Travel Card Fraud Protection for Indians in 2026: Skimming, OTP Scams and What to Do
By Kabir Malhotra (Kabir Malhotra writes about how Indian travel buyers actually pay — UPI vs credit card vs forex card surcharges, reward-point math on the top travel credit cards, RBI tokenisation, EMI-on-flights and the small fees that compound across a year of bookings.) · Published · Last updated · 12 min read
Card fraud spikes for Indians abroad — skimmed ATMs, tampered terminals, and OTP-stealing scams. Here's how to harden your cards before you fly, the RBI zero-liability rules that protect you, and the exact reporting steps to keep your liability at zero.
Quick answer
To protect your cards abroad, set per-day and international transaction limits in your bank app, carry two cards on different networks, never let a card leave your sight, and always decline dynamic currency conversion. If fraud does happen, RBI's customer-liability rules (as of June 2026) give you zero liability if you report the unauthorised transaction to your bank within 3 working days, and limited liability if you report within 4–7 days. The bank must credit (shadow-reverse) the disputed amount within 10 working days. Speed of reporting is everything. Keep your bank's 24×7 international helpline saved offline before you fly.
Where Indian travellers actually get hit
The fraud you should worry about isn't exotic — it's mundane and preventable:
- ATM skimming: a card-reader overlay plus a pinhole camera copies your card and PIN. Standalone ATMs in tourist areas and petrol stations are the highest risk.
- Tampered POS terminals: a waiter takes your card out of sight, or a portable terminal is rigged. Restaurants and bars are common.
- OTP / phishing scams: a fake 'airline' or 'hotel' calls or messages about your booking and extracts your OTP or card details. This is the fastest-growing vector for Indians.
- Dynamic currency conversion (DCC): not fraud exactly, but a silent 5–12% overcharge when a terminal 'helpfully' bills you in rupees instead of local currency — always decline. See our DCC guide.
Harden your cards before you fly
Do this checklist the week before departure:
- Enable international usage in your bank/card app — many Indian cards are domestic-only by default and will simply decline abroad.
- Set tight limits: a sensible per-day limit and per-transaction cap on international spend, so a skimmed card can't drain your account.
- Turn on instant alerts for every transaction (SMS + app push). Real-time alerts are how you catch fraud within the 3-day zero-liability window.
- Carry two cards on different networks (e.g. one Visa, one Mastercard or RuPay) kept in different bags, so one compromised card doesn't strand you. See network acceptance abroad.
- Note your bank's international helpline (the +91 number that works from abroad) and save it offline.
Smart habits at ATMs and terminals
On the ground: prefer ATMs inside bank branches over standalone street machines. Tug the card slot and cover the keypad with your hand when entering the PIN — defeats most cameras. At restaurants, ask for a portable terminal brought to your table rather than letting the card disappear. Use tap-to-pay / contactless where possible — it never exposes your full card number to the terminal. And the single most valuable habit: at every foreign terminal, when asked 'pay in INR or local currency?', always choose local currency — our decline-DCC trick explains why this saves real money.
Never share your OTP — even with 'the airline'
OTP scams are surging because they bypass every technical protection. The pattern: you get a call or WhatsApp from someone claiming to be your airline, hotel or 'bank security' about a booking problem, and they ask you to 'confirm' an OTP or card details. No legitimate airline, hotel, OTA or bank will ever ask for your OTP, full card number, CVV or PIN. Hang up and call the company back on its official number. If you booked through an OTA, check the genuine support channel in your app. This scam is the leading cause of large losses for Indian travellers in 2026, precisely because the victim authorises the transaction.
Your RBI protections — and the 3-day rule
India has strong consumer protection here. Under RBI's limited-liability framework (current as of June 2026):
- Zero liability if the fraud is due to bank/third-party fault, or if you report it within 3 working days of receiving notification.
- Limited liability (capped by account type) if you report within 4–7 working days.
- Beyond 7 days, the bank's board-approved policy decides.
Crucially, the burden of proving customer negligence lies with the bank, and it must shadow-reverse the disputed amount within 10 working days of your report. This is why instant transaction alerts matter so much — they start your 3-day clock the moment fraud happens. Verify the current thresholds on rbi.org.in.
If your card is compromised abroad — step by step
Act fast and in this order:
- Block the card immediately from the bank app or by calling the international helpline — don't wait.
- Report the unauthorised transaction in writing (app/email) the same day to lock in zero liability.
- Switch to your backup card for ongoing spend — this is why you carried two.
- Get a written reference number for your fraud report.
- File a chargeback if needed — see our chargeback guide for the dispute mechanics.
- File a police report locally if cash or physical theft was involved; insurers and banks may ask for it.
Travel insurance with card-fraud / wallet cover can reimburse some out-of-pocket losses — check your policy. Compare options in our travel insurance guide.
Build a fraud-resilient travel money setup
The travellers who never get badly burned aren't lucky — they're set up well. A resilient kit, as of 2026, looks like this: two credit/debit cards on different networks in different bags; a zero-markup forex card for the bulk of spend, which limits exposure since only the loaded balance is at risk, not your whole bank account; tight per-day and international limits on every card; instant alerts on all of them; and a small cash float for when cards fail. Keep your bank helplines and card numbers saved offline, plus a photo of the cards' fronts (never the CVV) in secure cloud storage, so you can report and reorder fast. On the behavioural side: never share OTPs, always decline DCC, prefer in-branch ATMs and contactless payments, and treat any unsolicited 'booking problem' contact as a scam until proven otherwise. This setup turns most fraud incidents into a minor, fully-recoverable inconvenience rather than a trip-ending disaster, and it pairs naturally with the RBI protections that already favour the customer. Review it before every international trip, and refresh your saved helpline numbers, since banks change them. For the cash-versus-card balance, see our how-much-cash guide.
Frequently asked questions
What should I do if my card is used fraudulently abroad?
Block the card immediately via the app or international helpline, then report the unauthorised transaction to your bank in writing the same day. Under RBI rules, reporting within 3 working days gives you zero liability, and the bank must shadow-reverse the amount within 10 working days. Get a written reference number.
Does RBI's zero-liability rule protect me on international transactions?
Yes. RBI's limited-liability framework applies to unauthorised electronic transactions including those abroad. You get zero liability if you report within 3 working days, limited liability within 4–7 days. The burden of proving customer negligence is on the bank. Verify current thresholds on rbi.org.in.
How do I avoid ATM skimming when travelling?
Use ATMs inside bank branches rather than standalone street machines, cover the keypad when entering your PIN, and tug the card slot to check for overlays. Set tight per-day international limits and enable instant alerts so any skimmed-card misuse is caught within the 3-day zero-liability window.
Will the airline ever ask for my OTP or card details?
No. No legitimate airline, hotel, OTA or bank will ask for your OTP, full card number, CVV or PIN. Any call or message asking for these is a scam, even if it references a real booking. Hang up and call the company back on its official number. OTP scams are the top cause of large losses for Indian travellers.
Should I carry two cards when travelling abroad?
Yes — carry two cards on different networks (e.g. one Visa, one Mastercard or RuPay), kept in separate bags. If one is skimmed, lost or blocked, the other keeps you funded. Also enable international usage and set limits before you fly, since many Indian cards are domestic-only by default.