How to Report Online Financial Fraud to Your Bank in India — Step-by-Step Guide

To report online financial fraud to your bank, call the bank's customer care immediately to block your card or account, report to the national cybercrime helpline 1930 within minutes, and file a written complaint with the bank within 3 working days. Under RBI rules, if you report within 3 working days, you have zero liability for the fraudulent transaction. The bank must credit the disputed amount within 10 working days and resolve the complaint within 90 days.

Who can report online financial fraud

• Any individual bank account holder who has experienced an unauthorized debit or transfer from their account
• Any debit card or credit card holder who has been charged for transactions they did not authorise
• Any UPI (Unified Payments Interface) user who has been defrauded through a fake payment request or unauthorized transfer
• Any net banking user whose credentials were compromised and used for unauthorized transactions
• Any mobile banking or wallet user who has been defrauded
• A legal heir or authorised representative of a deceased or incapacitated account holder
• A company or firm whose business account has been subjected to unauthorized transactions

Types of fraud covered:

• Phishing (fraudulent emails or websites that steal banking credentials)
• Vishing (fraudulent phone calls impersonating bank officials)
• SIM swap fraud (fraudster obtains a duplicate SIM to intercept OTPs)
• Card skimming (card data stolen at ATMs or POS machines)
• Unauthorized UPI transactions
• Net banking fraud (unauthorized login and fund transfer)
• QR code scam (fraudster sends a payment request disguised as a payment receipt)
• Fake customer care number fraud

Documents you will need

Immediate (for initial report — no documents needed)

You do not need any documents to make the initial report. Call immediately. Gather documents afterwards.

For the formal written complaint (within 3 days)

• Bank account statement — Showing the unauthorized transaction(s) with date, amount, and transaction reference number
• Screenshot of the transaction — From your mobile banking app, UPI app, or net banking showing the fraudulent transaction
• Identity proof — Aadhaar card, PAN card, or passport (photocopy)
• Bank account details — Account number, branch, IFSC code
• FIR or cybercrime complaint acknowledgement — From the police station or cybercrime.gov.in (file this in parallel)
• SMS or email alerts — The bank's transaction alert messages showing the unauthorized transaction
• Any communication from the fraudster — Emails, SMS, WhatsApp messages, or call records related to the fraud (screenshots)

Step-by-step process

Step 1: Call your bank IMMEDIATELY to block access

The moment you notice an unauthorized transaction or suspect fraud, call your bank's 24x7 customer care number and request an immediate block on your debit card, credit card, or net banking access.

Where: Bank's 24x7 customer care number (printed on the back of your card and on the bank's website) What to say: "I have noticed an unauthorized transaction on my account. I request you to immediately block my [card/net banking/UPI]. The transaction amount is ₹[amount] and the date is [date]."

Major bank helpline numbers:

Tip: Time is critical. Every minute you delay increases the chance that the fraudster moves the money to another account or withdraws it. Call before doing anything else. Do not wait to gather documents — call first, document later.

Step 2: Call the national cybercrime helpline 1930

Immediately after calling your bank, dial 1930 — the national cybercrime financial fraud helpline operated by the Ministry of Home Affairs. This helpline triggers the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS), which sends automated alerts to banks to freeze the fraudster's accounts.

Where: Dial 1930 from any phone (available 24x7 in most states) What to provide: Your name, bank name, account number, transaction details (amount, date, time), and any details about how the fraud occurred

Tip: The 1930 helpline is the single most effective step for recovering money. The CFCFRMS system can freeze the fraudster's bank account within minutes if the money has not yet been withdrawn. The sooner you call, the higher the chance of recovery.

Step 3: File a complaint on cybercrime.gov.in

File a formal complaint on the National Cyber Crime Reporting Portal (NCRP) to create an official record and initiate the police investigation.

Where: cybercrime.gov.in How:

1. Visit cybercrime.gov.in and click on "File a Complaint"
2. Select "Report Financial Fraud" under the complaint category
3. Create an account or log in with your mobile number
4. Enter the fraud details — type of fraud, transaction details, amount lost, bank details
5. Upload supporting evidence (screenshots, bank statements)
6. Submit and save the acknowledgement number

Tip: The NCRP complaint creates a formal record that is shared with your local police and the cyber cell. You will receive an SMS with the complaint number. This number is required when following up with the bank and the police.

Step 4: File a written complaint with your bank

Within 3 working days of the unauthorized transaction, file a formal written complaint with your bank. This is critical because the RBI's zero liability protection depends on timely reporting.

Where: Your bank branch (in person), bank's email for complaints, or the complaint section of the bank's website/app What to include:

• Your account number and personal details
• Transaction details — date, time, amount, transaction reference number, beneficiary details (if visible)
• Statement that you did not authorise the transaction
• Request for reversal of the amount
• Mention that you are reporting within 3 working days as per the RBI Circular on Limiting Liability of Customers dated July 6, 2017
• Attach the cybercrime complaint acknowledgement number

Form: Some banks have a specific "Dispute Form" or "Transaction Dispute Form" — ask for it at the branch

Tip: Keep a copy of the complaint with a receipt stamp from the bank. If you send it by email, get a written acknowledgement. The 3-day reporting window is calculated from the date you receive the SMS/email alert about the transaction, not from the date the transaction occurred.

Step 5: File an FIR at the local police station

File a First Information Report (FIR) at your nearest police station. While the cybercrime.gov.in complaint handles the cyber investigation, a local FIR is often required by the bank for processing your dispute.

Where: Nearest police station or the local cyber police station What to carry: Bank statement showing the fraudulent transaction, identity proof, cybercrime.gov.in complaint acknowledgement Section: Under Section 318 of Bharatiya Nyaya Sanhita (BNS) (cheating) and Section 66C/66D of the IT Act (identity theft, cheating by personation using computer resource)

Tip: If the police station refuses to file an FIR, remind them of the Supreme Court's direction in Lalita Kumari v. State of Uttar Pradesh (2014) that FIR registration is mandatory for cognizable offences. Alternatively, file a complaint with the Superintendent of Police (SP) or approach the Magistrate under Section 175(3) BNSS.

Step 6: Follow up with the bank for shadow reversal

Under the RBI circular, the bank must credit the disputed amount to your account within 10 working days of receiving your complaint. This is called a "shadow reversal" or "temporary credit."

Where: Bank customer care or branch Timeline: 10 working days from the date of your written complaint What to ask: "Has the shadow reversal of ₹[amount] been credited to my account as per the RBI circular on unauthorized electronic banking transactions?"

Tip: If the bank does not credit the amount within 10 working days, escalate to the bank's Nodal Officer (details available on the bank's website under "Grievance Redressal"). Cite the specific RBI circular: "Master Direction on Digital Payment Security Controls" and "Circular on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions dated July 6, 2017."

Step 7: Cooperate with the bank's investigation

The bank will investigate the complaint to determine liability. Cooperate fully — provide additional information if requested.

RBI liability framework:

Timeline: The bank must complete its investigation and determine liability within 90 days.

Tip: The key question is whether you shared your OTP, PIN, or password with the fraudster. If you did (even unknowingly due to social engineering), the bank may classify this as "customer negligence" and deny the refund. However, if the fraud was due to a SIM swap, malware, or a breach in the bank's system, you have zero liability if you reported within 3 days.

Step 8: Escalate to RBI Ombudsman if the bank does not resolve

If the bank does not resolve the complaint within 30 days (or you are not satisfied with the resolution), file a complaint with the RBI Integrated Ombudsman.

Where: cms.rbi.org.in (Complaint Management System) or call 14448 How: Register on the portal, enter the bank complaint reference number, describe the unresolved issue, and submit Timeline: The Ombudsman must dispose of the complaint within 30 days (extendable by 30 days)

Tip: The RBI Ombudsman has the power to order the bank to refund the amount plus compensation of up to ₹20 lakh. This is a free service and no advocate is required. The Ombudsman's decision is binding on the bank.

Fees and costs

How long does it take

Can you do this online?

Yes. Most of the reporting process can be done online or via phone:

1. Bank complaint: Call customer care (24x7) + file through mobile banking app or bank website
2. 1930 helpline: Phone call (24x7)
3. Cybercrime.gov.in: Fully online complaint filing
4. FIR: Some states allow e-FIR for financial fraud; otherwise, visit the police station
5. RBI Ombudsman: Fully online at cms.rbi.org.in

Tip: The fastest and most effective combination is: (1) Call bank immediately, (2) Call 1930, (3) File on cybercrime.gov.in — all within the first hour. The written bank complaint and FIR can follow within 1-3 days.

What if things go wrong

Problem: The bank says you shared your OTP/password and denies the refund

Solution: If you genuinely did not share your credentials, insist on a detailed investigation. Request the bank to provide evidence of customer negligence (they must demonstrate how the credentials were compromised by the customer). Under the RBI circular, the burden of proof for customer negligence lies with the bank. If the bank still denies, escalate to the RBI Ombudsman. If you unknowingly shared credentials due to social engineering (e.g., a fraudster posing as a bank official called you), courts have been sympathetic — the Rajasthan High Court held in 2024 that a customer has zero liability even with a compromised SIM if reported within 3 days.

Problem: The bank does not process the shadow reversal within 10 working days

Solution: Send a formal written reminder citing the RBI Circular on Limiting Liability of Customers (July 6, 2017) which mandates shadow reversal within 10 working days. If the bank still does not comply, file a complaint with the RBI Ombudsman at cms.rbi.org.in. The bank's non-compliance with the RBI circular is itself a ground for the Ombudsman to take action.

Problem: Police refuse to file an FIR

Solution: Under the Supreme Court's direction in Lalita Kumari v. State of Uttar Pradesh (2014), the police must register an FIR for cognizable offences — online financial fraud is a cognizable offence under the BNS and IT Act. If the police refuse, (a) submit a written complaint and ask for a written refusal, (b) file a complaint with the Superintendent of Police (SP), (c) approach the Magistrate under Section 175(3) of the BNSS to direct FIR registration, or (d) use cybercrime.gov.in as the primary complaint channel (it is shared with the police anyway).

Problem: The money has already been withdrawn by the fraudster

Solution: If the money has been moved to multiple accounts or withdrawn, recovery becomes harder but not impossible. The CFCFRMS system (triggered by the 1930 helpline) traces the money trail across banks. Even if the final amount is withdrawn as cash, the police investigation may identify the fraudster and recovery can be pursued through criminal proceedings. Continue with the bank complaint and RBI Ombudsman — the bank's liability (zero liability within 3 days) applies regardless of whether the money is recovered from the fraudster.

Problem: Multiple unauthorized transactions over several days

Solution: The 3-day reporting window applies separately to each transaction, calculated from when you receive the bank's notification (SMS/email) for that transaction. Report all transactions together but be aware that the liability framework applies individually to each. If you did not receive SMS alerts for some transactions, inform the bank that the notification failure is the bank's fault — the reporting timeline should be calculated from when you actually became aware of the transactions.

Frequently asked questions

What is the 3-day rule for reporting bank fraud?

Under the RBI Circular on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (July 6, 2017), if you report an unauthorized transaction to your bank within 3 working days of receiving the transaction notification (SMS or email), you have zero liability for the loss in cases where the fault is neither yours nor the bank's (third-party breach). The 3 days are calculated from the date the bank sends the transaction alert, not from the transaction date.

What if I discover the fraud after 3 days?

If you report between 4-7 working days, your maximum liability is capped at ₹5,000 to ₹25,000 depending on the type of account (savings, basic, credit card). If you report after 7 working days, the bank's board-approved policy determines the liability, which may be higher. However, even for late reporting, if the fraud was due to the bank's system failure or an employee's act, you have zero liability regardless of when you report.

Does the bank have to give me my money back?

If the transaction was unauthorized and you reported it within 3 working days, the bank must credit the disputed amount (shadow reversal) within 10 working days and must complete the investigation within 90 days. If the investigation confirms it was not your fault, the credit becomes permanent. If the investigation finds you were negligent (shared OTP/PIN), the bank can reverse the shadow credit — but you can challenge this finding with the RBI Ombudsman.

Can I file a complaint with both the bank and the RBI Ombudsman simultaneously?

No. The RBI Ombudsman requires that you first approach the bank and wait for 30 days (or receive an unsatisfactory response). You can file with the RBI Ombudsman only after the bank fails to resolve or you are dissatisfied. However, you can and should file with cybercrime.gov.in and the police simultaneously with the bank complaint.

What is the CFCFRMS system and how does it help?

The Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) is a national platform that connects law enforcement with banks and financial institutions. When you report fraud through the 1930 helpline, the system automatically sends alerts to the banks where the fraudulent funds have been transferred, requesting them to freeze the relevant accounts. This rapid-response mechanism has significantly improved the recovery rate for online financial fraud.

Are UPI frauds covered under these RBI guidelines?

Yes. The RBI guidelines on unauthorized electronic banking transactions cover all forms of electronic transactions including UPI, IMPS, NEFT, RTGS, debit card, credit card, net banking, and mobile banking transactions. The same 3-day reporting rule and zero liability framework applies to UPI fraud.