Lost money to UPI or online fraud? What to do in the first hour (and the next 30 days)

Call 1930, report on cybercrime.gov.in, inform your bank within 3 working days for zero liability, and follow up the freeze, FIR and refund - step by step.

Updated:

Lost money to UPI, card or online fraud? Get the cybercrime.gov.in text, bank dispute letter with RBI rules, police FIR request and next steps in minutes.

Try Fraudshikayat free

Speed decides whether you get money back. Fraudsters move money through several "mule" accounts within hours; the sooner it's reported, the more of it can be frozen before it's withdrawn.

In the first hour

  1. Call 1930 (national cyber crime helpline) or report at cybercrime.gov.in → "Report financial fraud". Give the transaction IDs (UTR numbers), amounts, times, and the fraudster's UPI ID / account / phone number. You get an acknowledgement number - keep it.
  2. Call your bank's fraud line and block the card / UPI / net banking. Ask them to raise a dispute and note the complaint number.
  3. Don't delete anything: SMSes, call logs, chats, screenshots, the fraud app or link.

Within 3 working days: tell the bank in writing

Under RBI's customer protection rules (2017), if the fraud was a third-party breach and you report to the bank within 3 working days of getting the transaction alert, your liability is zero. Reported in 4-7 working days, your liability is capped (₹5,000-25,000 depending on the account type). After that, it's as per the bank's board-approved policy. If the bank itself was at fault, your liability is zero whenever you report.

Email the bank's grievance address: what happened, transaction IDs, the 1930 acknowledgement, and a request to reverse the unauthorised debit under the RBI circular. Note: if you shared your OTP or PIN, the bank may argue negligence - but still report everything.

Within a few days: police

  • Large losses: an FIR. In some states, complaints above a threshold made on 1930/NCRP are automatically turned into an e-Zero FIR - you're asked to visit the cyber police station within 3 days.
  • Otherwise, submit a written complaint at your local cyber cell with your acknowledgement number.

Getting frozen money back

When the police freeze the fraudster's account, the money is held, not returned. To get it back, you usually need a court order - an application before the magistrate (under BNSS section 503, earlier CrPC 457) - or a Lok Adalat in some states. Ask the investigating officer which route your district uses; some ask for an indemnity bond.

If the bank doesn't help

No reply or an unfair rejection after 30 days: complain to the RBI Ombudsman at cms.rbi.org.in (helpline 14448), within one year.

Get every document in the right order - the 1930/NCRP text, the bank letter citing RBI rules, the police complaint and the follow-up plan.

Frequently asked questions

Will I get my money back after reporting on 1930?

It depends on how quickly it was reported and whether the money could be frozen in the receiving accounts. Frozen amounts are returned through a court or Lok Adalat process. Reporting within the first hour gives the best chance.

Is the bank liable if I shared my OTP?

If you shared credentials, the bank may treat it as your negligence and you may bear the loss until you report it. Losses after you report are the bank's responsibility. Report anyway, and file with 1930.

UPI / online fraud complaint: every document, in the right order

Try Fraudshikayat free

More guides