Citizen legal awareness · India
Have you lost money in a UPI scam, a fake investment scheme or an online banking fraud? Time matters. Immediately contact your bank or payment provider through its official fraud-reporting channel, call the national cyber financial fraud helpline 1930, and report the incident through the Government of India's National Cyber Crime Reporting Portal. Keep every complaint acknowledgement. Quick reporting can help authorities trace or hold money, but recovery is not guaranteed.
This guide explains practical steps for citizens across India, including Bihar. It distinguishes a police cybercrime complaint from a bank complaint, and explains why RBI's customer-liability rules do not automatically cover every payment made under deception.
At a glance: your first three actions
Step 1: Notify your bank or payment app without delay
Use the number on your card, your bank's official website, or its authenticated app. Explain that you suspect fraud; provide the transaction date, amount, and UTR or reference number. Request any appropriate protective action such as disabling a compromised card, payment credentials or access. If a UPI app was involved, also use the transaction's in-app complaint function and notify the account-holding bank.
Save the bank complaint number, date and time. Do not rely on a random search-result “customer care” phone number or social-media account claiming to offer a refund. If you have shared a password, OTP or PIN, immediately secure your credentials using official channels.
Step 2: Call 1930 for financial cyber fraud
1930 is the national reporting helpline for cyber financial fraud. You may be asked for your mobile number, bank or wallet, amount, transaction ID or UTR, date, time, and available information about the recipient or suspected fraudster. Give an accurate account; do not guess unknown details.
If you receive an acknowledgement or instructions to finish the complaint online, complete that follow-up promptly, preferably within the specified deadline. Official reporting instructions in some jurisdictions require completion within 24 hours of the helpline acknowledgement. If the phone line is busy, do not postpone the bank notification or online report.
Step 3: File a complaint on the national cybercrime portal
Go directly to https://cybercrime.gov.in/. Choose the relevant category (such as financial fraud or other cybercrime), follow the portal's registration and verification steps, explain the event chronologically and attach supporting documents as permitted. Save the acknowledgement number and check the complaint status through the portal. The official portal FAQ describes categories and tracking.
Important: Submission of a portal complaint does not in every case mean that an FIR has already been registered. The police handle the information in accordance with applicable procedure. For immediate danger to personal safety, contact the police or emergency number 112.
What evidence should you preserve?
- Bank debit alert, UTR/transaction reference, amount, date and time.
- Suspected UPI ID, beneficiary account details, phone numbers, website links or social-media profiles.
- Chats, emails, SMS, advertisements, screenshots and relevant call details, if available.
- Bank, payment-app, 1930 and portal complaint reference numbers and responses.
- A simple timeline: when contact began, when payment occurred and when you notified the bank or police.
Keep original records, preserve digital evidence and share sensitive data only with verified authorities through appropriate channels. Never put OTPs, PINs, passwords or full card credentials into a public form or social-media comment.
Secure your accounts and devices
Change affected passwords using a trusted device, enable multi-factor authentication, review active sessions, remove unknown remote-access applications, and contact your mobile operator if the SIM or phone is compromised. If a phishing link or downloaded app may have exposed your device, consider qualified technical help to secure it. Do not delete relevant fraud evidence before preserving a copy.
Will the bank refund the stolen money?
No automatic promise can be made. The RBI's Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (6 July 2017) provides zero or limited customer liability in specified circumstances. For example, in certain third-party breaches where neither the bank nor the customer is responsible, notifying the bank within three working days of receiving the bank's communication can be important. The rules are fact-dependent; the customer's own negligence and the difference between an unauthorised transaction and a payment that was authorised after deception may matter.
The “three working days” rule should not be presented as a guaranteed refund rule for every UPI scam. Submit a written bank grievance and retain all responses, even when you have filed a cybercrime complaint.
What if the bank does not resolve the grievance?
Use your bank or regulated payment provider's official grievance procedure first. For eligible complaints about deficiency in service, the Reserve Bank – Integrated Ombudsman Scheme, 2026 took effect on 1 July 2026. The RBI's Complaint Management System (CMS) provides an official channel for filing a qualifying Ombudsman complaint after the required initial approach to the regulated entity and applicable waiting period. The Ombudsman process concerns eligible service grievances and is not a substitute for a police investigation.
Keep in mind that different cases may concern different banks, payment intermediaries or non-bank wallet providers, and the applicable regulatory arrangements may differ.
How common cyber scams work
- UPI collect-request or QR scam: A fraudster promises money but asks you to enter a UPI PIN. As explained in NPCI's fraud-awareness guidance, entering your PIN after scanning a QR code generally authorises a payment, not a receipt.
- Fake customer care: Search advertisements or social-media posts show phone numbers controlled by impostors. Verify support channels independently.
- “Digital arrest” intimidation: Criminals impersonate officers by video call and demand money or secrecy. There is no legal procedure of online “digital arrest” requiring such payments.
- Investment, employment and task scams: A fake platform displays profits or salary and then demands more money for verification, tax, unlocking or withdrawal.
- Remote-access scams: A caller asks you to install screen-sharing software to “verify” or “refund” a payment.
If you have received a suspicious call, SMS or WhatsApp message but have not lost money, the Department of Telecommunications' Sanchar Saathi – Chakshu service accepts reports of suspected fraud communications. Where money has been lost, prioritise 1930, the cybercrime portal and your bank.
Frequently asked questions
What is the first thing to do after a UPI scam?
Immediately report the transaction through your bank or UPI provider's official channel, call 1930 and submit the details on cybercrime.gov.in. Record every acknowledgement.
Is 1930 available for online financial fraud?
Yes. It is the national helpline for reporting cyber financial fraud. Follow any instructions to complete the complaint online promptly.
Will a complaint on 1930 guarantee a refund?
No. Timely reporting can assist tracing or holding funds, but restitution depends on circumstances and legal processes.
Can I report fraud even after sharing an OTP or UPI PIN?
Yes. Report accurately to the bank and cybercrime authorities without delay, secure credentials and preserve evidence. Recovery and liability are case-specific.
Can I complain if I don't know the fraudster's name?
Yes. Provide the details you possess, such as transaction references, phone numbers, payment IDs, messages and links, without inventing facts.
Does a cybercrime portal acknowledgement automatically mean an FIR?
Not always. The complaint is processed by the appropriate law-enforcement authorities under applicable procedure.
Is every cyber fraud covered by RBI's three-working-day rule?
No. RBI's unauthorised electronic banking transaction rules depend on the facts. A customer-authorised payment induced by deception may raise different questions.
Verified official references and services
- Government of India — National Cyber Crime Reporting Portal (complaints and tracking)
- National Cyber Crime Reporting Portal — FAQs (reporting procedures)
- Reserve Bank of India — 2017 customer-liability notification (unauthorised transactions)
- RBI — Complaint Management System (Integrated Ombudsman Scheme, 2026)
- NPCI — Fraud Awareness (UPI and payment-safety advice)
- Department of Telecommunications — Sanchar Saathi (suspected calls and messages)
Disclaimer: This article is general public legal education, not individual advice, an advertisement or an invitation to engage legal services. Rules and portal interfaces can change. Prompt reporting is important, but no recovery or case outcome is guaranteed. Last updated: 31 October 2026.
Related: Citizen Legal Resource Centre · हिंदी संस्करण
New guides on WhatsApp: Follow the CLC Legal – Bihar Law Guides channel