Online Payment Fraud Recovery in India

If you just lost money to an online payment scam in India, the next 3 working days decide whether your bank must refund you. The legal framework favours the victim, but only if you follow a specific written sequence. This guide walks through that sequence in the order that actually works.

Time is the single biggest factor in fraud recovery. The RBI customer-liability circular ties your refund right to how fast you reported, in three buckets:

1. Within 3 working days of receiving the bank's transaction alert: zero customer liability if you were not part of the fraud and did not share OTP or password.
2. Within 4 to 7 working days: limited liability up to ₹5,000 / ₹10,000 / ₹25,000 depending on account type (BSBDA / regular savings / current account).
3. Beyond 7 working days: the bank's policy decides; refund becomes harder.

Within the first 24 hours, you also have the cybercrime side: a complaint at NCRP or a call to 1930 lets the cyber cell push freeze instructions to the recipient bank before the money is moved out. Once the money is laundered through a chain of mule accounts, recovery becomes far harder.

Report inside 24 hours to NCRP, write to your bank within 3 working days, and keep evidence of both timestamps.

The Indian Cybercrime Coordination Centre (I4C) runs the 1930 helpline on top of the National Cybercrime Reporting Portal. When you call, the operator opens a “ticket” linked to your bank account and pushes a near-real-time hold request to the recipient bank's nodal officer.

What to keep ready before calling:

• Your phone number (the one linked to the account).
• The exact transaction amount and time.
• UPI transaction ID (UTR) or RRN.
• Recipient UPI ID, account number, or merchant name.
• Your bank account number (last 4 digits at minimum).
• SMS / email alerts from the bank.

If 1930 is busy, file the complaint directly at cybercrime.gov.in - the portal opens a ticket in the same I4C system. Save the acknowledgement number; that number is your proof of reporting time.

Phone calls do not count for the 3-working-day rule. The RBI customer-liability circular protects you only if your report is “in writing”, and the burden of proving you were negligent falls on the bank, not you. Email or written letter both qualify.

Send your email to:

• Your branch's official email (printed on your passbook).
• The bank's grievance redressal officer (listed on the bank's website).
• The bank's nodal officer for fraud (listed on the RBI Ombudsman portal).
• CC yourself.

1. Reverse the disputed amount to my account on a "shadow credit" or provisional basis as required by the circular.
2. Issue a written acknowledgement with a complaint reference number.
3. Block my debit card and reset internet banking and UPI credentials.
4. Coordinate with the recipient bank's nodal officer to freeze the receiving account.
5. Provide me with the dispute resolution timeline.

Send this from the email registered on your bank account. Do not delete the sent copy.

For amounts above ₹2 lakh, an FIR is mandatory under most state cybercrime SOPs. For smaller amounts, an “NCRP complaint” is treated as equivalent to an FIR for many banking purposes, but a proper FIR is still useful for chargebacks and ombudsman cases.

You can file:

• Online via NCRP at cybercrime.gov.in - the portal forwards the complaint to your district cybercrime cell and many states auto-convert it to an FIR for losses above their threshold.
• At a police station in person - any police station, not just a “cyber” station, must accept your complaint. Section 173 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023 (which replaced CrPC 154) requires registration of an FIR for a cognisable offence, and the BNSS gives statutory backing to the “zero FIR” so jurisdiction cannot be used as a ground to refuse. A station that refuses can be approached at the SP / DCP level via written complaint.
• e-FIR in states that allow it (Delhi, Haryana, UP, MP, Maharashtra and others) - online via the state police portal.

Cite the right offences in your FIR:

• Information Technology Act, 2000 Section 66C - identity theft (using your password / OTP).
• Information Technology Act, 2000 Section 66D - cheating by personation using a computer resource.
• Bharatiya Nyaya Sanhita (BNS), 2023 Section 318 - cheating (replaces IPC 420).
• BNS, 2023 Section 319 - cheating by personation.
• BNS, 2023 Section 336 - forgery of an electronic record.
• If you were threatened, BNS, 2023 Section 308 - extortion.

The FIR copy is required for the bank's chargeback to a credit-card network and is useful for a District Commission consumer complaint if the bank stalls.

Most fraud refunds fail not because the law is weak but because the victim deleted the SMSes during cleanup. Within 30 minutes of the fraud, do the following:

If you reset your phone, change your SIM, or wipe the messaging app, you may lose admissible evidence. Save first, clean later.

If the loss was on a credit or debit card, your bank can raise a “chargeback” with the Visa, Mastercard, RuPay, or Amex network. Chargebacks have strict timelines under each network's rulebook:

• Visa, Mastercard: typically 120 days from transaction date for “fraud / unauthorised” reason code.
• RuPay: 120 days, varies by reason code.
• Amex: 60 to 120 days.

Ask your bank in writing to “raise a chargeback under the relevant fraud reason code”. Ask for the chargeback reference number and expected timeline.

For UPI, the dispute resolution mechanism is operated by NPCI under the UPI dispute resolution framework. The first port of call is your bank or payment app's grievance officer (GPay, PhonePe, Paytm, BHIM all have one). If the issue is not resolved in 30 days, NPCI's UDIR (UPI Dispute Resolution) and the RBI Ombudsman take over. Cite the NPCI dispute mechanism in your bank email.

If your bank does not refund within 30 days of your written complaint, file at cms.rbi.org.in under the Reserve Bank - Integrated Ombudsman Scheme, 2026 (RB-IOS 2026), in force from 1 July 2026. The Ombudsman is free, online, and binding on the bank. Under RB-IOS 2026 the Ombudsman can award compensation up to ₹30 lakh for consequential loss arising out of the grievance, plus up to ₹3 lakh for mental harassment, time, and expense (the “One Nation One Ombudsman” framework; cost-free to the customer).

You need:

• The bank's written reply (or proof you waited 30 days without a satisfactory reply).
• Your original written complaint to the bank.
• NCRP complaint reference and FIR.
• Bank statements and SMS evidence.

The Ombudsman process is largely paper-based, with hearings only when needed.

If the recipient handle ends in @paytm, @ybl, @okaxis, @ibl, or another payment-app suffix, NPCI's mule-account framework allows the receiving payment service provider (PSP) to freeze and reverse if reported within the dispute window. Mention specifically in your NCRP complaint and bank email: “Recipient UPI handle [handle] - request immediate beneficiary freeze under NPCI mule-account guidelines”.

If your card was used on an offshore website (often a gaming, dating, or crypto site as cover), this is a “card not present” fraud. RBI's Additional Factor of Authentication (AFA) framework requires a second factor for card transactions processed in India. If your card was charged without OTP or 3D Secure where AFA was mandated, that is a clean liability shift to the bank. Cite the RBI AFA framework in your email.

If money was withdrawn from your account using an Aadhaar-enabled Payment System (AePS) device at a “BC” point, you have a separate path. The biometric was likely cloned. See our dedicated guide: AePS / Aadhaar-enabled payment fraud recovery. The 3-working-day RBI rule still applies, plus you can lock your Aadhaar biometrics on UIDAI's portal.

Some frauds target the corporate-salary-account window of large IT services and BPO employees, where salary credits arrive on a fixed day. The fraud often takes the form of a fake “HR” email asking you to “verify” your account. The recovery sequence is the same as above, plus your employer's CISO and the bank's corporate-banking team get looped in.

A subset of frauds happens because your SIM was cloned or “swapped” by a fraudster who tricked the telecom company. If your phone suddenly shows “no signal” for hours and then payments leave your account, this is a SIM-swap scam. Recovery steps:

• Call your telecom helpline (use a different phone) and demand SIM block + reactivation log.
• File a complaint at trai.gov.in for the unauthorised SIM swap.
• Add the telecom company as a respondent in your bank case - the SIM was the entry vector.
• Lock your UIDAI Aadhaar to prevent further OTP-based bypass.

• UPI “auto-pay” / collect request - someone sends you a “request” you accidentally approved. Cite IT Act 66D + BNS 318 + the RBI customer-liability circular.
• Phishing email or fake bank SMS - cite IT Act 66 + 66C + BNS 318 + 319.
• Fake “AnyDesk” / customer-support call - cite IT Act 66D + BNS 318.
• “Job offer” with deposit - cite BNS 318 + 319 (cheating, personation). See fake job and executive course scams and fake LinkedIn recruiter scam.
• Loan-app extortion / fake EMI - cite BNS 308 (extortion) + 351 (criminal intimidation). See loan app harassment in India.
• Edtech “course” charge that won't refund - this is a service deficiency, not pure cyber fraud. See edtech refund complaint in India.
• AePS / Aadhaar-enabled withdrawal at BC point - see AePS Aadhaar fraud recovery.
• Crypto wallet drain / trading scam - cite BNS 318 + 319 + 336. RBI does not regulate crypto, but the IT Act and BNS apply to the cheating itself.

1. Hour 0-1: Call 1930. File at cybercrime.gov.in. Lock UPI, debit card, internet banking. Take screenshots.
2. Hour 1-3: Send written email to bank. Lock SIM if SIM-swap suspected. Save evidence to cloud.
3. Hour 3-24: Visit police station, file FIR. Lock Aadhaar at UIDAI.
4. Day 2-3: Bank should issue acknowledgement and shadow credit. If not, send a follow-up.
5. Day 4-10: Bank should reverse under the RBI customer-liability circular (zero-liability path).
6. Day 10-30: If bank stalls, write a final reminder. Prepare RBI Ombudsman papers.
7. Day 31+: File at cms.rbi.org.in. Send copy to your bank with “Ombudsman complaint filed” in the subject.
8. Day 90+: If still no relief, file at the e-Daakhil consumer commission.

This is the bank's standard first defence. The legal position is more nuanced. The RBI customer-liability circular puts the burden of proving customer negligence on the bank, not you. Sharing OTP under social-engineering pressure (impersonation of bank / RBI / police) has been treated by multiple Ombudsman orders as “fraud-induced sharing”, not negligence. Your reply email to the bank should specifically rebut: “I was induced by impersonation of [bank / RBI / police / family]; the disclosure was extracted by deception, which under the customer-liability circular and consistent Ombudsman orders is fraud-induced and not negligence on my part.”

The 3-working-day rule is the customer-protection lever inside the RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18 dated 6 July 2017. If you report an unauthorised electronic transaction to your bank in writing within 3 working days of the bank's transaction alert, and you did not contribute to the fraud through gross negligence (such as writing your PIN on the card), your liability is zero and the bank must credit the disputed amount within 10 working days. The burden of proving that you were grossly negligent shifts to the bank.

Both. Calling 1930 opens an immediate ticket and triggers a freeze attempt at the recipient bank, but the call alone does not create a permanent paper-trail you can attach to the bank email or Ombudsman case. Filing at cybercrime.gov.in immediately afterwards generates a written NCRP acknowledgement number, which is the document you actually need. Do both: call 1930 first for speed, file at cybercrime.gov.in within the same hour for paper.

Yes. Section 173 of the BNSS, 2023 (which replaced CrPC 154) makes it mandatory for any police station to register an FIR for a cognisable offence, regardless of jurisdiction - the BNSS gives statutory backing to the “zero FIR”. If a station refuses, write to the SP / DCP and copy the State Human Rights Commission and the State CID's cyber wing. The NCRP filing is itself treated as an FIR-equivalent in many states for losses above their threshold.

Harder, but not impossible. Voluntary transfers under deception (someone claiming to be a relative in trouble, an HR department, a delivery courier) can still constitute “cheating by personation” under BNS, 2023 Sections 318 and 319. The bank may argue this falls outside the RBI customer-liability circular's “unauthorised” definition. But you can still attempt: (a) NCRP freeze if the recipient account is still active, (b) chargeback if it was on a card, © civil suit for recovery, (d) Ombudsman complaint citing inadequate fraud monitoring. Speed matters - the earlier you act, the better the odds.

The RBI circular at paragraph 8 envisages a credit (often called a “shadow credit”) of the disputed amount within 10 working days of the customer's written report, while the bank investigates. Many banks delay this, especially if they want to argue customer negligence. A clear written email citing the specific circular paragraph and copying the nodal officer pushes most banks to give the credit. If they still refuse, that refusal itself becomes a deficiency under the Consumer Protection Act, 2019 and a separate ground in your RBI Ombudsman complaint.

Generally, no - not immediately. Closing the account ends the dispute trail with that bank and complicates the refund. Instead, lock everything that can be locked: debit card, internet banking, UPI, mobile banking. Open a fresh, clean account at another bank for new transactions and salary credits, but keep the compromised account open with zero balance and active monitoring until the dispute closes. Move SIPs and auto-debits to the new account in writing. Once the refund is credited and the dispute fully closes, you can reassess whether to close the old account.

The Reserve Bank - Integrated Ombudsman Scheme, 2026 (RB-IOS 2026), in force from 1 July 2026, is a free, online dispute-resolution mechanism for banking, NBFC, and payment-system grievances (the “One Nation One Ombudsman” framework). You file at cms.rbi.org.in after waiting 30 days from your written complaint to the bank. The Ombudsman can award compensation up to ₹30 lakh for consequential loss, plus up to ₹3 lakh for mental harassment, time, and expense. The process is faster than a civil suit, paper-based, and has no lawyer requirement. For most online payment fraud cases, the Ombudsman is the correct forum after the bank refuses.

Yes. Banking is a “service” under Section 2(42) of the Consumer Protection Act, 2019, and a wrongful debit or refusal to refund is a “deficiency in service” under Section 2(11). You can file at the e-Daakhil portal at the District Commission for amounts up to ₹50 lakh, the State Commission for amounts between ₹50 lakh and ₹2 crore, and the National Commission above ₹2 crore (these pecuniary limits were set by the Consumer Protection (Jurisdiction of the District/State/National Commission) Rules, 2021). Many victims combine the RBI Ombudsman path with a parallel consumer complaint. See our how to file a consumer court case guide.

International cyber fraud is harder but not hopeless. The Mutual Legal Assistance Treaty (MLAT) network and Interpol Red Notices apply for large amounts. For a citizen, the practical route is: (a) NCRP forwards to I4C, which liaises with international agencies; (b) FIR with the cyber cell; © bank chargeback if it was a card transaction (chargebacks work even for offshore merchants); (d) RBI Ombudsman against your bank for any failure of monitoring. Money routed through Indian mule accounts is more recoverable; money already converted to crypto and moved offshore is mostly not.

No. The “recovery agent” market is dominated by the same fraud networks. Real recovery is free - 1930, NCRP, your bank, RBI Ombudsman, and the consumer commission. Anyone asking for a “registration fee”, “GST”, “release charge”, “tax clearance”, or “advance commission” is a recovery scammer. Some pose as “ex-cyber officers”, “law firms”, or “specialised recovery experts” with fake testimonial videos. They will eventually ask for your remaining bank credentials. The single most reliable signal: if they want money upfront, they are scamming you.

• RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18 dated 6 July 2017 - Limiting Liability of Customers in Unauthorised Electronic Banking Transactions - rbi.org.in
• Reserve Bank - Integrated Ombudsman Scheme, 2026 (RB-IOS 2026) - file at cms.rbi.org.in
• National Cybercrime Reporting Portal - cybercrime.gov.in | helpline 1930
• NPCI UPI Dispute Resolution - npci.org.in
• Information Technology Act, 2000 (Sections 66, 66C, 66D) - meity.gov.in
• Bharatiya Nyaya Sanhita, 2023 (Sections 308, 318, 319, 336, 351) - indiacode.nic.in
• Bharatiya Nagarik Suraksha Sanhita, 2023 (Section 173) - indiacode.nic.in
• Consumer Protection Act, 2019 - consumeraffairs.nic.in
• UIDAI Aadhaar lock / unlock - uidai.gov.in
• TRAI complaint portal - trai.gov.in

• Fake job and executive course scams in India - parent article in this series
• Edtech refund complaint in India
• AePS / Aadhaar-enabled payment fraud recovery
• Loan app harassment and EMI extortion in India
• Fake LinkedIn recruiter scam in India
• Fake university and degree scam in India
• Coaching institute refund rights in India
• How to file a consumer court case in India
• How to file a consumer complaint at NCDRC

Last reviewed: 17 July 2026.

• UPI Fraud: What To Do Immediately, How To Recover Money (India Guide)