Speed decides whether you get money back. Fraudsters move money through several "mule" accounts within hours; the sooner it's reported, the more of it can be frozen before it's withdrawn.
In the first hour
- Call 1930 (national cyber crime helpline) or report at cybercrime.gov.in → "Report financial fraud". Give the transaction IDs (UTR numbers), amounts, times, and the fraudster's UPI ID / account / phone number. You get an acknowledgement number - keep it.
- Call your bank's fraud line and block the card / UPI / net banking. Ask them to raise a dispute and note the complaint number.
- Don't delete anything: SMSes, call logs, chats, screenshots, the fraud app or link.
Within 3 working days: tell the bank in writing
Under RBI's customer protection rules (2017), if the fraud was a third-party breach and you report to the bank within 3 working days of getting the transaction alert, your liability is zero. Reported in 4-7 working days, your liability is capped (₹5,000-25,000 depending on the account type). After that, it's as per the bank's board-approved policy. If the bank itself was at fault, your liability is zero whenever you report.
Email the bank's grievance address: what happened, transaction IDs, the 1930 acknowledgement, and a request to reverse the unauthorised debit under the RBI circular. Note: if you shared your OTP or PIN, the bank may argue negligence - but still report everything.
Within a few days: police
- Large losses: an FIR. In some states, complaints above a threshold made on 1930/NCRP are automatically turned into an e-Zero FIR - you're asked to visit the cyber police station within 3 days.
- Otherwise, submit a written complaint at your local cyber cell with your acknowledgement number.
Getting frozen money back
When the police freeze the fraudster's account, the money is held, not returned. To get it back, you usually need a court order - an application before the magistrate (under BNSS section 503, earlier CrPC 457) - or a Lok Adalat in some states. Ask the investigating officer which route your district uses; some ask for an indemnity bond.
If the bank doesn't help
No reply or an unfair rejection after 30 days: complain to the RBI Ombudsman at cms.rbi.org.in (helpline 14448), within one year.
Get every document in the right order - the 1930/NCRP text, the bank letter citing RBI rules, the police complaint and the follow-up plan.