Something went wrong online? Start here.
Reviewed by the VirtualVakil legal team · Last reviewed:
If you have lost money, call 1930 or report on cybercrime.gov.in first, then tell your bank: reporting is free and speed matters most. For everything else, pick your situation below: each page gives the first steps, the sections of law that usually apply, and where to complain.
What happened?
Lost money in a UPI or online fraud
Call the 1930 cyber fraud helpline or report the fraud on cybercrime.gov.in at once, and tell your bank through its official helpline to block the card, UPI or net banking. Speed matters: an early report gives the banks a chance to put a hold on the money before it is moved on. Then save every screenshot and SMS, and complete the full complaint using the acknowledgement number you receive.
Read the answerBank not refunding an unauthorised transaction
For an unauthorised electronic transaction made up to 31 December 2026, RBI rules give you zero liability if a third party caused the breach and you tell your bank within three working days of its alert, a capped liability from four to seven working days, a credit of the disputed amount within 10 working days and a decision within 90 days. For transactions from 1 January 2027, new RBI rules apply: report within five calendar days, a decision within 45 days, and one-time compensation of up to ₹25,000 for some small-value victims even where they were careless. If the bank does not reply within 30 days or you are not satisfied with its reply, go to the RBI Ombudsman.
Read the answerRBI Ombudsman complaint for card or UPI fraud
Complain to your bank first, in writing. If it does not reply within 30 days, or you are not satisfied with its reply, you can file a free complaint on cms.rbi.org.in under the Reserve Bank – Integrated Ombudsman Scheme, 2026, which applies to complaints from 1 July 2026. File within 90 days of the later of the 30 days running out or the bank's last reply, and attach your bank complaint, its reply, the transaction details and your cyber fraud acknowledgement.
Read the answerCyber insurance or a response membership
Personal cyber insurance is a policy from an insurance company that pays for covered financial losses after you make a claim, subject to its terms, limits and exclusions. A cyber response membership such as Cyber Surety is not insurance: it gives you people who act during the incident, ethical hackers to secure your accounts and devices and lawyers to file and follow up the complaint. Which one fits depends on whether you want money after a loss, help while it is happening, or both.
Read the answerInstagram or WhatsApp account hacked
For WhatsApp, reinstall the app and register again with your own number: entering the six-digit SMS code logs the other device out, and you should then turn on two-step verification. For Instagram, go to instagram.com/hacked from any browser, which lets you recover the account through your email, phone number or identity checks. Warn your contacts at once, because hackers use the account to ask friends for money or OTPs, and report on cybercrime.gov.in if money or threats are involved.
Read the answerBlackmailed after a video call (sextortion)
Do not pay and do not negotiate: paying does not get the video deleted and often leads to more demands. Stop replying, save the evidence (the profile, chat, phone numbers and payment requests), make your social accounts private and report on cybercrime.gov.in or 1930. Recording and threatening to share intimate images is a crime under the IT Act and the BNS; you are the victim, and the content can be reported for removal.
Read the answer'Digital arrest' call
There is no such thing as a 'digital arrest' in Indian law: the police, CBI, ED, customs or a court do not arrest anyone over a video call, and no agency asks you to transfer money to 'verify' it. Cut the call, do not pay, and report the number on 1930, cybercrime.gov.in or Chakshu on Sanchar Saathi. If you have already paid, call 1930 immediately and tell your bank.
Read the answerHarassed by a loan app
Recovery agents may not threaten, abuse or humiliate you, or call your family and friends to shame you: RBI rules forbid this for regulated lenders, and threats and morphed photos are crimes under the BNS and the IT Act. Keep proof of every call and message, check whether the app is linked to an RBI-regulated lender, and report the harassment on cybercrime.gov.in or 1930. Complaints about a regulated lender go to the lender and then the RBI Ombudsman; illegal lending can be reported on RBI's Sachet portal.
Read the answerIs my phone hacked?
Warning signs include apps you did not install, an app with Accessibility or device-admin access you never knowingly gave, OTP messages you did not request, and accounts logged in on devices you do not recognise. Check those settings first, remove anything unknown, update the phone and change your passwords from a different device. If money or messages are being misused, report on 1930 or cybercrime.gov.in, and have the phone examined before you reset it if you need the evidence.
Read the answerThree ways we can help
Free guidance on WhatsApp
Tell us what happened. We tell you what to do next and which law applies. Starting is free.
We file your complaint: ₹999
We draft your cybercrime.gov.in complaint, bank dispute letter, police follow-up and ombudsman escalation, and follow up with you on WhatsApp.
Cyber Surety membership
A membership, not insurance: ethical hackers and lawyers on WhatsApp 24×7 for the next incident. Cyber-loss cover included, up to plan limits. T&C apply.
Prefer to file it yourself? Reporting on 1930 and cybercrime.gov.in is free. The step-by-step portal guide is on codesnag.ai: how to file a cyber crime complaint. All our cyber questions are on the cyber help page.