UPI fraud, phishing links, fake investment apps, OTP compromises, marketplace cons — the modus changes monthly, but the aftermath is the same problem everywhere: defrauded money begins moving through a chain of accounts within minutes, and every passing hour erodes what can be frozen. Indian enforcement has built a dedicated interception machinery for exactly this — the 1930 helpline and the National Cyber Crime Reporting Portal — but it works at the speed of the victim's reporting. This explainer lays out the first forty-eight hours in order of priority, and the legal follow-through after them.
The first day, in order
What to preserve, and why
| Evidence | What it later proves |
|---|---|
| Bank statements with UTR numbers | The debit trail matched against credits frozen in mule accounts — the basis for seeking release of funds |
| Call recordings, numbers, chat screenshots | Inducement and personation; identification of the fraud infrastructure |
| Phishing links, APK files, fake app pages | The IT Act offences and the modus; takedown requests to intermediaries |
| Portal and 1930 acknowledgements | Promptness of reporting — relevant to bank liability and to any insurance claim |
| The written bank notification and its timestamp | Position under the RBI zero/limited-liability framework |
The offences in play
Most online frauds engage cheating under Section 318 of the Bharatiya Nyaya Sanhita, 2023 (formerly Section 420 IPC) and cheating by personation under Section 319 BNS, alongside the Information Technology Act, 2000 — Section 66C for identity theft (misuse of passwords, OTPs and credentials) and Section 66D for cheating by personation using a computer resource. Forged payment pages and documents add the BNS forgery provisions, and organised rackets can attract Section 111 BNS. For the victim, the precise sections matter less at the start than the completeness of the factual record handed to the investigator — sections can be added; lost hours cannot.
After the first week
Once tracing reports arrive, the dispute typically moves on three tracks. On the criminal track, the investigation proceeds against the account operators and the racket, and the victim\'s role is to supply the matching documentation promptly. On the recovery track, the victim applies — through counsel, before the magistrate seized of the frozen-account reports — for release of amounts frozen in the chain that correspond to the victim\'s debits. On the banking track, the customer pursues the bank\'s liability determination under the RBI framework where the transactions were unauthorised, escalating through the bank\'s internal grievance machinery to the RBI Integrated Ombudsman if the response is inadequate. A victim who has papered the first forty-eight hours properly walks into all three tracks with the record already made.
What not to do: do not keep engaging the fraudster to "negotiate a refund"; do not pay "release fees" to anyone promising recovery — recovery-agent frauds specifically target recent victims; do not delete chats or reset the compromised device; and do not wait for the bank\'s response before reporting to 1930 and the portal — the tracks run in parallel, not in sequence.
Practice note: in cyber fraud, the client\'s best lawyer on day one is a complete, timestamped paper trail. Everything that follows — freezing, release applications, bank liability — is built on it. This article is for general information only and is not legal advice.
Frequently Asked Questions
Why is 1930 the first call, before even the bank?
The helpline feeds the Citizen Financial Cyber Fraud Reporting and Management System, which connects police and the banks in the transaction chain on one platform. A prompt report lets holds be placed on the money as it sits in intermediate accounts — the only stage at which it is realistically recoverable. The bank should be informed immediately after, in writing, but the interception machinery is triggered through 1930 and the portal.
Does reporting on the portal replace an FIR?
No. The portal complaint initiates tracing and freezing, but the criminal investigation — and several downstream remedies, including release of frozen amounts and insurance or liability claims — are anchored to an FIR. If the local police station hesitates, remember that cyber offences can be reported at any police station (the Zero FIR route) for transfer to the jurisdictional cyber police station, and e-FIR facilities exist for certain categories.
What do the RBI's zero-liability rules actually say?
For unauthorised electronic transactions — where the customer did not authorise the debit at all — RBI's customer-protection framework provides zero liability where the fraud results from the bank's own deficiency or a third-party breach and the customer notifies the bank within three working days of learning of the transaction; limited liability applies for delayed notification, and the loss burden grows with delay. Transactions the customer was deceived into authorising are treated differently, which is why the facts of how the money moved must be recorded accurately from the start.
Is the money ever actually recovered?
Yes — when freezing beats layering. Amounts intercepted in the chain are held under orders of the criminal courts, and victims can apply to the court concerned for release of the traced funds against proof that the frozen credits correspond to their debits. The success rate falls steeply with reporting delay, which is the whole case for treating the first day as decisive.