With online financial fraud, speed matters more than anything a lawyer can do later. Money moves through mule accounts within hours.
The first hour
- Call 1930, the national cyber crime helpline. This is what triggers the request to freeze funds in the receiving account.
- File on cybercrime.gov.in and keep the acknowledgement number.
- Inform your bank in writing, not only by phone. Email the branch and the grievance officer, describing the transaction and asking for the beneficiary account to be flagged.
- Freeze what can be frozen. Block the card, change passwords, disable UPI.
The freeze request works only while the money is still sitting in the beneficiary account. Once it has been layered onward through several accounts and withdrawn, recovery becomes an investigation rather than a reversal.
What to preserve
- Screenshots of the entire chat, call log and any web page, with visible timestamps
- Transaction IDs, UTR numbers, the beneficiary account or UPI handle
- The phone numbers and email addresses used by the fraudster
- The original device, unwiped. Under the Bharatiya Sakshya Adhiniyam, 2023, electronic evidence needs a proper certificate, and that is far easier when the source device still exists
What happens after you report
The helpline call and the portal complaint feed the same system, so do both. The complaint generates an acknowledgement number and a ticket that reaches the bank or wallet holding the beneficiary account, asking it to hold the credited amount. Guard that number: it is dated proof of when you first complained, and every later step is built on that date. Our note on how to report a cyber crime in India sets out the portal fields and what to upload.
Follow it with a written complaint at the police station. In Bengaluru, cyber offences go to the CEN police stations, the Cyber, Economic Offences and Narcotics stations attached to the city's police divisions. If a station says the offence happened elsewhere, ask for a zero FIR: information disclosing a cognizable offence can be recorded irrespective of where it was committed, and the papers are transferred on. If registration is refused, escalate to the Deputy Commissioner of Police and then apply to the Magistrate under Section 175(3) of the Bharatiya Nagarik Suraksha Sanhita, 2023 for a direction to register and investigate.
Your bank's liability
The RBI framework on limiting customer liability in unauthorised electronic transactions matters here. Where the fraud is due to a third-party breach and the customer notifies promptly, liability can be zero or limited depending on the days elapsed. This is precisely why the written notification on the same day is so important. If the bank does not resolve it, the RBI Ombudsman is the next step.
The graded structure is worth stating precisely, because banks state it selectively. Liability is zero where the loss flows from a contributory fraud, negligence or deficiency on the bank's part, and in a genuine third party breach where neither side was at fault, provided you notify within three working days. Notification on the fourth to seventh working day puts you in a limited liability band capped in rupee terms by account type. Beyond that the bank's board approved policy governs. Even where your credentials were shared, you bear the loss only up to the point of reporting. Take the caps and day counts from the directions in force, not from the bank's letter. Our guide on recovering money lost to UPI and bank fraud under the RBI rules works through each limb.
The directions say in terms that the burden of proving customer liability in an unauthorised electronic banking transaction lies on the bank. You do not have to prove you were not careless. Put that in the first written complaint, ask the bank to state what material it relies on, and ask by name for the transaction log with timestamps, the device and IP details recorded against each debit, and the alert dispatch log.
If the bank does not resolve it
- Escalate in writing to the bank's nodal or principal nodal officer, insisting on a reasoned written reply rather than a call.
- After thirty days without a satisfactory response, complain to the RBI Ombudsman under the Reserve Bank Integrated Ombudsman Scheme, 2021. It is free and needs no lawyer.
- In parallel, a consumer complaint for deficiency in service, which can carry compensation and costs alongside the refund.
On the "digital arrest" scams
No police officer, no court, no enforcement agency in India conducts an arrest over a video call, demands that you stay on camera, or asks you to transfer money to a "verification account". There is no such procedure. If a call is running along those lines, it is a fraud, and disconnecting is the correct response.
The script is recognisable before it works. A parcel in your name is said to contain contraband, or your Aadhaar to have surfaced in a money laundering case. The call moves to video, a uniform and an official looking notice appear, and you are told to stay on camera, speak to nobody, and move your funds to a "verification" account. Nothing in the criminal procedure statute resembles any of it: an arrest is made in person by an officer who must identify himself, and no agency takes custody of money for verification. Disconnect, call 1930, and warn whoever in the family is likely to be next. Our note on online impersonation and digital arrest frauds sets out the pattern and what to do once money has gone. If you have already paid, do not delete the chat or the app you were made to install, and do not reset the phone; that material is the case.