The RBI has made it compulsory for transactions which does not involve the card being directly used a use of PIN, or OTP or such layer of protection be used by banks (or other approved card provider).
In cases of fraud transactions where your card is not physically used the RBI states that it is the responsibility of a card issuer if a transaction has happened without the use of an OTP or PIN and if the customer has logged a complaint the card issuing bank has to pay back the stolen amount to the customer without raising objections or show reluctance.