as on 1 October 2026) Supports Landing page for the Directions PDF used below
RBI, Credit Cards and Debit Cards Issuance and Conduct Directions, 2025 (PDF) Supports Card issuer must block a lost card immediately on being informed, formalities can follow (paragraph 68); 24x7 channels for reporting loss, theft or unauthorised use and for the customer to initiate blocking (paragraph 69); immediate confirmation of blocking (paragraph 70); replacement card only with explicit consent (paragraph 71); bank must tell the cardholder with reasons if it blocks a card itself (paragraph 67)
RBI, Commercial Banks Responsible Business Conduct Directions, 2025 (PDF, updated as on 1 October 2026) Supports Rules in force on 12 Oct 2026 on limiting customer liability (paragraphs 64 to 76); SMS alerts and reply facility; reporting channels and acknowledgement with complaint number; zero liability and limited liability; Table 1 caps; three and seven working day windows and how days are counted; credit within 10 working days; 90 day outer limit; no loss of interest; burden of proof on the bank
RBI, Responsible Business Conduct Third Amendment Directions, 2026 (24 June 2026) Supports Rules for electronic banking transactions on or after 1 January 2027; definitions of negligence by bank and by customer; SMS alerts above Rs 500; five calendar day window; 45 and 60 calendar day decision timelines; compensation of 85 per cent up to Rs 25,000 once in a lifetime; cybercrime portal and helpline 1930
RBI press release, 24 June 2026, Review of Framework of Limiting Customer Liability in Digital Transactions Supports The amendment was issued on 24 June 2026 and comes into effect from 1 January 2027 for all categories of banks
RBI, FAQs on the Reserve Bank Integrated Ombudsman Scheme, 2026 (updated as on 1 July 2026) Supports Complain to the bank first; Ombudsman after 30 days or an unsatisfactory reply; 90 day window; CMS portal, email crpc@rbi.org.in and postal address; contact centre 14448; no fee; compensation powers
National Cyber Crime Reporting Portal Supports Official portal for reporting cyber and financial fraud
RBI, Commercial Banks Responsible Business Conduct Directions, 2025 (page, updated as on 1 October 2026) Supports Landing page showing the Directions as updated on 1 October 2026 and linking to the PDF
RBI, Complaint Management System portal Supports Portal for complaints under the Reserve Bank Integrated Ombudsman Scheme, 2026; contact centre 14448

In the search archive

None of the searches this guide answers is in the archive for India yet.

Open India in the explorer or read its top searches year by year.