If you have been cheated online in India — whether through a UPI scam, phishing link, fake website, or fraudulent investment scheme — you have legal rights and a clear path to recovery. The single most important thing you can do is act within the first 24 hours: call your bank to block the compromised account, report on cybercrime.gov.in, and dial 1930 (the national cyber fraud helpline). Under RBI rules, if you report an unauthorized transaction within 3 working days, your liability is zero — meaning the bank must return your money.
Why this matters
Online fraud in India is growing at an alarming rate. The Ministry of Home Affairs reported that its Citizen Financial Cyber Fraud Reporting and Management System helped save over Rs. 3,431 crore across more than 9.94 lakh complaints. UPI fraud, phishing attacks, loan app scams, and fake investment schemes affect millions of Indians every year — from college students to retired professionals.
The good news is that India now has a well-developed system for reporting and recovering from online fraud. The national cybercrime portal (cybercrime.gov.in), the 1930 helpline, RBI's zero-liability circular, and the banking ombudsman together create a safety net that most victims do not know about. The earlier you act, the higher your chances of getting your money back. National recovery rates improved from 10-11% in 2024 to 24% in 2025, with prompt reporting within 6 hours significantly increasing recovery chances.
Step-by-step: What to do right now
Step 1: Call your bank immediately — block the compromised account
This is the golden rule. The moment you realize money has left your account without your authorization, call your bank's customer care or fraud helpline. Ask them to:
- Block your debit card, credit card, or UPI ID linked to the fraud
- Place a temporary freeze on outgoing transactions
- Note your complaint reference number (you will need it later)
Most banks have 24/7 fraud helplines. Every minute matters because fraudsters move stolen money quickly through multiple accounts.
Step 2: Report on cybercrime.gov.in within 24 hours
Visit the National Cyber Crime Reporting Portal at cybercrime.gov.in. Here is what to do:
- Click on "Report Financial Fraud" or "Report Other Cyber Crime" depending on your case
- Fill in your personal details, bank details, and the transaction details
- Upload evidence — screenshots of messages, transaction receipts, call logs, emails
- You will receive a unique complaint reference number — save it
This portal is managed by the Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs. It operates 24/7 and connects directly to banks and payment intermediaries to freeze fraudulent transactions.
Step 3: Call 1930 — the national cyber fraud helpline
Dial 1930 from any phone. This toll-free helpline operates 24 hours a day, 365 days a year. When you call:
- An operator will record your complaint details
- The system immediately alerts banks and payment gateways connected to the fraud
- Over 85 banks and payment intermediaries are linked to this system
- If the stolen money has not yet been withdrawn by the fraudster, it can be frozen in real time
The 1930 helpline replaced the earlier 155260 number in 2021 and is now the single point of contact for financial cyber fraud across India.
Step 4: File an FIR at the nearest police station or cyber cell
While the online complaint on cybercrime.gov.in has legal standing, filing a First Information Report (FIR) at your local police station strengthens your case significantly. You can also file it at the nearest cyber crime cell.
- Bring all evidence: screenshots, bank statements, transaction IDs, complaint numbers from Steps 2 and 3
- The police are legally required to register your FIR under Section 154 of the Code of Criminal Procedure (now Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023)
- If the police refuse to file the FIR, you can send a written complaint to the Superintendent of Police, or approach a Magistrate under Section 175(3) BNSS
Step 5: Preserve all evidence
Do not delete anything. Save the following:
- Screenshots of all messages, emails, and calls from the fraudster
- Transaction IDs and bank statements showing the unauthorized debit
- URLs of any fake websites you visited
- App download history if the fraud involved a malicious app
- Any communication with the fraudster — WhatsApp chats, SMS, call recordings
This evidence will be crucial for the police investigation and for your bank's internal inquiry.
What if things go wrong
Bank refuses to reverse the transaction? File a complaint with the RBI Banking Ombudsman at cms.rbi.org.in. You must first complain to the bank and wait 30 days (or receive an unsatisfactory response). The Ombudsman can award compensation of up to Rs. 30 lakh for financial loss and up to Rs. 3 lakh for non-financial loss such as harassment or mental anguish. You can also call the RBI's toll-free helpline at 14448.
Police refuse to file FIR? Send a written complaint to the Superintendent of Police of your district. If that does not work, approach the jurisdictional Magistrate with your complaint and evidence. The Magistrate can direct the police to register the FIR.
Fraudster is from another state? Cybercrime is investigated based on where the victim is located, not where the fraudster operates from. Your local police station has jurisdiction. The cybercrime.gov.in portal also routes complaints across state boundaries.
Money already withdrawn by the fraudster? Recovery becomes harder but is not impossible. The investigation may trace the fraudster's accounts and assets. You can also file a civil suit for recovery of the amount.
Documents and resources you need
- National Cyber Crime Reporting Portal: cybercrime.gov.in
- Cyber Fraud Helpline: 1930 (toll-free, 24/7)
- RBI Complaint Portal: cms.rbi.org.in
- RBI Helpline: 14448 (for banking ombudsman complaints)
- Sanchar Saathi Portal: sancharsaathi.gov.in (to report suspected fraud communications and block stolen phones)
- Your bank's fraud helpline number (save it in your phone now — do not wait for a fraud to happen)
- Evidence checklist: Bank statements, transaction IDs, screenshots of messages/emails, URLs, call logs, FIR copy, cybercrime.gov.in complaint number
Common myths
Myth: "Online fraud is too small for police to investigate." Reality: Every FIR must be registered regardless of the amount. Even small UPI frauds of Rs. 500 are registered on cybercrime.gov.in. The I4C system processes complaints of all sizes.
Myth: "If I shared my OTP, the bank won't help me." Reality: Even if you made an error, RBI rules still apply. If you report within 3 working days, your liability is zero for bank/system-side breaches. For cases where you shared credentials, the bank must still investigate. The Ombudsman can intervene if the bank is unfair.
Myth: "I can only complain in the city where the fraud happened." Reality: You can file the FIR and the cybercrime.gov.in complaint from your own location. Cybercrime jurisdiction is based on where the victim is, not where the fraudster operates.
Myth: "Reporting takes weeks and money is gone by then." Reality: The 1930 helpline and cybercrime.gov.in trigger real-time alerts to banks. If you report within the first hour, there is a high chance the fraudster's account gets frozen before the money is withdrawn.
Myth: "Only tech-savvy people can file a cybercrime complaint." Reality: The cybercrime.gov.in portal is designed for ordinary citizens. You can also walk into any police station and file the complaint in person. The 1930 helpline provides step-by-step guidance over the phone.
The law behind this
| Legal provision | What it covers | Punishment |
|---|---|---|
| IT Act, Section 43 | Unauthorized access to a computer system, data theft | Compensation up to Rs. 5 crore (civil) |
| IT Act, Section 66 | Computer-related fraud and dishonesty | Up to 3 years imprisonment + Rs. 5 lakh fine |
| IT Act, Section 66C | Identity theft — misuse of someone's electronic signature, password, or unique ID | Up to 3 years imprisonment + Rs. 1 lakh fine |
| IT Act, Section 66D | Cheating by impersonation using a computer resource | Up to 3 years imprisonment + Rs. 1 lakh fine |
| BNS, Section 318 | Cheating — dishonestly inducing someone to deliver property or alter a valuable security | Up to 3 years imprisonment + fine |
| BNS, Section 319 | Cheating by impersonation | Up to 5 years imprisonment + fine |
| RBI Circular dated 6 July 2017 (RBI/2017-18/15) | Customer protection — limits customer liability in unauthorized electronic banking transactions | Zero liability if reported within 3 days; limited liability (Rs. 5,000 to Rs. 25,000) if reported in 4-7 days; bank's policy applies after 7 days |
Frequently asked questions
What is the RBI zero-liability rule for unauthorized transactions?
Under RBI's circular on "Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions" (6 July 2017), if an unauthorized transaction happens due to a bank's system failure or a third-party breach and you report it within 3 working days, your liability is zero. The bank must credit the disputed amount back to your account within 10 working days. If you report between 4 and 7 days, your liability is limited to Rs. 5,000 (for basic savings accounts) to Rs. 25,000 (for credit cards and other accounts). Beyond 7 days, the bank's own policy determines liability.
Can I file a cybercrime complaint anonymously?
Yes, the cybercrime.gov.in portal allows anonymous reporting specifically for crimes against women and children. For financial fraud complaints, you will need to provide your identity and bank details so that the authorities can process the complaint and initiate recovery.
What types of online fraud can I report?
You can report all types: UPI fraud, debit/credit card fraud, phishing (fake emails or messages asking for passwords), vishing (phone calls pretending to be from your bank), fake e-commerce websites, job scams, loan app harassment, investment and cryptocurrency scams, social media impersonation, OLX/marketplace fraud, and sextortion. The cybercrime.gov.in portal has specific categories for each type.
How long does it take to get my money back?
If the money is frozen in time (typically within the first few hours of reporting), recovery can happen within a few weeks. If the money has already been withdrawn, recovery depends on the investigation — it can take several months. The RBI mandates that for proven unauthorized transactions, banks must credit the amount within 10 working days of your complaint.
Should I hire a lawyer for an online fraud case?
For the initial reporting and complaint process, you do not need a lawyer. The cybercrime.gov.in portal, 1930 helpline, and FIR filing are all designed for citizens to handle directly. However, if you need to approach the banking ombudsman for a disputed amount, file a civil recovery suit, or if the case involves a large sum, consulting a lawyer can help strengthen your case.
What if I receive a threatening call from a loan app after repaying?
Threatening calls, abusive messages, and accessing your phone contacts by loan apps are illegal. Report the app on cybercrime.gov.in under "Other Cyber Crime." You can also complain to the RBI if the app claims to be linked to a bank or NBFC. If the harassment involves threats of violence or defamation, file an FIR under BNS Section 351 (criminal intimidation).