See here:
Master Direction – Credit Card and Debit Card – Issuance and Conduct Directions, 2022
6. (a)
iv. ... In case, an unsolicited card is issued/existing card upgraded and activated without the explicit consent of the recipient and the latter is billed for the same, the card-issuer shall not only reverse the charges forthwith, but also pay a penalty without demur to the recipient amounting to twice the value of the charges reversed. In addition, the person in whose name the card is issued can also approach the RBI Ombudsman who would determine the amount of compensation payable by the card-issuer to the recipient of the unsolicited card as per the provisions of the Ombudsman Scheme, i.e., for loss of complainant’s time, expenses incurred, harassment and mental anguish suffered by him/her.
...
vi. Card-issuers shall seek One Time Password (OTP) based consent from the cardholder for activating a credit card, if the same has not been activated by the customer for more than 30 days from the date of issuance. If no consent is received for activating the card, card-issuers shall close the credit card account without any cost to the customer within seven working days from date of seeking confirmation from the customer. In case of a renewed or replaced card, the closure of an inactivated card shall be subject to payment of all dues by the cardholder.
...
vii. No card-issuer shall report any credit information relating to a new credit card account to Credit Information Companies prior to activation of the card. Any credit information relating to such inactivated credit cards already reported to Credit Information Companies shall be withdrawn immediately; under no circumstances it shall take more than 30 days from the effective date of these directions.
...
viii. The consent for the cards issued or the other products/services offered along with the card shall be explicit and shall not be implied. In other words, the written consent of the applicant shall be required before issuing a credit card. Alternatively, card-issuers may use other digital modes with multifactor authentication to obtain explicit customer consent. Such alternative digital modes, if any used by the card-issuer, shall be communicated to the Department of Regulation, Reserve Bank of India.