Lucky Draw Scam Recovery Guide India (2026)

Priya from Nagpur received an SMS in March 2026 claiming she won ₹25 lakh in a “Flipkart Anniversary Lucky Draw.” She paid ₹48,000 in “processing fees” across four UPI transactions before realising no such contest existed. Lottery and lucky draw scams defraud large numbers of Indians every year, and the single biggest factor in recovering money is speed — acting in the first hours, before the money is withdrawn, using the steps documented here.

Citizen Crisis Response Network
If you or a family member has lost money to a lucky draw scam, call 1930 (National Cyber Crime Helpline) immediately so that the suspect account can be put on hold, then file an online complaint through https://cybercrime.gov.in. The earlier you report, the better the chance of recovery — recovery becomes much harder once the money has been withdrawn from the fraudster's account.

To try to recover money lost in a lucky draw scam: 1. Call 1930 as soon as possible so the suspect account can be flagged and put on hold. 2. File an online complaint at cybercrime.gov.in citing the cheating provisions of the Bharatiya Nyaya Sanhita 2023 (BNS §318) and IT Act 2000 §66D. 3. Preserve all SMS, emails, screenshots and transaction IDs. 4. File the NCRP complaint with the merchant ID / UPI handle. 5. Send a written demand to the payment gateway / bank for a chargeback. 6. File a consumer complaint under the Consumer Protection Act 2019 if there is deficiency of service. 7. Pursue the FIR and, if the accused is traced and convicted, ask the criminal court for restitution.

• How lucky draw scams work in 2026
• Legal framework: BNS 2023 and IT Act 2000
• Step-by-step recovery protocol (the first hours)
• Filing FIR and NCRP complaint
• Payment gateway chargeback procedure
• Consumer court remedies under CPA 2019
• Case law: Restitution and compensation
• Red flags and prevention checklist
• Myth vs reality table
• Sample legal notice and FIR text
• Frequently asked questions
• Related resources and helplines

Fake lottery and lucky draw scams remain one of the most common categories of online financial fraud reported in India. Fraudsters impersonate well-known e-commerce platforms, telecom companies, or government schemes. The victim receives an SMS, WhatsApp message, or email claiming they have won a prize ranging from a few lakh rupees to ₹1 crore.

The message contains a “claim code” and a customer-care number. When the victim calls, a caller (often using a spoofed caller ID showing “Flipkart” or “Amazon”) congratulates them and explains that to release the prize, they must pay GST, processing fees, courier charges, or “legal documentation fees.” These fees are paid through UPI, NEFT, or cryptocurrency wallets.

Once the victim pays, the fraudster either vanishes or demands additional fees—“customs duty,” “RBI clearance,” or “TDS advance”—creating a cascading loss. In Priya's case, she paid in instalments over three days, each time assured that the “prize money transfer is pending final clearance.”

Warning — Legitimate lucky draws never ask winners to pay upfront fees. Any request for advance payment—regardless of the reason—is a scam. No GST, no processing fee, no courier charge is deducted from your prize; the sponsor absorbs these costs.

Lucky draw scams are prosecuted under multiple statutes. Note that since 1 July 2024 the Bharatiya Nyaya Sanhita 2023 (BNS) replaced the Indian Penal Code, the Bharatiya Nagarik Suraksha Sanhita 2023 (BNSS) replaced the Code of Criminal Procedure, and the Bharatiya Sakshya Adhiniyam 2023 replaced the Indian Evidence Act.

Bharatiya Nyaya Sanhita 2023 (BNS):

• Section 318 (Cheating): Cheating is deceiving a person and dishonestly inducing them to deliver property. Under §318(4) — the successor to IPC §420 — cheating and thereby dishonestly inducing the person to deliver property is punishable with imprisonment up to seven years and fine. This is the core charge in a lucky draw scam, where the victim is induced to part with money. A false promise of fictitious winnings is a form of cheating under this section.
• Section 319 (Cheating by personation): If cheating is committed by pretending to be some other person (such as impersonating a company or its representative), the punishment may extend to five years, or fine, or both.

Information Technology Act 2000:

• Section 66D (Punishment for cheating by personation using a communication device or computer resource): Imprisonment up to three years and fine up to ₹1 lakh.

Account freezing / lien (1930 + NCRP / I4C):

• When you report to 1930 and file on the National Cyber Crime Reporting Portal (https://cybercrime.gov.in), the complaint is routed through the Indian Cyber Crime Coordination Centre (I4C) and the banking system so that the suspect account can be flagged and a hold/lien placed on the disputed funds. This is an administrative process operated through banks' obligations and the NCRP/I4C system, and it works fastest when you report immediately.

Consumer Protection Act 2019 (CPA):

• Section 35: Sets out the manner in which a consumer complaint is filed before the District Consumer Disputes Redressal Commission. You can pursue a complaint against a service provider (such as a bank or payment system operator) for deficiency in service where that is made out.

Prize regulation:

• The Prize Competitions Act, 1955 regulates prize competitions and licensing, and lotteries are otherwise governed by state lottery laws and the Lotteries (Regulation) Act, 1998. A “lucky draw” that demands an upfront fee is not a regulated competition at all — it is plain cheating, prosecuted under the BNS and IT Act provisions above.

Most citizens miss this — Filing an FIR alone is often not enough to recover money fast. You must also file a complaint on the National Cyber Crime Reporting Portal (https://cybercrime.gov.in) and call 1930 so that the bank can be asked to place a hold on the fraudster's account. Without the NCRP complaint, there is no fast route to freeze the funds.

Immediate action (as soon as you realise):

1. Call **1930** (National Cyber Crime Helpline). Provide transaction ID, beneficiary account number / UPI ID, date-time, and amount.
2. Do NOT confront the fraudster or make additional payments hoping to recover earlier amounts.
3. Screenshot all messages, emails, call logs showing the fraudster's number.

Within a few hours:

4. File the online complaint at **https://cybercrime.gov.in**. Upload all evidence. Mention BNS 2023 §318, §319, and IT Act 2000 §66D.
5. Visit your bank branch with the NCRP acknowledgement number and request a "Fraud Transaction Report." Banks are expected to assist under RBI's customer-protection and cyber-security framework.

Within the first day:

6. File an FIR at the local police station (cyber cell) or online via the state police portal. Obtain the FIR number.
7. Send a written complaint to the payment gateway / UPI app (Paytm, PhonePe, Google Pay, Razorpay) citing the FIR number and requesting a chargeback / dispute resolution.

Within the first few days:

8. Send a legal notice (see sample below) to the payment gateway and, where relevant, the telecom operator whose SIM was used.
9. Report the mobile number used by the fraudster to the telecom operator and to the Department of Telecommunications' Sanchar Saathi portal (https://sancharsaathi.gov.in), and to TRAI for SMS / DND violations (https://www.trai.gov.in).

Do this immediately — Even if you paid via cryptocurrency or an international payment app, still file the NCRP complaint and call 1930. The Indian Cyber Crime Coordination Centre (I4C) coordinates with banks, exchanges and other agencies, and the disputed funds can sometimes still be traced — but only if you report quickly.

FIR content (cybercrime station or local police station):

To,
The Station House Officer,
Cyber Crime Police Station, [District]

Subject: FIR under BNS 2023 Sections 318 and 319 and IT Act 2000 Section 66D

Sir / Madam,

I, [Your Name], son/daughter of [Parent Name], resident of [Full Address], Aadhaar [Last 4 digits], mobile [Your Number], wish to report the following cybercrime:

1. On [Date], I received an SMS from mobile number [Fraudster Number] claiming I won ₹[Amount] in "[Company Name] Lucky Draw."

2. The caller identified as "[Fake Name]" and instructed me to pay ₹[Amount] as "processing fee" to claim the prize.

3. I transferred ₹[Amount 1] on [Date 1] to UPI ID [ID 1], transaction ID [TXN 1]; ₹[Amount 2] on [Date 2] to account [Account Number], IFSC [Code], transaction ID [TXN 2].

4. After payment, the caller became unreachable. No prize was delivered. I discovered [Company Name] has no such contest on their official website.

5. I have filed NCRP complaint [Number] on [Date].

6. Enclosed: SMS screenshots, call recordings, bank statements, NCRP acknowledgement.

I request registration of FIR under BNS 2023 §318 and §319 and IT Act 2000 §66D, and initiation of investigation, including a request to the bank to place a hold on the beneficiary account.

Place: [City]
Date: [Date]
Signature: [Your Signature]

NCRP complaint (cybercrime.gov.in):

• Category: “Financial Fraud — Sub-Category: Fraud Call / Vishing.”
• Loss amount, transaction details, suspect mobile / account / UPI.
• Upload: SMS screenshot, payment receipt, call log screenshot.

After filing, you receive an acknowledgement number. The complaint is routed so that banks can be asked to place a hold on the suspect account; the speed of the actual freeze depends on how quickly you report and on the banks involved.

Citizen tip — If the local police station refuses to register the FIR (citing “jurisdiction” or “online fraud is not our area”), insist on a Zero FIR, which can be registered at any police station regardless of where the offence occurred and is then transferred to the jurisdictional station. The duty to register an FIR for a cognizable offence is set out in BNSS 2023 §173. Insist on a written refusal if registration is denied, then escalate to the Superintendent of Police (Cyber).

Payment gateways and UPI apps have dispute resolution mechanisms but short timelines:

UPI (Google Pay, PhonePe, Paytm):

• Raise an “Unauthorised / disputed transaction” complaint promptly via the app.
• Upload the FIR / NCRP copy in the dispute form.
• NPCI's UPI dispute redressal mechanism (and the RBI Ombudsman scheme if unresolved) governs how these disputes are handled.

Credit card / Debit card / Net banking:

• Call the bank's fraud helpline and request a chargeback / dispute under the applicable RBI customer-protection directions on unauthorised electronic transactions.
• Submit a written complaint with the FIR / NCRP number as soon as possible. Reporting an unauthorised electronic transaction promptly is important for limiting your liability under RBI's framework.

Legal basis for a claim:

• RBI's directions on limiting customer liability for unauthorised electronic banking transactions place obligations on banks where the customer reports promptly.
• The Consumer Protection Act 2019 allows a complaint for “deficiency in service” where a service provider fails in its duties.

If a bank or payment gateway wrongly refuses a legitimate dispute, you can escalate to the RBI Ombudsman (https://cms.rbi.org.in) and/or file a consumer complaint.

Trust signal — Recovery is realistic but not guaranteed, and it depends almost entirely on speed: if the funds are still sitting in the fraudster's account when you report, a hold can stop them; once withdrawn, recovery is much harder. Report to 1930 and cybercrime.gov.in at the earliest.

If your bank or payment gateway wrongly refuses a legitimate chargeback, or there is a clear deficiency in service, you can file a complaint under the Consumer Protection Act 2019:

Jurisdiction (pecuniary limits):

• Up to ₹50 lakh: District Consumer Disputes Redressal Commission.
• ₹50 lakh – ₹2 crore: State Consumer Disputes Redressal Commission.
• Above ₹2 crore: National Consumer Disputes Redressal Commission.

Possible opposite parties (where deficiency in service is made out):

• The bank or payment system operator, for deficiency in service.
• The telecom operator, where a SIM was issued without proper verification.

Relief that may be claimed:

• Refund of the amount lost (where the opposite party's deficiency caused or facilitated the loss).
• Compensation for mental agony.
• Litigation costs.

Note: A consumer complaint succeeds only where you can show a deficiency in service by the opposite party — for example a bank ignoring a timely fraud report. The mere fact that you were cheated by a third party does not automatically make the bank or gateway liable; the fraudster is the primary wrongdoer and the criminal case is the main route against them.

Sample prayer:

BEFORE THE DISTRICT CONSUMER DISPUTES REDRESSAL COMMISSION, [DISTRICT]

Complaint under Section 35 of the Consumer Protection Act, 2019

[Your Name], [Address] — Complainant

Versus

1. [Bank / Payment Gateway Name], [Registered Office Address]
2. [Telecom Operator Name], [Registered Office Address]
— Opposite Parties

Facts:

The Complainant paid ₹[Amount] on [Date] via UPI to [Fraudster UPI ID] believing they won a lucky draw. Despite FIR No. [Number] dated [Date] and NCRP complaint [Number] reported promptly, Opposite Party No. 1 failed to act on the disputed transaction.

Prayer:

1. Direct the Opposite Party to refund ₹[Amount] where its deficiency in service is established.
2. Award reasonable compensation for mental agony.
3. Award litigation costs.
4. Any other relief.

Place: [City]
Date: [Date]
Signature: [Your Signature]

Consumer complaints can usually be filed in person without a lawyer, and filing fees are modest. The Consumer Protection Act 2019 sets timelines for disposal, though actual timelines vary by commission and workload.

Courts and consumer commissions have, in appropriate cases, held banks and service providers liable where their own deficiency contributed to a fraud, and the criminal law provides for restitution to victims:

• Banks' duty in unauthorised-transaction cases: Under RBI's framework on limiting customer liability, where a customer reports an unauthorised electronic transaction promptly and is not at fault, the bank may be required to make the customer good. Consumer commissions have applied this in cyber-fraud disputes; outcomes turn on the specific facts and on how quickly the customer reported.

• Criminal restitution under the BNSS 2023: The trial court can order an offender to pay compensation to the victim under BNSS 2023 §395 (the successor to CrPC §357), and the victim compensation scheme operates under BNSS 2023 §396 (successor to CrPC §357A). If the accused is traced and convicted, the victim can seek compensation through the criminal court without filing a separate civil suit.

• RTI to trace the fraudster's KYC: On the question of obtaining bank records, Reserve Bank of India v. Jayantilal N. Mistry (2016) 3 SCC 525 is the leading Supreme Court authority holding that the RBI and banks are public authorities under the RTI Act and cannot routinely refuse disclosure by claiming a fiduciary relationship — useful background when you seek records through the RTI route or through the investigating officer.

Do this immediately — If the police trace the fraudster and the matter reaches trial, ask the criminal court to order restitution/compensation under BNSS 2023 §395 as part of the proceedings. You do not necessarily need a separate civil decree for this.

10 red flags of a fake lucky draw:

1. You did not enter any contest, yet you “won.”
2. SMS / email contains grammatical errors, generic greetings (“Dear Customer” instead of your name).
3. Sender ID is a random mobile number, not an official short code.
4. You're asked to pay fees before receiving the prize.
5. Caller insists on immediate payment, threatens the prize will be “forfeited” if you delay.
6. Payment must be made via UPI to a personal account, not a company account.
7. Caller refuses to provide written documentation or an official email.
8. The company's official website has no announcement about the contest.
9. Caller asks for OTP, Aadhaar number, or bank PIN.
10. The prize amount is suspiciously high for a contest you never entered.

Prevention protocol:

• Verify any contest on the company's official website or call their published customer-care number (not the number in the SMS).
• Register for TRAI's DND (Do Not Disturb) service to cut down spam calls/SMS.
• Never share OTP, CVV, or card details over a call or email.
• Verify the merchant / UPI ID before paying.
• Report suspicious SMS and calls to your telecom operator and to the Sanchar Saathi portal (https://sancharsaathi.gov.in).

Trust signal — Before responding to any “you have won” message, you can check the suspect mobile number, UPI ID, account number or website against the Suspect Repository / “Report & Check Suspect” facility on the National Cyber Crime Reporting Portal (https://cybercrime.gov.in), which lets citizens check identifiers for links to reported cyber criminals.

Legal notice to payment gateway / bank:

LEGAL NOTICE

To:
The Chief Grievance Officer
[Bank / Payment Gateway Name]
[Registered Office Address]

Dear Sir / Madam,

Subject: Demand for refund of ₹[Amount] in respect of a fraudulent transaction — Legal notice

My client, [Your Name], [Address], on [Date] transferred ₹[Amount] via UPI ID [ID] on your platform, to fraudster UPI ID [Fraudster ID], believing they won a lucky draw prize.

The transaction was reported promptly. FIR No. [Number] dated [Date] has been registered at [Police Station], and NCRP complaint [Number] is pending.

My client demands:

1. Refund of ₹[Amount] / restoration of the disputed amount, where your deficiency in service is established, within 15 days of this notice.
2. Compensation for the resulting hardship.
3. Failing which, a complaint under the Consumer Protection Act 2019 will be filed before the District Consumer Commission.

This notice is issued without prejudice to my client's rights and contentions.

Date: [Date]
Place: [City]

[Your Name, if self-represented]
OR
Advocate for Complainant
[Advocate's Name & Enrolment Number]

RTI application to trace the fraudster's KYC:

To,
The Public Information Officer
[Name of Bank where fraudster's account is held]
[Branch Address]

Subject: RTI application under Section 6(1) of RTI Act 2005

I, [Your Name], [Address], request the following information under the RTI Act 2005:

1. Confirmation of action taken on account number [Account Number], IFSC [Code], in connection with NCRP complaint [Number] dated [Date].

2. Whether the account was placed on hold / frozen pursuant to the cybercrime complaint, and if not, the reason.

3. The status of any lien marked on the disputed funds.

This information is needed to pursue criminal case FIR No. [Number] and recovery proceedings.

IPO / DD No. [Number] for ₹10 enclosed towards the application fee.

Date: [Date]
Signature: [Your Signature]
Mobile: [Your Number]
Email: [Your Email]

Banks typically respond to RTI applications within 30 days. Note that a bank will usually refuse to hand over a third party's personal KYC documents (name, Aadhaar, PAN) directly to you, citing the personal-information exemption under RTI Act §8(1)(j); that material is normally obtained by the investigating officer. You can still use RTI to ask about the action taken on your complaint and the status of any hold on the account, and you can escalate a wrongful refusal to the First Appellate Authority under RTI Act 2005 §19. The leading authority that the RBI and banks are public authorities under the RTI Act is Reserve Bank of India v. Jayantilal N. Mistry (2016) 3 SCC 525.

For drafting RTI applications, use the RTI drafter tool at https://righttoinformation.wiki/tools/rti-assistant. For analysing PIO replies, use the PIO Reply Checker at https://righttoinformation.wiki/tools/pio-reply-checker.

It is harder, but still report. File the NCRP complaint mentioning the wallet address and the exchange used, and call 1930. The Indian Cyber Crime Coordination Centre (I4C) coordinates with banks and exchanges, and crypto transactions can sometimes be traced. You can also report to the Financial Intelligence Unit (FIU-IND) at https://fiuindia.gov.in.

Still file the NCRP complaint at https://cybercrime.gov.in and mention the country code and number. Indian agencies coordinate with telecom operators and, where required, with international counterparts. Report the number through the Sanchar Saathi portal as well.

It varies by commission and case. The Consumer Protection Act 2019 sets timelines for disposal, but actual times depend on workload and whether the order is appealed. Treat the criminal complaint and the bank-dispute route as the faster avenues for recovery.

Yes. A false promise of winnings is still cheating under BNS 2023 §318 even if you paid “willingly,” because your consent was obtained by deception.

There is no fixed rate — it depends overwhelmingly on how quickly you report. If you call 1930 and file on cybercrime.gov.in while the money is still in the fraudster's account, a hold can be placed and recovery is realistic. Once the money is withdrawn, recovery becomes much harder.

No. You can file and argue as a “consumer in person” under the Consumer Protection Act 2019. Engaging an advocate is advisable for larger or contested claims but is not mandatory. Filing fees are modest.

You can raise it where there was a clear failure in verification, but success depends on showing a deficiency in service by the operator. Cite the relevant TRAI regulations on customer verification and unsolicited commercial communications.

Insist on a Zero FIR, which can be filed at any police station and transferred to the jurisdictional station. The obligation to register an FIR for a cognizable offence is set out in BNSS 2023 §173. Insist on a written refusal, then escalate to the Superintendent of Police (Cyber).

Yes. You can file the NCRP complaint at https://cybercrime.gov.in from any country. Appoint a local representative (family member or advocate) to pursue the FIR and any consumer complaint. Indian courts have jurisdiction where the transaction or the fraudster is in India.

Visit the company's official website (type the URL manually; do not click the SMS link). Check the “Press Releases” or “Media” section, and call the customer-care number listed on the website (not the number in the SMS). Genuine contests are announced publicly, with detailed terms, and never require an upfront payment.

Government helplines and portals:

• National Cyber Crime Helpline: 1930 (24×7)
• National Cyber Crime Reporting Portal: https://cybercrime.gov.in
• Reserve Bank of India Complaint Management System (Ombudsman): https://cms.rbi.org.in
• Sanchar Saathi (report fraudulent SIMs / numbers): https://sancharsaathi.gov.in
• TRAI Complaint Portal: https://www.trai.gov.in (for SMS / DND related issues)
• Financial Intelligence Unit (FIU-IND): https://fiuindia.gov.in

Citizen Crisis Response Network: For urgent guidance after a fraud, see the Citizen Crisis Response Network hub at https://righttoinformation.wiki/citizen-crisis-response-network.

Related RTI Wiki guides:

• Complete guide to the RTI Act 2005: https://righttoinformation.wiki/rti-act-2005-complete-guide
• Crypto Scam Recovery in India: https://righttoinformation.wiki/crypto-scam-recovery-india
• Fake Lottery Scam — Recovery and Reporting: https://righttoinformation.wiki/fake-lottery-scam-india

Legal aid:

• National Legal Services Authority (NALSA): https://nalsa.gov.in — free legal aid for eligible persons.
• District Legal Services Authority: visit your district court campus.

Warning — Beware of “recovery agents” who claim they can get your money back for an upfront fee. This is a secondary scam targeting fraud victims. Genuine recovery happens through the police, the bank/UPI dispute process, or a consumer court—all of which have nominal or zero cost. Never pay a “recovery fee.”

Lucky draw scams exploit hope and urgency. Fraudsters know victims will act fast to claim a prize, bypassing rational scrutiny. The legal framework—the BNS 2023, BNSS 2023, the IT Act 2000, the Consumer Protection Act 2019 and RBI's customer-protection directions—gives citizens real tools, but recovery depends above all on speed. File your NCRP complaint and call 1930 the moment you realise it is a fraud; every hour counts while the money is still in the fraudster's account. Document everything: SMS, calls, transaction IDs. Do not feel embarrassed—a great many honest people fall victim; the shame belongs to the fraudster, not to you. Consumer courts are designed for self-represented litigants. Act fast, use the official channels, and report the scam to help prevent the next victim.