Question: A card add-on insurance cover was attached to my account without asking me. Is explicit consent needed?
Answer: Yes. Where a card issuer offers insurance cover in tie-up with an insurer, it must obtain explicit consent in writing or digital mode from the cardholder and collect nominee details.

Supporting evidence:
title: rbi.org.in/BS_ViewMasDirections.aspx
quote: In cases where the card-issuers are offering any insurance cover to their cardholders, in tie-up with insurance companies, the card-issuers shall obtain explicit consent in writing or in digital mode from the cardholders along with the details of nominee/s
context: come kit) and in important subsequent communications. The MITC shall be provided to the customer at the time of onboarding and each time, a condition is modified with notice to the customer. The MITC and copy of the agreement signed between the card-issuer and cardholder shall be sent to the registered email address of the cardholder or postal address as per the choice of the customer. iii. Card-issuers may consider introducing, at the option of the customers, an insurance cover to take care of the liabilities arising out of lost cards, card frauds, etc. In cases where the card-issuers are offering any insurance cover to their cardholders, in tie-up with insurance companies, the card-issuers shall obtain explicit consent in writing or in digital mode from the cardholders along with the details of nominee/s. iv. The issue of unsolicited cards/upgradation is strictly prohibited. In case, an unsolicited card is issued/existing card upgraded and activated without the explicit consent of the recipient and the latter is billed for the same, the card-issuer shall not only reverse the charges forthwith, but also pay a penalty without demur to the recipient amounting to twice the value of the charges reversed.

In addition, the person in whose name the card is issued can also approach the RBI Ombudsman who would determine the amount of compensation payable by the card-issuer to the recipient of the unsolicited card as per the provisions of the Ombudsman Scheme, i.e., for loss of complainant’s time, expenses incurred, harassment and mental anguish suffered by him/her. v. There have been instances where unsolicited/applied-for cards have been misused before reaching the persons in whose names these have been issued. It is emphasised that any loss arising out of misuse of such unsolicited cards shall be the responsibility of the card-issuer only and the person in whose name the card has been issued shall not be held responsible for the same. vi. Card-issuers shall seek One Time Password (OTP) based consent from the cardholder for activating a credit card, if the same has not been activated by the customer for more than 30 days from the date of issuance. If no consent is received for activating the card, card-issuers shall close the credit card account without any cost to the customer within seven working days from date of seeking confirmation from the customer. In case of a renewed or replaced card, the closure of an inactivated card shall be subject to payment of all