Common Misconceptions About Cyber Fraud & How to Protect Yourself

Most people lose money to cyber fraud because of three beliefs that are simply wrong: that the bank will refund them automatically, that the complaint can wait until office hours, and that online fraud cannot be traced anyway. In fact, whether you get your money back turns almost entirely on how fast you report, first to the national cybercrime helpline 1930 and then in writing to your bank. Report an unauthorised electronic transaction to the bank within three working days and the Reserve Bank's customer protection directions can put your liability at zero. Wait a week and the loss may be yours.

Part of the cyber crime and online fraud practice at S Jain & Attorneys, Bangalore.

This guide sets out the misconceptions that cost victims money, the provisions that actually apply now that the Bharatiya Nyaya Sanhita, 2023 has replaced the Indian Penal Code, the correct reporting sequence, and how far a bank's liability really goes.

The first hour decides how much you recover

A modern scam does not end when the money leaves your account. It moves. The amount is pushed through a chain of mule accounts and wallets, split into smaller sums, and cashed out. Every layer it passes through makes recovery harder, because the freeze has to be placed on an account that still holds the money. That is why the Indian Cyber Crime Coordination Centre (I4C) built the reporting system around speed. When you call 1930 or file on cybercrime.gov.in, a ticket is raised that reaches the banks and payment operators in the chain, and the balance lying in the destination account can be put on hold.

Practitioners and the helpline itself refer to the first hour as the golden hour. It is not a legal term and no rule guarantees a freeze. It simply reflects the reality that a hold placed in minutes catches money that a hold placed the next morning will not.

Deadline warning. Two clocks start the moment the money leaves. The first is the freeze clock, measured in minutes, which is why 1930 comes before everything else. The second is the liability clock under the Reserve Bank's directions, measured in working days, which is why a written complaint to the bank must follow the same day. Missing either one costs money independently of the other.

Why the very first report has to go to 1930 rather than anywhere else.

Eight misconceptions that cost victims money

Which law applies to which scam

Cyber fraud is not one offence. A single incident usually attracts a cheating provision from the Bharatiya Nyaya Sanhita, 2023 plus one or more computer specific offences from the Information Technology Act, 2000. Knowing which is which matters when the FIR is being drafted, because a badly framed FIR is one of the commonest reasons a matter stalls.

Common mistake. Reporting to the police station first and to the bank later. The police station will register your complaint, but the police cannot place the freeze. The freeze comes from the banking channel triggered by 1930 and cybercrime.gov.in, and the bank's own liability clock only starts when you notify the bank. Do those two first, then the station.

What to do in the first twenty four hours

1. End the call. Do not confirm anything, do not install any application the caller asks you to install, and do not pay a further amount to release the first one.
2. Call 1930 from any phone, or file at cybercrime.gov.in, and give the exact amount, time, transaction or UPI reference and the beneficiary details visible in your app. Note the acknowledgement number the system gives you.
3. Notify your bank in writing on the same day. Use the bank's app or net banking grievance option, or email the branch and the nodal grievance officer, and keep the acknowledgement. A phone call alone leaves you with no proof of the date you reported.
4. Ask the bank to block the card, freeze the account or disable UPI on the compromised handle, and to record the complaint as an unauthorised electronic transaction, not as a general query.
5. Change the passwords and the UPI PIN on every account that shares an email address or mobile number with the compromised one, and remove any screen sharing or remote access application installed during the call.
6. Preserve evidence before anything is deleted. Take full screenshots showing date, time and the whole screen, save the SMS and email alerts, note the caller number and UPI ID, and export the call log.
7. File an FIR at a police station or cyber police station. Under BNSS s. 173(1) it must be recorded whichever station you approach, and under s. 173(2) you are entitled to a free copy of the FIR at once.
8. If the FIR is refused, send the substance of the complaint in writing by post to the Superintendent of Police under BNSS s. 173(4), and if that fails, apply to the Magistrate under BNSS s. 175(3), the provision that replaces the old s. 156(3) CrPC.
9. Diarise the ninety day mark. That is the outer limit within which the bank must resolve your complaint and establish your liability under the Reserve Bank directions.

How much of the loss the bank must bear

This is the part most victims never find out. The Reserve Bank circular DBR.No.Leg.BC.78/09.07.005/2017-18 dated 6 July 2017 fixes when a customer bears nothing, when the customer bears a capped amount, and when the loss falls back on the customer.

The customer's liability is zero in two situations: where the fraud, negligence or deficiency was contributed to by the bank, whether or not you reported it, and where the failure lay somewhere else in the system, neither with the bank nor with you, and you notified the bank within three working days of receiving the bank's communication about the transaction.

Three further points in the same circular are worth knowing. Working days are counted by the schedule of your home branch, excluding the day you received the bank's communication. Once you notify the bank, it must shadow credit the disputed amount within ten working days of notification, value dated to the date of the unauthorised transaction, without waiting for any insurance settlement. And the burden of proving customer liability in an unauthorised electronic banking transaction lies on the bank, not on you.

The one situation where the circular does not help is customer negligence, for example where you shared the credentials or the OTP. There, you bear the loss until the moment you report, and everything after the report is the bank's. That is another reason the timestamp on your written complaint matters so much.

Key takeaway. Complain to the bank in writing, on the same day, in words that say the transaction was unauthorised. A dated written complaint is what converts the Reserve Bank framework from a policy document into your entitlement, and it is the single document that decides which row of the table above you fall into.

If the bank says no: the escalation ladder

1. Written complaint to the bank, with the transaction details, the 1930 acknowledgement number and the FIR copy if you have it. Insist on a complaint reference number.
2. Escalate internally to the bank's nodal or principal nodal officer for grievance redressal if there is no meaningful response.
3. Reserve Bank Ombudsman under the Reserve Bank Integrated Ombudsman Scheme, 2021, filed online through the Reserve Bank's complaint management system. Under clause 10(2) of the scheme a complaint lies only after you have made a written complaint to the bank and it was rejected wholly or partly, or you received no reply within 30 days, and it must be filed within one year of the bank's reply, or within one year and 30 days of your complaint if no reply came.
4. Consumer commission under the Consumer Protection Act, 2019, on the footing of deficiency in service. Since the 2021 jurisdiction rules, the District Commission hears claims where the consideration does not exceed Rs. 50 lakh, the State Commission from above Rs. 50 lakh to Rs. 2 crore, and the National Commission above Rs. 2 crore.
5. Adjudicating officer under section 46 of the IT Act for compensation, where the claim arises from a contravention of the Act. That officer has jurisdiction where the claim for damage does not exceed Rs. 5 crore, above which the competent court decides.
6. Writ petition to the High Court in the narrow cases where a public authority has acted arbitrarily or a regulator has refused to act at all.

These routes are alternatives, not steps you must climb in order in every case, and the Ombudsman will not take a matter already pending before a court or commission. Choose one deliberately.

Evidence: why screenshots alone are not enough

Electronic evidence is now governed by the Bharatiya Sakshya Adhiniyam, 2023. Section 61 says a record cannot be rejected merely because it is electronic, section 62 says the contents of electronic records are proved in accordance with section 63, and section 63 sets the conditions on which a computer output is admissible. Critically, section 63(4) requires a certificate, submitted along with the electronic record at each instance where it is tendered, identifying the record, describing how it was produced, giving the particulars of the device, and signed both by the person in charge of the device or the relevant activity and by an expert.

In practical terms this means that the WhatsApp screenshot on your phone is the start of the evidence, not the end of it. Keep the original device if you can. Do not factory reset it, do not delete the chat because it upsets you, and do not forward the only copy and then clear the app. Bank statements and card statements should be obtained in the bank's own certified form. Where the recording of a call or a screen exists, keep the original file rather than a re-encoded copy shared over a messaging app.

Recognising the current scam patterns

The scripts change every few months but the levers do not. A caller manufactures authority, then urgency, then isolation. The digital arrest script is the clearest example: a caller claims to be from a police unit, customs, the narcotics wing or a central agency, says a parcel or a SIM in your name has been found with contraband, moves you to a video call with an apparent uniform and a fake courtroom backdrop, and tells you not to speak to anyone while the matter is verified. No Indian agency arrests, interrogates or takes custody over a video call, and no agency asks you to transfer money to a verification account. There is no such thing as a digital arrest.

Other recurring patterns are the investment or trading group that shows fabricated profits and then blocks withdrawal until a tax is paid, the part time task or rating job that pays small amounts and then demands a deposit, the fake customer care number that surfaces at the top of a search, the KYC expiry message that carries a link or an application file, and the loan application that harvests contacts and photos and then blackmails the borrower. If a stranger's instruction is that you install an application, share your screen, or move to a private chat, treat that as the end of the conversation.

What actually prevents this

• Never share an OTP, CVV, PIN, UPI PIN or password with anyone, including a person who says they are from your bank. No genuine bank employee needs any of them.
• Remember the direction of a UPI transaction. You never enter your UPI PIN to receive money. If someone asks you to approve a request or enter your PIN to collect a refund, it is a debit.
• Turn on two factor authentication on your bank accounts, primary email and any account that can reset the others. The email account is the master key, so protect it first.
• Never install a screen sharing, remote access or unknown APK file at the instruction of a caller, and never grant SMS or accessibility permissions to an application you did not go looking for.
• Set transaction limits low by default and raise them for the one transaction you need. Keep a separate low balance account for online payments.
• Read the SMS alert rather than dismissing it, and reconcile your bank and card statements monthly. The Reserve Bank framework runs off the date of the bank's communication, which means an unread alert is a running clock.
• Check your credit report periodically for loans and cards you never applied for.
• Do not transact on public wifi, and do not use a search engine result to find a bank or company helpline. Use the number printed on the card or the official application.
• Talk to the older members of the family about the digital arrest script and the fake refund call before they receive one, not after.

What we tell clients

The pattern in these matters is depressingly consistent. Recovery is decided in the first few hours, and it is lost in ordinary, understandable ways: the victim spends forty minutes trying to reach the bank on a customer care line instead of dialling 1930, or reports on the phone and never puts it in writing, so weeks later there is nothing to prove when the bank was told. Cases also weaken because the complaint is vague. A cyber complaint that says money was fraudulently withdrawn is worth much less than one that lists each debit with its time, amount, reference number and beneficiary handle, because the money trail is what the investigating officer can actually act on. The other frequent failure is the second scam: a caller who says he is from a recovery cell or a cyber unit and can return the money for a processing fee. No agency does that. Finally, be realistic about outcomes. A freeze secured in the first hour often produces a real refund, sometimes after an application to the Magistrate for release of the frozen amount. Once the money has been layered and withdrawn, the criminal case may still run, but the recovery conversation shifts to the bank's liability under the Reserve Bank framework, and that is a paper case built on your written complaint and the dates on it. Also worth saying plainly: if the loss is small and you are simply exhausted, still report on 1930 and cybercrime.gov.in, because the beneficiary account you name is very often the same account draining someone else.

If you want the reporting mechanics in more detail, our companion guide on how to report cyber crime in India walks through the portal category by category.

Frequently Asked Questions

If you have lost money or data, reporting quickly matters far more than anything else. Legal help can follow once the immediate report is in.

This article is for general informational purposes only and does not constitute legal advice. Please consult a qualified advocate about your specific matter.

Related guides and where to get help

If this is a live problem rather than background reading, our cyber crime practice handles these matters from Bengaluru, including for clients who cannot attend court in person. These guides go deeper on the neighbouring questions:

• IP Protection for Startups in India: A Founder's Guide
• How to Report Cyber Crime in India: A Step-by-Step Guide
• Maintenance and Alimony in India: Common Misconceptions Both Husbands and Wives Get Wrong