How to Recover Money From Online Fraud in India

If you are wondering how to recover money from online fraud, the single most important thing to know is that speed decides the outcome. The moment you realise money has left your account, call the national cyber-crime helpline 1930 and file a complaint at the National Cyber Crime Reporting Portal. If you act within the first hour, often called the golden hour, your bank and the receiving bank can place a hold on the funds before the fraudster withdraws them.

Part of the cyber crime and online fraud practice at S Jain & Attorneys, Bangalore.

This is not a theoretical remedy. Answering in Parliament on 11 February 2026, the Ministry of Home Affairs said that the Citizen Financial Cyber Fraud Reporting and Management System run by the Indian Cyber Crime Coordination Centre had saved more than Rs 8,189 crore across more than 23.61 lakh complaints up to 31 December 2025. In the same answer the Ministry recorded 24,02,579 financial-fraud complaints on the portal in 2025 alone, involving around Rs 22,495 crore. Money does come back. It comes back to the people who reported fast and reported in writing.

This guide explains the practical steps, the legal framework under the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023 and Bharatiya Nagarik Suraksha Sanhita, 2023, and the Reserve Bank of India customer-protection rules, and what realistically happens to your money after you report. It is general information, not legal advice.

What "online financial fraud" covers

Online financial fraud is any deception carried out using a computer, phone or the internet that causes you to lose money. Common forms include:

• UPI and wallet frauds (fake collect requests, QR-code scams, "wrong transfer" refund tricks)
• Phishing and vishing (fake bank calls, KYC-update links, OTP theft)
• Fraudulent investment, trading, "task" and loan-app schemes
• Card-not-present (CNP) fraud and SIM-swap attacks
• Fake customer-care numbers and remote-access app scams
• "Digital arrest" calls, where a caller posing as police, CBI or a courier company frightens the victim into transferring money

The recovery mechanism is broadly the same across all of them: stop the money, report it, and let the banking and law-enforcement systems trace and freeze it.

The statutory framework: which law does what

Four separate bodies of law operate at once in an online fraud, and they do different jobs. Understanding which one gives you money and which one gives you a prosecution saves a lot of wasted effort.

The Information Technology Act, 2000: penalty, compensation and the cyber offences

The IT Act is the only one of the four that lets a civil-style authority order the wrongdoer to compensate you. The provisions that matter:

• Section 43 makes a person liable to pay damages by way of compensation for unauthorised access to, downloading from, or damage caused to a computer, computer system or computer network.
• Section 43A makes a body corporate that handles sensitive personal data and is negligent in maintaining reasonable security practices liable to pay compensation to the person affected.
• Section 66 punishes doing any act referred to in Section 43 dishonestly or fraudulently, with imprisonment up to three years or a fine up to five lakh rupees or both.
• Section 66B punishes dishonestly receiving a stolen computer resource or communication device: up to three years or a fine up to one lakh rupees.
• Section 66C punishes identity theft, that is, fraudulent or dishonest use of another person's electronic signature, password or unique identification feature: up to three years and a fine up to one lakh rupees.
• Section 66D punishes cheating by personation using a communication device or computer resource: up to three years and a fine up to one lakh rupees. Almost every impersonation scam, from the fake bank officer to the fake police caller, is charged here.
• Section 46 gives the adjudicating officer the power to decide claims. Section 46(1A) limits that officer to claims for damage not exceeding rupees five crore; above that, jurisdiction vests in the competent court.
• Section 61 bars a civil court from entertaining a suit in any matter the adjudicating officer or the Appellate Tribunal is empowered to decide, so you cannot simply file a civil suit for the same relief.
• Section 57 provides an appeal to the Appellate Tribunal, and Section 62 a further appeal to the High Court within sixty days, extendable by a further sixty days for sufficient cause.
• Section 77B makes offences punishable with three years and above cognizable, and those punishable with three years bailable. Section 78 requires that offences under the Act be investigated by a police officer not below the rank of Inspector.

The Bharatiya Nyaya Sanhita, 2023: the cheating offences

The general penal law on cheating moved from the Indian Penal Code to the BNS with effect from 1 July 2024. The mapping you need:

• Section 318 BNS (formerly Sections 415 to 420 IPC) defines and punishes cheating. Section 318(2) covers plain cheating, up to three years. Section 318(4), the successor to the old Section 420 IPC, covers cheating that dishonestly induces the victim to deliver property, and carries imprisonment up to seven years and fine. This is the charge in most transfer-based frauds.
• Section 319 BNS (formerly Section 419 IPC) covers cheating by personation, punishable up to five years.
• Section 111 BNS is genuinely new and matters for scam-centre and mule-account cases. Its definition of organised crime expressly names cyber-crimes as one of the continuing unlawful activities that can constitute organised crime when carried on by an organised crime syndicate. Where a fraud is run by a network rather than an individual, ask the investigating officer to consider it.

The Bharatiya Nagarik Suraksha Sanhita, 2023: reporting and getting the money back

• Section 173 BNSS (formerly Section 154 CrPC) governs the FIR. Two features help fraud victims. Information may be given irrespective of the area where the offence is committed, which is the Zero FIR principle written into the statute, so a Bengaluru resident defrauded by an account in another state need not travel. And information may be given by electronic communication, taken on record once signed within three days.
• Section 107 BNSS has no equivalent in the old CrPC and is the most under-used recovery tool in the new code. Where the investigating officer has reason to believe property is derived from criminal activity, he may, with the approval of the Superintendent or Commissioner of Police, apply to the court for attachment. If the court finds the property to be proceeds of crime, it directs the District Magistrate to rateably distribute those proceeds to the persons affected by the crime, and Section 107(7) requires the distribution within sixty days.
• Section 395 BNSS (formerly Section 357 CrPC) lets the trial court apply a fine to compensating a victim of cheating, and Section 396 BNSS (formerly Section 357A CrPC) is the victim compensation scheme. Section 396(4) allows an application to the State or District Legal Services Authority even where the offender is never traced and no trial takes place.

Key takeaway. The criminal case and the money are two different tracks. An FIR under Section 318(4) BNS punishes the fraudster; it does not, by itself, refund you. Your refund comes from the RBI customer-liability rules, an attachment order under Section 107 BNSS, or a compensation order under Section 46 of the IT Act. Run all the tracks you are entitled to, and do not assume the FIR is doing the work.

The RBI framework: the rule that actually decides your refund

For an ordinary bank customer, the decisive instrument is not a statute at all. It is RBI circular DBR.No.Leg.BC.78/09.07.005/2017-18 dated 6 July 2017, "Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions". It applies to all scheduled commercial banks including regional rural banks, small finance banks and payments banks, and it fixes how much of the loss you bear according to how quickly you reported. The detail is set out below.

The four bodies of law that operate at once in an online fraud, and the job each one does.

How to recover money from online fraud: the step-by-step process

The recovery system in India works as a chain that runs from you, to your bank, to the cyber-crime system, to the receiving bank. The faster each link reacts, the more likely the money is frozen before it is cashed out.

1. Report within the golden hour. The golden hour is the short window, practically the first sixty minutes to a few hours, between the debit and the point where the fraudster moves the money out of the receiving account. Do two things immediately and in parallel: call 1930, the national cyber-crime helpline, and register the transaction details, or file online at cybercrime.gov.in; and inform your bank through its fraud-reporting channel and ask it to flag the transaction. The portal generates an acknowledgement number. Keep it, because your bank, the police and any court will ask for it.
2. Alert your bank in writing and freeze the channel. Report the unauthorised transaction in writing (email or the in-app complaint, not just a phone call) so you have a dated record. Ask the bank to block the card, UPI ID or net-banking access used, and to raise the dispute with the receiving or beneficiary bank so a hold can be placed. Under the 2017 circular banks must give 24x7 reporting access through multiple channels and must send an immediate acknowledgement carrying a registered complaint number.
3. Let the lien or hold do its work. Once the complaint is logged, the system tries to place a lien, that is, a legal hold, on the disputed amount in the beneficiary account so it cannot be withdrawn. A lien is not the same as getting your money back. It is a freeze. The refund follows either the bank's own dispute resolution, a direction from the cyber cell, or an order from a court or the adjudicating officer. The lien simply ensures there is still money left to return.
4. Insist on the shadow reversal. Paragraph 9 of the 2017 circular requires the bank, on being notified, to credit the amount involved to your account within ten working days of your notification, without waiting for any insurance settlement, value dated as of the date of the unauthorised transaction. Very few customers know this and very few banks volunteer it. Quote the paragraph.
5. File the formal cyber-crime complaint or FIR. Filing on the portal or calling 1930 is your first report. For a full investigation you may also need a written complaint or FIR at the local cyber police station under Section 173 BNSS, invoking Sections 66C and 66D of the IT Act and Section 318(4) BNS. Remember Section 78 of the IT Act: the investigation must be conducted by an officer not below the rank of Inspector.
6. Ask the investigating officer about Section 107 BNSS. Where the money has been traced to an identifiable account or asset, an attachment application under Section 107 BNSS with the approval of the Superintendent or Commissioner of Police is the route to actual restitution, because Section 107(6) lets the court direct rateable distribution of the proceeds of crime to the victims.
7. Track, follow up and escalate. Track your portal complaint and respond to any request for documents. Paragraph 10 of the 2017 circular requires the bank to resolve the complaint and establish your liability within the period in its board-approved policy and in any case not exceeding ninety days from receipt of the complaint, failing which it must pay the compensation anyway. If it does not, escalate to the bank's grievance cell and then to the RBI Ombudsman.

A simple action checklist (first 24 hours)

How much can you actually recover? The RBI customer-liability rules

Under the 6 July 2017 circular, your liability depends on how fast you report and whose fault caused the loss. The circular treats the clock as running from the date you receive the bank's communication about the transaction, and working days are counted by your home branch's schedule, excluding the date of that communication.

You have zero liability in two situations. First, where there is contributory fraud, negligence or deficiency on the part of the bank, and this applies irrespective of whether you reported the transaction at all. Second, in a third-party breach where the deficiency lies neither with the bank nor with you but elsewhere in the system, provided you notify the bank within three working days.

Where the four-to-seven-day band applies, the caps are set by account type:

Separately, where the loss is due to your own negligence, such as sharing the OTP, PIN or password, you bear the entire loss until you report it, and the bank bears any loss occurring after you report. That is precisely why the reporting time stamp matters even when you know you were careless: it draws a line and stops the bleeding.

Key takeaway. Paragraph 12 of the 2017 circular places the burden of proving customer liability on the bank, not on you. If the bank tells you it will not refund because you "must have shared the OTP", ask it to say so in writing and to produce the evidence. In practice that single request settles a surprising number of disputes, because most banks cannot prove it and know that the Ombudsman will ask the same question.

Escalation ladder if the bank says no

There is a defined order, and skipping steps costs you time rather than saving it.

1. The bank's own grievance machinery. Written complaint, then the nodal officer, then the bank's internal ombudsman. Keep every acknowledgement.
2. The RBI Ombudsman. The Reserve Bank Integrated Ombudsman Scheme, 2026 came into force on 1 July 2026 and replaced the 2021 scheme; complaints received before that date continue under the old scheme. It is free. File online at cms.rbi.org.in, by email to the Centralised Receipt and Processing Centre, or by post to that centre at Central Vista, Sector 17, Chandigarh 160017. You must first approach the bank, and you may go to the Ombudsman only after thirty days without a reply (or the longer period specified by RBI, NPCI or a card network, if applicable), or earlier if you have a reply and are dissatisfied. You must then file within ninety days of that timeline expiring or of the last communication from the bank, whichever is later. There is no ceiling on the amount in dispute, and the Ombudsman may award compensation up to Rs 30 lakh for consequential loss plus up to Rs 3 lakh for lost time, expenses and mental anguish. The scheme covers banks, most NBFCs, non-bank prepaid payment instrument issuers and credit information companies. Usefully for fraud victims, a pending police investigation or criminal proceeding is expressly not treated as the same grievance, so an FIR does not block your Ombudsman complaint. Note one restriction: an advocate cannot act as your authorised representative unless the advocate is himself the aggrieved person.
3. The adjudicating officer under Section 46 of the IT Act. This is the route where the claim is against the entity whose system failed, and it can order compensation for claims up to Rs 5 crore. The application carries a fee calculated on the compensation claimed under the Information Technology (Qualification and Experience of Adjudicating Officers and Manner of Holding Enquiry) Rules, 2003. The Secretary of the state or union territory department of information technology has been notified as adjudicating officer.
4. Consumer forum. A bank's failure to protect an account or to honour the RBI circular is a deficiency in service under the Consumer Protection Act, 2019. Pecuniary limits are Rs 50 lakh for the District Commission, above Rs 50 lakh and up to Rs 2 crore for the State Commission, and above Rs 2 crore for the National Commission.
5. Writ or civil action. Reserve this. Remember Section 61 of the IT Act bars a civil suit where the adjudicating officer or Appellate Tribunal has jurisdiction.

Costs and timelines you should plan for

These are indicative and vary with the forum, the city and the complexity of the trace.

• 1930 call and portal complaint: free, and the only step that has any real chance of stopping the money. Same day.
• Bank dispute: free. Shadow reversal due within ten working days of your notification; final resolution within ninety days of the complaint.
• FIR and investigation: no court fee. Charge sheet timelines vary widely; a traced-account cyber fraud typically takes several months, and an untraced one can remain under investigation indefinitely.
• RBI Ombudsman: no fee at all, and you can file it yourself. Most complaints are decided in a few months. Do not pay any agency that offers to file it for you.
• Section 107 BNSS attachment: driven by the investigating officer, not by you, so the cost is the lawyer time spent persuading the police and the court. Where an order is made, distribution is due within sixty days.
• Adjudicating officer or consumer forum: a prescribed filing fee plus professional fees. Expect the matter to run for many months to a couple of years, which is why it is a fallback rather than a first move.
• Legal fees: in Bengaluru, indicative professional fees run from a modest fixed fee for a legal notice and a portal or Ombudsman filing, to substantially more for a contested consumer or adjudication matter. Ask for the basis of the fee in writing before you engage anyone.

Evidence to preserve

Recovery and prosecution are only as strong as your records. Keep:

• SMS and email debit alerts and the exact transaction time and amount
• The UPI reference or transaction ID and the beneficiary VPA or account details
• Screenshots of the fraudulent message, link, app or call log, with the phone number and any URL visible
• Any payment receipts and your written complaint to the bank, with its acknowledgement number and date
• The cyber-crime portal acknowledgement number and the FIR copy
• The bank statement for the period, downloaded rather than photographed

Where the case reaches a court, electronic records are proved under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, which replaced Section 65B of the Indian Evidence Act and now requires dual certification. Ask the bank for a certificate along with the statement while the matter is fresh; getting one two years later is much harder.

The mistakes that cost people their money

• Calling the bank and nothing else. A phone call leaves no record you control. Send the email the same day, even a two-line one, and keep the sent copy.
• Waiting to "see if it reverses on its own". Every hour lowers the chance of a lien and moves you along the RBI liability table.
• Searching for the bank's customer-care number on the internet. Fake customer-care numbers are themselves one of the commonest frauds. Use the number printed on your card or in the bank's own app.
• Sending "verification" money to get the frozen amount released. No bank, police officer or portal will ever ask for a payment to release your funds. That call is a second fraud on the same victim.
• Paying a recovery agent found through a search result or a social media advertisement. The portal and the Ombudsman are free.
• Accepting an oral refusal. Ask for the refusal in writing with reasons. You need it to start the thirty-day Ombudsman clock and you need it to show the burden under paragraph 12 was never discharged.
• Missing the ninety-day Ombudsman window. People chase the bank for a year and then discover the Ombudsman route has closed.
• Filing the FIR and then stopping. The FIR is a prosecution, not a refund. Keep the banking track running in parallel.

Deadline warning. Three clocks run at the same time and each one is short. Three working days from the bank's communication preserves zero liability. Ninety days from the bank's reply or from the expiry of its thirty-day window is your last date to reach the RBI Ombudsman. And the practical clock, the one that decides whether the money is still there at all, is measured in minutes. Diarise all three on the day you discover the fraud.

When to involve a lawyer

You can do the first steps yourself, and you should, because speed matters more than legal help in the golden hour. Consider professional advice when the amount is significant; when the bank denies a clearly unauthorised transaction or blames you without proof; when the fraud crosses states or borders; when you want the investigating officer to move an attachment application under Section 107 BNSS; or when you need to pursue the adjudicating officer under the IT Act or a consumer complaint. Our team explains how these remedies fit together on the cyber-crime law practice page.

For related reading, see our guide on how to report cyber crime in India. You can also report directly through the Government of India portal at cybercrime.gov.in.

Frequently Asked Questions

This article is for general informational purposes only and does not constitute legal advice. Laws change and every situation is different; please consult a qualified advocate about your specific matter.

Related guides and where to get help

If this is a live problem rather than background reading, our cyber crime practice handles these matters from Bengaluru, including for clients who cannot attend court in person. These guides go deeper on the neighbouring questions:

• UPI and Bank Fraud in India: How to Get Your Money Back Under the RBI Rules
• How to Recover Streedhan in India
• Execution of Decree in India: How to Actually Recover Money After Winning (2026)