Money has left your account and you did not approve it. Or someone has used your identity to take a loan. The first hour matters most, so here is what to do, in order.
Step 1: Report to 1930 or cybercrime.gov.in
Call the National Cyber Crime Helpline on 1930, or file a report at cybercrime.gov.in. The report is passed to your bank and the receiving bank. Quick reports give a better chance of freezing the money before it moves on.
Step 2: Call your bank
- Block the card, UPI and net banking access.
- Get a complaint number, and follow up by email so you have it in writing.
- Note the time you received the alert and the time you reported.
Under the RBI circular of 6 July 2017, a customer has zero liability for a third-party fraud reported within three working days of the alert. Liability is limited after that. RBI has announced a revised framework that is due to apply from 1 January 2027.
Step 3: Preserve the evidence
- Screenshots of messages, links and the caller’s number.
- Transaction IDs, UPI IDs and account numbers involved.
- Bank statements and SMS alerts.
Do not delete anything. Do not reply to the fraudster.
Step 4: File an FIR
Go to the local police station or the cyber cell. Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 allows a Zero FIR at any police station, whatever the place of the offence. It also allows information to be given electronically.
The offences often include cheating (section 318 of the Bharatiya Nyaya Sanhita, 2023), cheating by personation (section 319) and forgery (section 336). The Information Technology Act, 2000 adds identity theft (section 66C) and cheating by personation using a computer resource (section 66D). Each carries up to three years and a fine of up to ₹1 lakh.
If your identity was stolen
- Check which mobile connections are in your name on the Sanchar Saathi portal, and report any you do not recognise.
- Change passwords and turn on two-factor authentication.
- Check your credit report for loans you did not take. Tell the lender in writing.
Prevention
- Never share an OTP, PIN or card details, even with someone claiming to be from the bank.
- A UPI request to “receive” money is a request to pay it.
- Be wary of remote-access apps and of links in unexpected messages.
Key takeaway
In the first hour, call 1930, tell your bank, and save the evidence. Reporting within three working days protects you best.