If money has just left your account through a fraud, stop reading and call 1930 now. Then come back. Speed decides most of these cases. Fraudsters move money through several accounts within minutes, and once it is withdrawn as cash or sent abroad, it is very hard to get back.
An online fraud complaint works on two tracks at the same time. One is the police track: 1930, the national cyber crime portal, and an FIR. That is what freezes the money in the fraudster’s accounts. The other is the bank track: your complaint to the bank, RBI’s customer liability rules, and the RBI Ombudsman. That can make the bank pay you back in some cases. Do both.
Step 1: Call 1930 within the first hour
1930 is the national cyber crime helpline run with the Ministry of Home Affairs’ Indian Cyber Crime Coordination Centre. It works 24 hours. When you report a financial fraud, the details go to the banks and payment apps involved, and they can put a hold on the money in the receiving accounts if it is still there.
Police and officials call the first hour after the fraud the “golden hour”. The sooner you call, the more of the money is likely to be sitting in the first or second account in the chain.
Keep ready:
- the transaction ID or UTR number, date, time and amount
- your bank and account, and the UPI ID, account number or card used
- the fraudster’s phone number, UPI ID, website or app name
- screenshots of chats and messages
You will get an acknowledgement number. Write it down.
Step 2: Complete the complaint on cybercrime.gov.in
The National Cyber Crime Reporting Portal at cybercrime.gov.in has a section for financial fraud. If you called 1930, the complaint may already be logged, but you will often be asked to log in and add details and documents. Do it the same day. Upload the screenshots and your bank statement showing the debit.
The portal also lets you track the complaint. Check it, because it shows which accounts the money went to and whether any amount has been put on hold.
Step 3: Tell your bank in writing, today
Call your bank’s fraud line to block the card, UPI or net banking, and then send a written complaint by email or through the app. Ask for a complaint number and keep it. The date and time you report to the bank matters for the liability rules below.
What RBI’s liability rules say
RBI has rules on who bears the loss when there is an unauthorised electronic transaction, meaning one you did not make or approve. The rules from RBI’s circular of 6 July 2017 (now part of RBI’s 2025 consolidated directions for banks) apply until the revised rules described below take effect:
| Situation | Your liability |
|---|---|
| The bank was at fault | Zero, whenever you report |
| Fault lies with a third party (not you, not the bank), reported within 3 working days of the bank’s alert | Zero |
| Same, reported in 4 to 7 working days | Limited to the transaction value or a cap of Rs 5,000, Rs 10,000 or Rs 25,000 depending on account type, whichever is lower |
| You shared your OTP, PIN or password | You bear the loss until you report it. After that, the bank bears it |
The bank must credit the disputed amount to your account (a “shadow reversal”) within 10 working days of your report, and must settle the complaint within 90 days. The bank has to prove that you were at fault.
RBI issued revised rules in June 2026. For commercial banks they apply to transactions on or after 1 January 2027. Under them, a third-party breach reported within five calendar days carries zero liability, and some small-value victims can get partial compensation even where they were careless. We check which version applies to your transaction date.
The limit of these rules
If you were tricked into making the payment yourself, by scanning a QR code, entering your UPI PIN, or transferring to a “customer care” number, the bank will usually say you authorised it. In those cases the liability rules may not help, and recovery depends on the police track: getting the money frozen and then released to you.
Step 4: The RBI Ombudsman if the bank does not help
If the bank does not reply within 30 days, or rejects your complaint, you can complain to the RBI Ombudsman under the Reserve Bank Integrated Ombudsman Scheme, 2021, on cms.rbi.org.in. You must complain to the bank first. The Ombudsman complaint should be filed within a year of the bank’s reply, or of the date a reply was due. There is no fee.
Step 5: The FIR
The portal complaint is not always an FIR. For larger amounts, or if the police ask you to, file an FIR at the cyber crime police station. Bengaluru has CEN (Cyber, Economic and Narcotics) police stations that deal with these cases. The usual offences are cheating under Section 318 of the Bharatiya Nyaya Sanhita (old Section 420 IPC) and identity theft and cheating by impersonation under Sections 66C and 66D of the Information Technology Act. If the station will not register it, see what to do when the police refuse to file an FIR.
Our guide to filing a cyber crime complaint in Bengaluru has more detail on the station and the documents.
Step 6: Getting frozen money released to you
A hold on the fraudster’s account does not send the money back to you on its own. Usually you have to apply to the magistrate for the held amount to be released, with the FIR or complaint number and proof of your loss. Such applications are commonly made under Sections 497 and 503 BNSS (old Sections 451 and 457 CrPC). The court may ask you for a bond or undertaking to return the money if another claim is proved.
Where money from several victims landed in the same account, the court may share it out. Section 107 BNSS also allows a court to attach proceeds of crime and have them distributed among the people who lost money.
This stage is where people often stall. Applications get adjourned while the court waits for a police report. We file the application, follow up with the investigating officer for the report, and press for an order.
Questions people ask
How do I file an online fraud complaint?
Call 1930 and report on cybercrime.gov.in as soon as possible, then complain to your bank in writing. For larger losses, also file an FIR at the cyber crime police station.
Can I get my money back after a UPI fraud?
Sometimes. If you report quickly and the money is still in the receiving account, it can be held and later released to you by court order. If the payment was unauthorised and you report within RBI’s time limits, the bank may have to refund you.
What is the time limit to report UPI fraud to the bank for zero liability?
Under the rules in force until the end of 2026, three working days from the bank’s alert where the fault lies with a third party. From 1 January 2027, the revised RBI rules for commercial banks allow five calendar days.
What if my money went into an account that was not the fraudster’s?
That happens often, because fraud money is passed through other people’s accounts. Those accounts may be frozen too. Read about it from the other side in bank account frozen by cyber crime police.
Talk to us about your matter
Call or WhatsApp to fix a time. Bring your papers to the office in Rajarajeshwari Nagar.
This article is general information about the law as it stood when it was written. Your facts change the answer. Speak to an advocate before you act on it.