A call from “the bank”, a fake courier link, a screen-sharing app, a too-good investment group on WhatsApp: online fraud in Mumbai takes many forms, and the money leaves your account in seconds. What you do in the first hour often decides whether it can be stopped. This guide gives the steps in order, and explains your rights against the bank.
The first hour
- Call 1930, the national cyber fraud helpline. Reporting quickly allows the police and banks to try to freeze the money in the fraudster’s account before it is withdrawn.
- Inform your bank immediately through its 24-hour helpline, app, or SMS, and block the card, UPI or net banking. Note the time and the complaint or reference number.
- File online at cybercrime.gov.in under financial fraud, with transaction IDs, the fraudster’s UPI ID, account or phone number, and screenshots. Keep the acknowledgement number.
- Do not delete messages, call logs, links or apps involved. Uninstall any screen-sharing or remote-access app only after taking screenshots.
- Change passwords and UPI PINs from a different, safe device.
Your rights against the bank: the RBI liability rule (2017 framework, being replaced from 1 January 2027)
The Reserve Bank of India’s directions on unauthorised electronic banking transactions (first issued in July 2017) decide how much of the loss you bear:
| Situation | When you report | Your liability |
|---|---|---|
| Fraud due to the bank’s negligence or deficiency | Any time | Zero |
| Third-party breach (neither you nor the bank at fault) | Within 3 working days of the bank’s alert | Zero |
| Third-party breach | 4 to 7 working days | Limited, to a capped amount depending on account type |
| Third-party breach | After 7 working days | As per the bank’s board-approved policy |
| Loss due to your own negligence, such as sharing your OTP or PIN | Before reporting | You bear the loss until you report; the bank bears losses after |
- On being notified, the bank must give a shadow credit of the disputed amount within 10 working days, without waiting for any insurance claim.
- The burden of proving that the customer is liable lies on the bank.
Note that where you yourself approved a payment after being tricked (for example, entering your PIN on a “collect request”), banks often treat it as an authorised transaction. That is why the police complaint and the freeze request matter even more in such cases.
RBI has issued revised directions on customer liability in fraudulent electronic banking transactions, effective 1 January 2027. They are meant to cover payments approved under deception and to set shorter reporting windows. Until then, the 2017 framework above applies. Check the RBI website for the current position, and report any fraud immediately.
Getting frozen money back
If the money was frozen in the receiving account, it is usually released to the victim through an order of the Magistrate on an application, supported by the FIR or cyber complaint, bank statements and proof of the transaction. This step often needs a formal application, and many victims get stuck here.
If the bank refuses to refund
- Write to the bank’s Grievance Redressal Officer or Principal Nodal Officer, citing the RBI directions and the date you reported.
- If there is no reply in 30 days, or the reply is unsatisfactory, complain to the RBI Ombudsman at cms.rbi.org.in. The service is free.
- For a larger loss, a consumer complaint for deficiency in service is also possible. See filing a consumer complaint.
Frequently asked questions
Is it worth complaining if the amount is small?
Yes. Fraudsters move money through many accounts; a quick report helps freeze it and helps police trace the network.
The police station says to file online only. Is that right?
The online portal is the fastest route for the freeze. For larger frauds, an FIR at the police station or cyber police station should also be registered. See if the police refuse an FIR.
Someone used my account details to take a loan. What now?
Report it to the lender and the police at once, ask the credit bureau to mark the account as disputed, and keep copies of every complaint.
See also: threats to leak private photos and police complaint drafting.
See also: Bank account frozen by cyber police: how to get it released.
Consultations are by appointment. To fix a time, telephone +91 99301 50560 or send a message on WhatsApp.
This guide describes general law and RBI directions as understood in October 2026. It is not legal advice; act quickly and confirm current procedures with your bank.