Lost or Blocked Cards: RBI Immediate Blocking, Confirmation and Replacement-Consent Controls

Blocking the card and deciding disputed liability are different actions

RBI’s card directions require immediate blocking of a lost card when the cardholder informs the issuer, with remaining formalities following within the policy-defined reasonable period. They also require immediate confirmation after blocking and explicit consent for a replacement where the card was blocked at the cardholder’s request. This control guide, checked on 27 October 2026, uses the issuer-specific 2025 Directions. For Commercial Banks and Small Finance Banks, the versions updated on 1 October 2026 contain these controls in paragraphs 67–71; the Urban Co-operative Banks Directions contain them in paragraphs 67–71, and the NBFC credit-card Directions in paragraphs 61–65. Commercial Banks: paragraphs 67–71; Small Finance Banks: paragraphs 67–71; Urban Co-operative Banks: paragraphs 67–71; NBFC credit cards: paragraphs 61–65.

Identify the issuer and product before applying the provisions. “Commercial Banks” in the cited Directions excludes Small Finance Banks, Payments Banks and Local Area Banks; Small Finance Banks and Urban Co-operative Banks have separate cited Directions. The cited NBFC Directions cover their specified NBFC classes and credit-card business requires RBI’s prior permission; they do not authorise NBFC debit-card issuance. For another issuer class, including a State or District Central Co-operative Bank, check its applicable current framework separately. This guide does not decide reimbursement or customer liability under separate unauthorised-transaction rules and does not substitute card directions for prepaid-instrument rules. The earlier 2022 Master Direction, updated 7 March 2024, is retained as a historical reference; its combined applicability wording and paragraph 23 numbering are not the current references used here.

Make the reporting channels usable at all hours

The issuer must give a detailed process for reporting loss, theft or unauthorised card/PIN use and provide multiple reporting channels on a 24×7 basis that enable the customer to initiate blocking. Preserve the channel used, report time, reference and content. An organisation should make emergency reporting access available to authorised card users without circulating PINs or passwords in its incident file. A police complaint or later internal approval should not be treated as a universal prerequisite to immediate lost-card blocking. RBI Commercial Banks Directions: paragraphs 67–71 (see issuer-specific references below).

Separate the report time from the completed block

Record when the report reached the issuer, when blocking took effect and when confirmation was sent. The direction says immediately; it does not create a general safe harbour of a specified number of seconds. A measured interval helps identify and investigate delay but does not itself decide compensation. Preserve the original message and issuer response rather than replacing them with a retrospective spreadsheet time.

Issuer-initiated suspension has its own notice trail

Where the issuer itself blocks, deactivates or suspends a card or withdraws benefits at its discretion, paragraph 67 of the cited Commercial Bank, Small Finance Bank and Urban Co-operative Bank Directions, or paragraph 61 of the NBFC Directions, requires the applicable standard operating procedure and immediate communication with reasons through electronic and other available modes. For Commercial Banks and Small Finance Banks, the procedure is laid down in the approved policy; paragraph 8 permits policy approval by the Board or a committee with powers delegated by the Board. The cited Urban Co-operative Bank and NBFC provisions retain Board approval. Distinguish that event from a cardholder-reported loss. A merchant decline alone does not establish which event occurred or whether a replacement was requested. Ask for the issuer’s actual status and reason.

Do not turn a block request into a presumed replacement order

A replacement after a cardholder-requested block requires explicit consent. Retain the request, consent scope and issuer confirmation. Renewal has its own ability to decline before dispatch, and card blocking does not necessarily close the card account or cancel outstanding lawful dues. Review associated tokens, supplementary cards and channels with the issuer rather than assuming that every related instrument has the same status. This article does not invent a mandatory replacement fee or a blanket waiver.

Reconcile transactions without prejudging their legal treatment

Keep authorised, disputed, reversed and pending transactions separately identified. Document timestamps and the basis of the dispute; do not decide liability solely because a debit is before or after a blocking reference. Different customer-protection directions, product terms and facts may matter. Reconcile duplicate complaint references to a single underlying transaction so the incident tracker does not double-count a loss or reimbursement. Keep full sensitive card credentials out of ordinary shared workpapers. RBI Commercial Banks Directions: paragraphs 67–71 (see issuer-specific references below).

Applicable primary references

RBI Commercial Banks Directions: paragraphs 67–71 (see issuer-specific references below)

Six worked illustrations

All facts and amounts below are fictional. Assumptions describe the model, not additional statutory rules.

Illustrative example 1: Report-to-block interval

A loss report is recorded at 14:03:10 and blocking at 14:03:40. The measured interval is 30 seconds. That number is an operational fact, not an RBI-prescribed grace period or a conclusion on liability.

Illustrative example 2: Confirmation interval

Blocking occurs at 09:15:00 and confirmation arrives at 09:18:00: an interval of 180 seconds. Preserve both records and investigate the confirmation process against the immediate-confirmation requirement.

Illustrative example 3: Separate authorised and disputed amounts

A statement shows ₹12,000 of accepted purchases and ₹8,000 disputed. The total ₹20,000 must be reconciled as two categories; reporting ₹20,000 as fraud overstates the identified disputed amount by ₹12,000.

Illustrative example 4: Duplicate complaint references

Two complaint references both concern the same ₹5,000 transaction. The underlying disputed population remains ₹5,000, not ₹10,000. Preserve the linkage between references rather than deleting one history.

Illustrative example 5: Reversal reconciliation

Disputed entries total ₹9,000 and an identified reversal covers ₹4,000. The unreversed tracked amount is ₹5,000. This arithmetic does not determine whether the issuer owes that amount or whether other adjustments apply.

Illustrative example 6: Corporate incident population

A company has 12 issued cards; 3 were reported lost and blocked, and replacement consent exists for 2 of those 3. The evidence exception is 1 replacement-consent file if replacement is proposed for all 3, not an assumption that all 12 cards require replacement.

Ten-step verification table

Step	Action	Evidence
1	Identify the card and authorised reporter	Masked reference and authority.
2	Report through an official channel	Loss details and timestamp.
3	Retain the report acknowledgement	Reference and original communication.
4	Confirm effective blocking	Issuer status and event time.
5	Retain blocking confirmation	Message and delivery evidence.
6	Check reasons for issuer suspension	Applicable status and stated reasons.
7	Separate replacement consent	Explicit request and approved scope.
8	Review linked instruments	Issuer confirmation of token/add-on/channel status.
9	Reconcile disputed transactions	Unique transaction IDs and reversals.
10	Track unresolved issues	Separate blocking, liability and complaint outcomes.

Sixteen practitioner FAQs

1. Must a lost card be blocked immediately after reporting?

Yes: paragraph 68 of the cited Commercial Bank, Small Finance Bank and Urban Co-operative Bank Directions, and paragraph 62 of the NBFC Directions, require immediate lost-card blocking on being informed by the cardholder.

2. Can remaining formalities follow?

They may follow within the reasonable period clearly defined in the applicable approved policy. For Commercial Banks and Small Finance Banks, paragraph 8 permits Board approval or approval by a committee with delegated Board powers; the cited Urban Co-operative Bank and NBFC Directions retain Board approval.

3. Is a police complaint a universal prior blocking condition here?

The stated immediate-blocking rule does not impose that condition.

4. Must reporting be available outside business hours?

The directions require 24×7 reporting channels.

5. Is one complaint timestamp enough?

Retain report, block and confirmation events separately.

6. Is thirty seconds a statutory safe harbour?

No. It is only an illustrative measured interval.

7. Must confirmation follow blocking?

The issuer must immediately send confirmation after blocking.

8. Are issuer-initiated suspensions identical to lost-card requests?

No. Identify the event and its applicable notice requirements.

9. Should issuer suspension reasons be communicated?

Yes. See paragraph 67 of the cited Commercial Bank, Small Finance Bank and Urban Co-operative Bank Directions, or paragraph 61 of the NBFC Directions, under the applicable issuer and product scope.

10. Does blocking itself order a replacement?

No. Explicit consent is required for replacement after a cardholder-requested block.

11. Does blocking automatically close the account?

Do not assume so; confirm account status separately.

12. Does every post-report debit prove issuer liability?

No. Examine the applicable customer-protection framework and facts.

13. Can two complaint IDs double the disputed amount?

Not when they refer to the same transaction.

14. Does this guide prescribe a replacement fee?

No. It does not invent product charges or waivers.

15. Should the incident file contain PINs?

Do not circulate sensitive authentication credentials in shared workpapers.

16. What should the closing note distinguish?

Blocking completion, replacement consent, disputed-transaction outcome and any remaining complaint.

Conclusion

Separate loss reporting, card blocking, confirmation and replacement consent under RBI directions; preserve event times without assuming automatic fraud liability.