How to report cyber fraud in India

Call 1930. Do this before calling your bank, before searching online, before anything else. The operator takes the transaction details and raises a ticket that goes to the banks and payment intermediaries in the chain, who can place a hold on the funds if they have not already been withdrawn. The whole architecture is built around speed.

Have ready: your bank account or card number, the transaction date, time and amount, the beneficiary details if you have them, and the reference or UTR number.

Then call your bank's fraud line — the number on the back of the card or on your statement, never a number from a search result or a message. Block the card or freeze the account. Ask for a complaint reference number and the name of the person you spoke to.

Then file the complaint at cybercrime.gov.in. The online report is itself a formal complaint and generates an acknowledgement number. Upload screenshots, message threads, transaction records and anything else you have.

Then confirm to your bank in writing — email is fine — repeating what was reported and when. The written record of the date and time of your report is what establishes your liability position, and phone logs alone are weaker evidence.

Change passwords, starting with email, and enable two-factor authentication. If your phone stopped working around the time of the fraud, suspect a SIM swap and call your telecom operator immediately.

Do not delete anything. Messages, emails, call records and transaction confirmations are all evidence.

The RBI's limited liability framework for unauthorised electronic transactions is the most important consumer protection in this area and the least known.

Where the unauthorised transaction results from a deficiency in the bank's own systems, the customer has zero liability regardless of when it is reported.

Where it results from a third-party breach — where the fault is neither the bank's nor the customer's — the customer has zero liability if the transaction is reported within three working days of receiving the bank's communication about it. Reporting between four and seven working days limits liability to a prescribed amount; beyond that it is determined by the bank's own board-approved policy.

Where the loss results from the customer's own negligence — sharing a PIN, password or OTP — the customer bears the loss up to the point of reporting. After reporting, the bank bears it.

The bank must credit the amount to your account within ten working days of your notification where its liability is established, without waiting for the outcome of any investigation or insurance claim.

The bank bears the burden of proving customer liability. If a bank tells you the loss is yours because you shared an OTP, ask them to state that in writing with reference to the RBI circular — the requirement to justify it in writing changes many conversations.

If the bank does not resolve it within 30 days, escalate to the RBI Ombudsman through cms.rbi.org.in or by calling 14448. It is free, and the Ombudsman's award is binding on the bank.

The common structure across all of them is manufactured urgency plus a request for an OTP, a payment or an app installation. Any two of those three together is a fraud, essentially without exception.

The two rules that defeat almost all of it: no genuine institution ever asks for an OTP, PIN or password, and you never enter a UPI PIN to receive money.

Track your complaint on cybercrime.gov.in with the acknowledgement number. Complaints are routed to the relevant state cyber cell, and you may be asked to visit or to file a formal FIR.

Follow up. Recovery, where it happens, generally comes from the funds being held early rather than from a later investigation — which is again why the first hour matters so much.

For fraudulent loans taken in your name, dispute them with the lender and with all four credit bureaus — CIBIL, Experian, Equifax and CRIF High Mark — enclosing the cyber crime acknowledgement. Credit report disputes are free and the bureau must investigate.

Check your credit report periodically. Each bureau must provide one free full report a year under RBI rules, and an unrecognised loan or enquiry is the earliest signal of identity misuse.

Lock your Aadhaar biometrics through myAadhaar, use a masked Aadhaar for photocopies, and use a Virtual ID where a service asks for an Aadhaar number.

Set transaction alerts and daily limits on your cards and UPI apps — the limits are adjustable, and lowering them costs nothing.

For frauds involving substantial sums, also report to IC3-equivalent national bodies where the counterparty is overseas, and consider a lawyer where the amount justifies it. Free legal aid through NALSA is available to those who qualify.