CYBER HELP · ONLINE FRAUD · FIRST HOUR

Lost money in a UPI fraud? The first hour, and how money is actually recovered

Reviewed by the VirtualVakil legal team · Last reviewed:

SHORT ANSWER

Call the 1930 cyber fraud helpline or report the fraud on cybercrime.gov.in at once, and tell your bank through its official helpline to block the card, UPI or net banking. Speed matters: an early report gives the banks a chance to put a hold on the money before it is moved on. Then save every screenshot and SMS, and complete the full complaint using the acknowledgement number you receive.

Get free help on WhatsAppWe file it for you: ₹999
DO THIS NOW

In the first hour

  1. Call 1930, the national cyber crime helpline, or report the fraud on cybercrime.gov.in. Write down the acknowledgement number.
  2. Call your bank on the number printed on your card or shown on its official website, never a number from a search result or from the caller. Ask it to block the card, UPI or net banking and to register a fraud complaint. Write down the complaint number.
  3. Do not call the fraudster back, do not install any app they suggest, and never share an OTP, UPI PIN or your screen with anyone who offers to recover the money.
  4. Take screenshots of the transaction, the UPI ID or account the money went to, the chat, the call log and the SMS before anything is deleted.
Step by step

How to report an online fraud, step by step

  1. Report on 1930 or cybercrime.gov.in

    Give the transaction ID, date, time, amount and the account or UPI ID that received the money. The report goes into the national system that the police and banks use to act on financial cyber fraud.

  2. Report to your bank in writing as well

    After the phone call, send the complaint through the bank's app, website or email so that the date and time of your report are on record. For an unauthorised electronic transaction, how quickly you report decides how much of the loss, if any, you bear under RBI rules.

  3. Preserve the evidence

    Keep the bank SMS and statement, payment screenshots, the fraudster's numbers, profile links, chats, emails, call recordings and any app they made you install. Do not delete the chat even if it upsets you; it is evidence.

  4. Complete the complaint on cybercrime.gov.in

    Log in to cybercrime.gov.in with your mobile number (the portal sends an OTP to your phone), quote the acknowledgement number if you called 1930, describe what happened in order, and attach the evidence. Do this the same day if you can.

  5. Follow up with the police

    The complaint is sent to the police for your area. Where the facts show a cognisable offence such as cheating, you may ask for an FIR to be registered under BNSS S. 173, which also permits information to be given electronically and an FIR to be registered irrespective of where the offence was committed.

  6. Escalate if the bank does not resolve it

    If your bank does not reply within 30 days, or rejects the complaint, you can complain to the RBI Ombudsman through cms.rbi.org.in.

How money is actually recovered: the hold, the lien and the release

When you report on 1930 or cybercrime.gov.in, the report is passed to the bank or wallet that received your money. If the money is still there, that bank can put a hold (often called a lien or debit freeze) on the amount. If it has already been moved, the trail is followed to the next account, which is why the first hour matters most.

A hold does not by itself return the money to you. The held amount is released to the victim through the police and bank process, and in many cases only on an order of a magistrate on an application for return of the property (BNSS S. 503 or S. 497, depending on the stage). The Ministry of Home Affairs has issued a standard operating procedure on removing lien markings and restoring defrauded money through the national reporting system. How long this takes varies from case to case and court to court.

This release stage is where a lawyer usually helps most: the application, the documents the court and bank ask for, and the follow-up with the investigating officer.

Will I get my money back?

No one can promise that, and you should distrust anyone who does. Recovery depends on how fast the fraud is reported and whether the money is still in an account that can be held.

If you did not authorise the transaction at all, for example your card or account was used without your knowledge, the RBI customer-liability rules may limit or remove your loss when you report quickly. If you approved the payment yourself, even after being deceived, banks usually treat it as an authorised payment, and the 1930 report, the hold on the money and the police case become your main route.

Mistakes that cost people more money

  • Calling a 'refund' or 'recovery' number found online or on social media. Recovery scams target people who have just lost money.
  • Waiting a day to see whether the bank reverses it on its own. Report first.
  • Paying a 'fee' or 'tax' to release a refund. Genuine refunds never need one.
  • Reporting only to the bank and not on 1930 or cybercrime.gov.in, or the other way round. Do both.
  • Deleting the chat or blocking the number before taking screenshots.
The law

Which sections usually apply

Sections of law that usually apply
SectionWhat it covers
BNS S. 318Cheating, including dishonestly inducing a person to deliver money or property.
BNS S. 319Cheating by personation, for example posing as a bank official, a company or a known person.
IT Act S. 66CIdentity theft: fraudulently using another person's password, electronic signature or other unique identification feature.
IT Act S. 66DCheating by personation using a computer resource or communication device.

The police decide which sections go into the FIR after looking at your facts. This list is a guide, not a charge sheet.

If you want help

Three ways we can help

Free guidance on WhatsApp

Tell us what happened. We tell you what to do next and which law applies. Starting is free.

We file your complaint: ₹999

We draft your cybercrime.gov.in complaint, bank dispute letter, police follow-up and ombudsman escalation, and follow up with you on WhatsApp.

See what ₹999 covers

Cyber Surety membership

A membership, not insurance: ethical hackers and lawyers on WhatsApp 24×7 for the next incident. Cyber-loss cover included, up to plan limits. T&C apply.

Plans on codesnag.ai

Prefer to file it yourself? Reporting on 1930 and cybercrime.gov.in is free. The step-by-step portal guide is on codesnag.ai: how to file a cyber crime complaint. All our cyber questions are on the cyber help page.

Frequently asked

What people ask

What is the cyber fraud helpline number in India?

1930. You can also report online at cybercrime.gov.in. Both are run under the Indian Cyber Crime Coordination Centre (I4C) of the Ministry of Home Affairs.

How soon should I report a UPI or online fraud?

Immediately. An early report gives the banks the best chance to hold the money. For an unauthorised electronic transaction caused by a third-party breach, RBI rules give zero customer liability if you report it within three working days of receiving the bank's communication (for transactions up to 31 December 2026) or within five calendar days of the transaction (from 1 January 2027).

Is filing a cyber crime complaint free?

Yes. Calling 1930 and filing on cybercrime.gov.in are free, and you do not need a lawyer to file. People use a lawyer or a service such as our ₹999 filing service when they want the complaint drafted properly, the bank and police letters written and the follow-up handled.

Can I also go to a police station?

Yes. You can approach the cyber cell or any police station. Where the facts disclose a cognisable offence, BNSS S. 173 provides for an FIR to be registered irrespective of where the offence was committed, and for information to be given electronically.

The bank has frozen the fraudster's account. When do I get my money?

A freeze or lien keeps the money from being moved; it does not transfer it to you. Release to the victim follows the police and bank process and often needs an order of a magistrate on an application for return of the money. The time taken varies, and no one can guarantee the outcome.

Someone says they can recover my money for a fee. Is that genuine?

Treat it as a second fraud. The police, banks and the 1930 helpline do not charge to recover money, and no genuine agency asks for your OTP, UPI PIN or remote access to your phone.

Does my bank have to refund a fraud?

For unauthorised electronic transactions the RBI customer-liability rules apply, and your liability depends on who was at fault and how quickly you reported. Up to 31 December 2026, a payment you approved yourself is usually treated as authorised; from 1 January 2027, new RBI rules also cover payments approved under coercion or made with credentials taken from you by fraud. See our page on banks not refunding unauthorised transactions.
Official sources

Where these rules come from

Last reviewed: 19 Oct 2026. This page gives legal information, not legal advice for your specific case. Rules and portals change; if anything here differs from the official source, the official source prevails. VirtualVakil is not a government portal.

Related questions

Bank not refunding an unauthorised transactionRead the answer 'Digital arrest' callRead the answer Instagram or WhatsApp account hackedRead the answer