Most of us carry both cards and use them almost without thinking: the debit card for the ATM and the grocery store, the credit card for a flight booking or an online sale. Yet the debit card vs credit card question is not only about convenience. One spends your own money, the other spends the bank’s money until you pay it back, and RBI applies different rules to how each is issued, closed, protected and billed.
This guide sets out those rules in plain language: how cards may be issued and closed, what tokenisation does, how to switch international and online use on or off, the contactless limit, what to do if a card is lost or misused, and how credit card billing and the interest-free period work. It is general information, not a recommendation of any card or bank.
Debit card vs credit card: the basic difference
RBI defines a debit card as a payment instrument linked to a savings or current account, used to withdraw cash, pay online, pay at shops or QR codes, and transfer funds. A credit card lets you buy goods and services or draw cash up to a credit limit set by the issuer, which you repay later. Credit cards can be issued by scheduled banks and by NBFCs that RBI has permitted.
| Feature | Debit card | Credit card |
|---|---|---|
| Whose money | Your own balance | The issuer’s credit, repaid by you |
| Who can issue | Banks, to savings or current account holders | Scheduled banks and RBI-approved NBFCs |
| Interest | None on spends | None if the full bill is paid by the due date; otherwise interest applies |
| Credit report | Not reported as a loan | Reported to credit information companies after activation |
| Fraud liability cap (3rd-party breach, reported in 4 to 7 working days) | ₹10,000 on a regular savings account; ₹5,000 on a basic savings account | ₹10,000 if limit up to ₹5 lakh; ₹25,000 above ₹5 lakh |
| Closure | Linked to the bank account | Within seven working days of request, once dues are paid |
The practical difference shows up when something goes wrong. If a debit card is misused, money leaves your account at once and you wait for the bank to reverse it. With a credit card, the disputed amount sits on a bill you have not yet paid.
RBI rules on how cards are issued
RBI’s card directions, in force since 1 July 2022, set clear limits on how banks and NBFCs can hand out cards.
Debit cards
Debit cards may be issued only to customers with a savings or current account. A bank cannot force you to take a debit card, and it cannot make a debit card a condition for any other facility.
Credit cards
- Unsolicited cards and upgrades are strictly prohibited. If a card is issued or upgraded and activated without your explicit consent and you are billed, the issuer must reverse the charges at once and pay you a penalty of twice the value of those charges.
- Your consent must be explicit, given in writing or through a digital mode with multi-factor authentication.
- If you have not activated a new card within 30 days of issue, the issuer must seek your consent by one-time password. If you do not give it, the card account must be closed at no cost to you within seven working days.
- No credit information about a new card may be reported to credit bureaus before it is activated.
- The credit limit cannot be raised beyond what was sanctioned without your explicit consent.
Closing a credit card or debit card
A request to close a credit card must be honoured within seven working days, provided you have paid all dues. Issuers must accept the request through several channels, such as a helpline, a dedicated email, internet banking or the mobile app, and cannot insist on a letter by post. If the issuer misses the seven-day deadline, it must pay you ₹500 for every calendar day of delay until the card is closed, as long as nothing is outstanding.
If a credit card has not been used for more than a year, the issuer may start closing it after informing you. If you do not reply within 30 days, the card can be closed once dues are cleared, and the credit bureau record must be updated within 30 days. Any credit balance left on a closed card must be sent to your bank account.
A debit card is tied to your account, so you can ask the bank to block and cancel the card while keeping the account, or it ends when you close the account.
Tokenisation: why sites no longer store your card number
Earlier, many shopping sites and apps saved your card number and expiry date for future use. If any of them was hacked, your card details leaked. RBI ruled that from 1 October 2022, no entity in the card payment chain other than card issuers and card networks may store card data, and earlier stored data had to be purged.
In its place came card-on-file tokenisation. The first time you pay at a merchant, you enter the card details and agree to create a token, confirmed with an OTP or other additional factor. The token is a unique code specific to that card and that merchant, so it cannot be used anywhere else. Next time you only pick the card by its last four digits. Tokenising is voluntary. If you prefer, you can keep typing the card details each time, which is called guest checkout.
Domestic, international and online use: switch on or off
Under RBI’s January 2020 directions, effective 16 March 2020, every new or reissued card, physical or virtual, is enabled only for use at ATMs and point-of-sale machines within India. Online, international and contactless use are off until you turn them on. For existing cards that had never been used online, abroad or in contactless mode, those features had to be disabled.
Issuers must also give you a round-the-clock facility, through the mobile app, internet banking, ATM or phone banking, to switch each type of use on or off and set your own limits within the card’s overall limit. That applies to domestic and international use, ATMs, shops, online payments and contactless payments, and you get alerts when settings change.
A sensible habit: keep international use off and switch it on only for the days you travel abroad or need to pay a foreign website. Set a modest online limit on the debit card, since it draws on your savings directly.
Contactless payments and the ₹5,000 limit
A contactless card has a small antenna, and you pay by tapping it on the machine. RBI allows card-present contactless transactions of up to ₹5,000 per transaction without a PIN or other additional factor of authentication, provided EMV standards are followed. This limit was raised from ₹2,000 in December 2020. For anything above ₹5,000 you will be asked for the PIN.
Contactless use stays your choice. You can switch it off entirely or lower the limit through the controls above. If you rarely tap to pay, turning it off removes one more way a lost card could be misused.
Lost card or fraud: what to do and what you can lose
- Block the card at once through the app, internet banking, SMS or the issuer’s helpline. Issuers must block a lost card immediately when told and offer several reporting channels.
- Report any unauthorised transaction to the bank straight away, and keep the complaint reference.
- File a cyber fraud complaint if money has been taken, and keep copies of everything.
- Follow up for the temporary credit and the final decision.
Speed decides how much you can lose. Under RBI’s limited liability rules, if the fraud was due to the bank’s fault, you have zero liability. If the breach was elsewhere in the system and you report within three working days of getting the bank’s alert, your liability is zero. Report in four to seven working days and it is capped at the transaction value or the limits in the table above, whichever is lower. Beyond seven working days, the bank’s board-approved policy applies. If you shared your PIN or OTP, you bear the loss until you report it.
Once you report, the bank must credit the disputed amount to your account within 10 working days as a shadow reversal, and settle the complaint within 90 days. Also note that no charges may be levied on a credit card transaction disputed as fraud until the dispute is resolved.
Credit card billing and the interest-free period
A credit card works on a billing cycle, the period between two statement dates. The interest-free credit period runs from the date of a purchase to the payment due date, but only if you pay the entire outstanding by the due date. Card issuers set their own cycles, and RBI requires them to let you change your billing cycle at least once to suit you.
Pay less than the full amount and the interest-free benefit goes. Interest is then charged from the date of each transaction on the outstanding amount, adjusted for payments and refunds, not on the original total. Late payment charges can be levied only if the account is past due for more than three days, and only on the amount outstanding after the due date.
As an illustration, say your bill is ₹30,000 and you pay only ₹10,000. Assume interest of 3% a month for illustration. The remaining ₹20,000, plus new purchases, now attract interest from their transaction dates, which can add roughly ₹600 a month on that balance alone. The minimum amount due only keeps you from being overdue; RBI requires it to be set so that the debt does not keep growing, but paying just the minimum stretches repayment over months or years. If you need to repay a large balance in instalments, compare the cost using an EMI calculator before converting it.
Key takeaways
- In the debit card vs credit card choice, a debit card spends your own money while a credit card gives you an interest-free period only if you pay the full bill by the due date.
- Unsolicited credit cards are banned; closure must happen within seven working days or the issuer pays ₹500 a day.
- Tokenisation keeps your card number off merchant servers.
- New cards work only at Indian ATMs and shops until you enable online, international or contactless use, and you can switch each on or off at any time.
- Contactless payments up to ₹5,000 need no PIN; turn the feature off if you do not use it.
- Report a lost card or fraud within three working days to protect your zero-liability right.
