Most people lose the money twice. Once when the transaction goes through, and again in the two hours spent staring at the phone deciding whether to call the bank, tell the family, or wait to see if it reverses on its own. That second loss is the avoidable one, and it is usually the expensive one.
Call 1930, file on cybercrime.gov.in, and lodge a written unauthorised-transaction dispute with your bank — all three, ideally within the first hour, because that is the window in which the receiving account can still be frozen.
The bottom line
What it costs: nothing. 1930 is toll-free and the portal complaint is free.
What can be recovered: money still sitting in the beneficiary account. Under RBI rules a genuine unauthorised transaction reported within three working days carries zero liability for you.
What it will not fix: money already withdrawn or layered through mule accounts, and in most cases a transaction you were talked into approving yourself with your own OTP.
What the system behind the helpline actually does
Three separate machines are involved, and knowing which one you are talking to saves a lot of confusion.
The Ministry of Home Affairs runs the cyber crime reporting side: helpline 1930 and the National Cyber Crime Reporting Portal at cybercrime.gov.in, both under the Indian Cyber Crime Coordination Centre, or I4C. Behind them sits the Citizen Financial Cyber Fraud Reporting and Management System, which links more than 85 banks and payment intermediaries. When your complaint enters that system, it alerts the beneficiary bank to hold the funds.
The RBI runs the second machine: the customer protection framework that decides how much of the loss you personally bear. The third is ordinary bank grievance redressal, ending at the RBI Ombudsman.
One limit worth knowing early. I4C and the portal coordinate; they do not themselves freeze or release accounts. Banks and law enforcement do that, under their own procedures.
The first-hour playbook
- Call 1930 and give the transaction details. This is the step that can freeze the money, and it is the one people do last.
- File on cybercrime.gov.in with screenshots, transaction IDs, UPI references, timestamps and beneficiary details. Save the complaint ID.
- Tell your bank in writing — customer care and the branch — to block the card or account, and lodge a formal unauthorised-transaction dispute. The written dispute is what triggers your RBI liability protection. A phone call alone does not.
- Preserve every message, call log and screenshot, unedited.
- File an FIR at the local police station or cyber cell. For losses above ₹10 lakh, the e-Zero FIR initiative introduced in 2025 converts the 1930 or portal complaint into a Zero FIR automatically.
- Follow up with both the bank and the cyber cell, quoting your acknowledgement numbers.
- If the bank has not resolved the dispute within 30 days, or the answer is unsatisfactory, escalate to the RBI Ombudsman.
The RBI rule that decides who bears the loss
The RBI circular of 6 July 2017, "Limiting Liability of Customers in Unauthorised Electronic Banking Transactions", is the provision to quote in your written dispute.
It sets zero liability where the loss arises from bank negligence or a third-party breach and you report promptly — within three working days. Report later and liability becomes limited rather than zero, capped by transaction and account type. The bank must shadow-credit the disputed amount within 10 working days of your report, and resolve the complaint within 90 days.
There is a distinction inside that framework that decides most disputes. The protection covers unauthorised transactions, meaning someone else got into your account. If you were deceived into approving the payment yourself, it sits in a greyer zone and a full refund becomes much harder to argue. The criminal remedies, the account freeze and the portal complaint all still apply, which is why you report either way.
Why speed matters more than the amount
National recovery rates moved from roughly 10–11% in 2024 to about 24% in 2025, and the reason was not better technology. More victims reported inside the window.
Take a Pune professional who clicks a fake electricity-bill SMS, enters her card details and loses ₹85,000. Calling 1930 and filing on the portal within the hour gives a real chance that the beneficiary account is frozen with the money still in it, while a written bank dispute preserves her position under the RBI framework. Waiting two days in the hope that the bank will notice and fix it means the funds have been split across mule accounts and withdrawn. Same fraud, same amount, entirely different outcome.
Small-value cases and digital arrest
A Ministry of Home Affairs standard operating procedure now allows refunds in small-value cases, below ₹50,000, without requiring a court order, with time-bound handling. It exists because the old process cost more in effort than the amount at stake, so nobody pursued it.
The digital arrest scam deserves its own line, because it has taken thousands of crores. Fraudsters impersonating police or central agencies keep a victim on a video call, assert that a case is pending, and extract payment through sustained fear. The playbook above applies unchanged, plus one rule that ends the call: no genuine agency in India arrests anyone over a video call, and none takes money to clear a case. The offences involved are impersonation and cheating, charged under the IT Act, 2000 and the Bharatiya Nyaya Sanhita, 2023 together.
Where the system runs out
Recovery odds fall sharply after 24 hours, and after a week the complaint is a prosecution record rather than a refund route. If you shared an OTP, PIN or CVV, banks generally treat it as customer negligence and a full refund becomes unlikely, though you should still report every time. Cross-state and cross-border cases take far longer, and payments you were deceived into making yourself remain legally unsettled.
Common mistakes
- Waiting. Losing the first hour is the single most expensive error in this entire process.
- Telling the bank but not the portal, or the portal but not the bank. Do all three steps.
- Sharing an OTP, PIN or CVV, which usually forfeits the refund.
- Deleting the messages out of embarrassment before filing.
- Accepting the bank's first refusal. The Ombudsman exists precisely for that.
- Assuming a portal complaint is an FIR. It is not, and larger cases need the FIR too.
Frequently asked questions
How fast must I report to get my money back? Within the first hour to have the best chance of a freeze, and within three working days to your bank to claim zero liability for a genuine unauthorised transaction under the RBI rules.
What if the bank says it was my fault? It cannot close the matter on that basis alone. The bank has to examine the transaction logs and your report. If the answer is still unsatisfactory after 30 days, escalate to the RBI Ombudsman.
Do I need a lawyer? Not to report. For a large or contested loss, a cyber crime lawyer helps with the FIR and with pushing the bank escalation.
Is 1930 free? Yes. It is a toll-free national helpline, available 24 hours a day.
I approved the payment myself after being tricked. Do I have any remedy? The RBI zero-liability protection may not apply cleanly, but reporting to 1930 and the portal can still freeze the funds, and the criminal case proceeds regardless. Report it.
What happens for a loss above ₹10 lakh? The e-Zero FIR initiative converts your 1930 or portal complaint into a Zero FIR automatically, so jurisdiction arguments do not delay the investigation.