What to Do When an Online Banking Scam Takes Your Money in India | Quick Actionable Ideas and Survival Tips

INDIA — If money has left your bank account after an online scam, ACT IMMEDIATELY. Call the national cyber financial fraud helpline on 1930 and report the incident through the official National Cyber Crime Reporting Portal. At the same time, contact your bank through a verified number or banking app and request fraud intervention. Save the transaction reference, date, amount, beneficiary or UPI ID, and the complaint acknowledgements.

The Indian Cyber Crime Coordination Centre (I4C) and banks may be able to coordinate steps to stop the transfer of money onward, but speed matters and recovery is not guaranteed. Do not send an additional payment to a caller claiming they can “release” or “refund” your stolen money.

12 immediate actions — online banking fraud checklist

Stop all contact with the scammer. End the call, chat, screen-share or video session. Do not follow more payment instructions.
Call 1930 immediately. This is India’s national helpline for reporting cyber financial fraud and obtaining reporting assistance.
Report at cybercrime.gov.in. Complete the official complaint with accurate transaction details; follow any acknowledgement and portal follow-up instructions promptly.
Contact the bank or payment provider directly. Use only its verified official app, website, card or statement contact number; ask it to secure the account and escalate the fraud.
Give the UPI transaction ID or UTR/reference number. Also provide the amount, transaction time, debit bank, payee/UPI ID and any relevant account or wallet details.
Request safeguards against further loss. Ask whether cards, mobile banking, UPI access, new beneficiaries or devices should be blocked or restricted.
Protect your primary email and phone number. Change compromised passwords on a trusted device, review login sessions and contact the mobile carrier if SIM misuse is suspected.
If a remote-access or screen-share app was installed, stop its access safely. Disconnect from the attacker, tell your bank what was installed and seek trustworthy device-security assistance.
Save evidence without exposing more data. Retain screenshots, bank alerts, payment receipts, scam messages, numbers and URLs, but do not post account numbers publicly.
Obtain complaint acknowledgements. Save the 1930/portal reference, bank fraud case number and any police or cyber-cell instructions.
Check all affected accounts. Review additional transfers, cards, standing instructions, UPI mandates and suspicious new-device logins.
Follow up until the bank and investigating authorities give an outcome. Use the current RBI complaint escalation process for eligible unresolved service grievances; avoid fake recovery agents.

If the transfer happened minutes ago, stop reading and contact 1930 and your bank now. An article cannot reverse a transfer, access police payment systems or guarantee that funds remain available to freeze.

Why reporting quickly matters

India’s Ministry of Home Affairs operates the Citizen Financial Cyber Frauds Reporting and Management System (CFCFRMS) through I4C and the National Cyber Crime Reporting Portal. Its purpose is to coordinate rapid reporting of digital financial fraud and help stop funds from being moved by criminals.

A July 2026 government release reported that the system had helped safeguard substantial amounts through participating banks and authorities. That describes the scale of the mechanism, not a promise that any individual transaction will be recovered.

A fraudster may immediately transfer the proceeds through several bank accounts or payment channels. A rapid, accurate report can give banks and police a better opportunity to identify the transaction and take available preventive action. Waiting until the end of the day may reduce options.

You should notify both the national cybercrime reporting service and the bank. They serve different but related functions: the first supports cybercrime reporting and coordination, while the bank protects your account and investigates transactions under its rules and applicable RBI requirements.

Exactly how to use the 1930 cyber financial fraud helpline

Dial 1930 from a phone in India. Explain that you are reporting an online financial cyber fraud. Be prepared with your mobile number, bank name, amount debited, date and time, and transaction reference. The cybercrime portal’s published reporting instructions list bank or wallet details, UPI ID, transaction ID and screenshots as useful reporting material.

Record the acknowledgement number and any specific next steps. Some official instructions require the caller to complete a formal complaint on the National Cyber Crime Reporting Portal using the acknowledgement within 24 hours. The precise process can vary with the reporting channel and current system instructions, so finish the portal follow-up as soon as possible and do not leave it incomplete.

Do not provide passwords, UPI PINs or one-time passcodes to an incoming caller merely because they claim to be following up for 1930. Use the actual government portal and verified contacts. Police and banks can ask for transaction information, but a request to make a fresh payment or reveal a secret PIN is a separate warning sign.

If the helpline is busy or you cannot get through, use the official online portal immediately and notify your bank without waiting. Keep evidence of each attempt and the reference from any successful report.

How to make a complaint at cybercrime.gov.in

The National Cyber Crime Reporting Portal accepts cybercrime complaints, including financial fraud. Use the correct reporting category and supply factual information about how the money was sent and what the scammer did.

List each transaction separately when several transfers occurred. A single scam conversation can lead to multiple UPI payments, bank transfers or card transactions; missing one may make investigation more difficult. Give the bank and cybercrime references that appear in your statements rather than trying to calculate a reference from memory.

Useful details include:

Name of the bank, payment app or wallet used.
Your relevant account or masked identifying details, following portal instructions.
The exact debited amount and timestamp.
Transaction number, UTR, reference or UPI payment identifier.
Recipient’s UPI ID, merchant label or beneficiary account details when shown.
The caller’s claimed identity and the phone number or website involved.
Screenshots of messages, payment screens and receipts.
The date you first noticed the fraud and any bank contact already made.

Do not guess missing details. If the payee was a fake investment platform or the payment went through an intermediary, describe that sequence accurately. Keep the original records in case investigators need them.

Reporting is not the same as getting an FIR or a refund

An online cybercrime complaint may be routed through police and financial entities, but whether an FIR is registered and what investigative action follows depends on the relevant law-enforcement agency. An acknowledgement that a report was received does not mean funds have been returned.

A temporary lien or hold on a suspected recipient account is also not a guarantee that money will automatically be paid to the victim. Restoration may require verification and additional lawful procedures. Follow the official case updates and do not pay strangers to accelerate the process.

What to tell your bank immediately

Use the bank’s fraud hotline or an official support channel identified independently. A concise opening is: “I have experienced a suspected cyber financial fraud. The transaction was [amount] at [time], reference [number]. Please secure my account, register a fraud complaint and advise what can be done to stop further transfers.”

Ask the bank whether it needs to block a card, disable UPI, freeze a compromised login, remove suspicious payees or restrict new devices. A bank may ask you to verify identity through approved methods. It should not ask you to reveal your secret UPI PIN or online banking password to a caller.

Request a written or digital acknowledgement. Note the complaint number, time, bank department and actions agreed. If more transfers occur after you have notified the bank, report them separately and ask for escalation.

Do not wait until the cybercrime portal produces a final result before contacting the bank. The Reserve Bank of India (RBI) has long emphasised prompt reporting of unauthorised electronic transactions to limit further losses.

Fraudulent UPI transfer versus unauthorised bank debit

This distinction matters for refund expectations.

In some cases, a criminal accesses an account and initiates a transfer without the customer’s authorisation. In other cases, the customer is tricked into entering a UPI PIN and approving a transfer because the scammer claimed it was a refund, investment, deposit or security check.

These can have different legal and banking consequences. RBI’s liability framework for unauthorised electronic transactions considers factors including where the fault occurred and how soon the customer reported it. It does not mean every transfer induced by a scam automatically qualifies for zero liability.

RBI guidance says certain third-party unauthorised transaction cases reported promptly may attract zero or limited customer liability, while negligence such as sharing a password, PIN or OTP can affect liability until the customer reports it. The facts must be examined under applicable law, current rules and the bank’s policy.

Do not withhold details or falsely state that you never approved a payment if you actually entered a PIN because of deception. Explain what was represented to you and precisely what you did. The complete account may be important to both police and the bank.

UPI scam warning: you do not enter a PIN to receive money

The National Payments Corporation of India (NPCI) warns that scanning a QR code and entering a UPI PIN is a payment action, not a way to receive money. Fraudsters sometimes promise a cashback, refund, prize or deposit and ask the victim to scan a QR code or approve a collect request.

A common misleading story is: “To receive your refund, enter your UPI PIN.” If a genuine refund can be made into your account, the supposed sender should not need you to authorise a new payment to them.

If you authorised such a transaction and money was debited, report the fraud promptly through 1930, the bank and the portal. NPCI’s published FAQs note that an initiated UPI payment cannot simply be stopped by the sender after initiation; raising a fraud complaint is different from cancelling an uncompleted transfer.

Be careful about screenshots claiming payment was successful. Confirm actual credits through your own bank or payment app and do not release goods or send more money based only on an image from the other person.

What to do after a ‘digital arrest’ scam

A scammer may pretend to be a police officer, court official or regulatory authority and claim that your bank account is linked to a criminal case. They may order you to stay on a video call, keep the matter secret and transfer funds to a “verification” or “safe custody” account.

Indian government and CBI advisories have warned against this type of impersonation and emphasise that criminals use intimidation, fabricated legal papers and false allegations to extract money. Do not follow threats that you must remain on a video call or make a private transfer to avoid arrest.

End the interaction and report the transaction or attempted fraud through 1930 and the cybercrime portal. If you have been threatened physically or believe someone is coming to your location, contact local police or emergency services. Do not attempt to confront the fraudster.

If you sent money after such threats, explain the coercion and messages in your bank and cybercrime complaints. Save fake warrants, video-call identifiers and beneficiary details. Do not erase the chat merely because it is upsetting.

If you installed a screen-sharing or remote-access app

Fraudsters may ask you to install a remote-assistance application while pretending to be bank support, a courier company or a government helpdesk. This can expose a phone’s screen, notifications and banking activity or enable other device control.

End the call and remove the scammer’s access from a safe situation. If the device may be compromised, use a separate trusted device to call the bank and change critical passwords. Ask a qualified device-security professional or the official manufacturer support channel for help checking permissions and removing the unwanted software.

Do not resume banking on the same potentially compromised phone merely because you closed one app. Review what permissions were granted, whether account recovery details changed and whether any unknown UPI mandates or transfers were created.

If a SIM swap is suspected or your phone suddenly loses cellular service, contact the mobile carrier through verified channels. Your registered number may be important for recovering banking and UPI accounts.

If the money was sent to a fake investment or job offer

Some scams persuade victims to send several smaller payments before demanding a much larger amount to release a supposed profit, salary, security deposit or withdrawal. The platform may display a fake balance that was never real money in an account.

Stop sending funds immediately. Do not pay a final tax, processing charge or “anti-money-laundering verification fee” demanded by the same platform to release your proceeds. A screenshot of a large trading balance is not proof that the money exists.

Report each debit with transaction references, the fake platform name, website, linked bank accounts and the messages promising returns or employment. Tell your bank whether any card or UPI credentials were entered into the fake site.

A second scam may follow: a stranger offers to recover the lost money for an advance fee. Treat this as another suspicious approach and verify any claim directly through police or the bank.

What if the scammer is still calling you?

End the conversation and preserve the phone number, user ID and messages. Do not negotiate or send personal documents, passwords or another OTP. Scammers may pressure victims to stay connected to prevent them from contacting family or a bank.

If someone claims to be from 1930, the RBI, police, a bank or a payment provider, verify the contact through an official website or the complaint channel you already used. Do not click new links sent unexpectedly and do not install a “refund processing” app.

For a victim who is frightened or uncertain, asking a trusted relative to help organise official calls and paperwork can be useful. That helper should not take over accounts in a way that creates additional security risks.

Can RBI help if the bank does not resolve the complaint?

The Reserve Bank – Integrated Ombudsman Scheme, 2026 took effect on 1 July 2026, replacing the 2021 scheme for new complaints. It provides a cost-free grievance redress mechanism for eligible service deficiencies involving regulated entities.

The customer must first complain to the bank or other relevant regulated entity. Under the 2026 scheme, an Ombudsman complaint may be made if the entity has not replied within 30 days—or a longer applicable RBI, NPCI or card-network timeline—or if the customer is dissatisfied with its response. The 2026 scheme also sets a 90-day period for filing after the applicable trigger or last communication, subject to its exact conditions.

Use the official RBI Complaint Management System and the current 2026 rules. Do not rely on older articles giving the 2021 scheme’s previous filing deadlines.

The Ombudsman examines eligible service-related grievances; it is not a substitute for an immediate 1930 report, does not run the police investigation and does not guarantee reversal of a deliberately authorised fraudulent payment. Preserve your first complaint and supporting records in case escalation becomes necessary.

The first 24 hours: practical follow-up

After filing the emergency reports and securing the account, review whether additional bank accounts, payment cards, UPI IDs, wallets or online merchants were linked to the compromised device or service. Confirm that pending payment requests and auto-payment mandates are reviewed through the legitimate provider.

Keep an incident timeline: what the scammer said, how the transfer was authorised, when money left, when the bank was notified, when 1930 was contacted and any subsequent instructions. A clear factual timeline is more useful than sending multiple incomplete messages to different departments.

Monitor the registered phone and email for responses from official police, the portal and the bank. Do not publish the case ID, identity documents or full account details in an open group hoping that somebody will accelerate recovery.

If the bank refuses to explain its fraud process, ask for its written grievance escalation path and the reason for any decision. Follow the updated RBI 2026 scheme when its eligibility and time requirements are met.

Children, students, older adults and other vulnerable victims

A teenager may lose money to a gaming, scholarship, part-time job or fake online store scam. Help them stop the interaction, report it and preserve evidence. Shaming or punishing them immediately can make it harder to find all the transactions or communications that investigators need.

Older adults may be targeted with pension, medical, courier, police or “digital arrest” impersonation stories. A family member can support official reporting, device security and follow-up without broadcasting private banking data. A person who needs language or accessibility support may need assistance using the complaint portal.

If a student or employee used a work or school-managed phone, notify the relevant IT team about possible credential or device compromise. The organisation may need to protect additional accounts. Keep personal banking reports separate from workplace incident handling while preserving the necessary facts.

Three common situations and the correct response

A QR-code refund scam caused a UPI debit

Call 1930, notify the bank and payment app, report the transaction using its UPI reference and complete the portal complaint. Explain that you entered the PIN because the other person claimed it was needed to receive money. Do not send another transaction to “reverse” the first.

Your phone was controlled through a remote-help app

Disconnect the attacker’s access, contact the bank using a separate trusted device, secure credentials and report all affected transfers. Seek help checking the device and verify that the phone number, recovery settings and payment mandates have not been altered.

You sent repeated payments to a fake investment website

Stop immediately. Record every payment, the website, alleged platform balance, beneficiary details and messages. Report to 1930, cybercrime.gov.in and each relevant bank. Do not pay the platform’s supposed withdrawal tax or a third-party recovery fee.

Mistakes that make a financial scam worse

Do not wait a day before informing the bank and 1930.
Do not assume calling 1930 automatically finishes every portal reporting requirement.
Do not hide that you entered a UPI PIN if that is what happened.
Do not assume an authorised but deceptive transfer has the same refund treatment as an unauthorised debit.
Do not scan a QR code and enter a PIN to receive money.
Do not send another payment to unlock a refund.
Do not trust a caller claiming to be a police officer without verification.
Do not install unknown remote-access apps for customer support.
Do not post complete account numbers, OTPs or identification documents online.
Do not rely on outdated RBI Ombudsman 2021 complaint deadlines for a new 2026 dispute.

Before another scam: ten controls that help

Save the official 1930 cyber financial fraud helpline and cybercrime.gov.in.
Save your bank’s genuine fraud number independently from its official app or card.
Enable instant payment notifications and review unexpected transfers promptly.
Keep UPI PIN, banking PIN, OTP and passwords secret.
Remember that entering a UPI PIN authorises an action; it is not required simply to receive money.
Avoid payment links, QR codes and investment portals sent by unknown people.
Use a screen lock and device security updates and review app permissions.
Set appropriate transaction limits and account safeguards where your bank provides them.
Agree on a trusted person who can help make emergency calls and organise records.
Learn the actual bank, cybercrime portal and RBI 2026 grievance paths before they are urgently needed.

Frequently asked questions

What number should I call when an online banking scam takes money in India?

Call 1930 immediately for the national cyber financial fraud reporting helpline, and contact your bank through an independently verified official channel. File the required complaint at cybercrime.gov.in.

Can 1930 automatically refund my money?

No. It supports rapid reporting and coordination with authorities and banks; any freezing or return of funds depends on the facts and lawful processes. Recovery is not guaranteed.

Is reporting to the bank enough?

Notify the bank urgently, but also use the cybercrime reporting system. A bank grievance and a cybercrime complaint serve different purposes.

Can I get money back after approving a UPI transfer?

Possibly in some cases, but not automatically. A payment induced through deception and an unauthorised transfer may be assessed differently. Provide accurate facts and use the bank and official police process.

Must I enter a UPI PIN to receive money?

No. NPCI warns that scanning a QR code and entering a UPI PIN is a payment action, not a requirement to receive a refund or credit.

What is the official government cybercrime website?

Use https://cybercrime.gov.in. Avoid imitation sites or links sent by strangers offering refunds.

Which RBI Ombudsman Scheme applies to new complaints in November 2026?

The Reserve Bank – Integrated Ombudsman Scheme, 2026, effective 1 July 2026, subject to its requirements and eligible regulated entities. Use cms.rbi.org.in.

Should I contact the police if somebody threatens me with a ‘digital arrest’?

Report impersonation and threats through cybercrime.gov.in and local police as appropriate. Do not remain on a coercive call or transfer money to a supposed police safe account.

Remember the next move

Stop contact → call 1930 → notify the bank → report at cybercrime.gov.in → secure accounts and devices → preserve transaction IDs → follow up through the official process. Never pay a scammer to recover stolen money.

Official Indian sources

Independent Indian public-information guide. Reviewed 6 November 2026. Bank liability, investigations, complaint time limits and recovery depend on applicable current rules and case-specific facts.