Quick answer: Report suspected financial cyber fraud immediately to your bank through its official fraud-reporting channel, and also call 1930. Submit the details at cybercrime.gov.in. Save both complaint references. Reporting to the cybercrime authorities does not replace notifying your bank, and reporting quickly does not guarantee reimbursement.
What to do immediately
- Notify your bank. Use the bank’s official app, website, or fraud helpline. Report the disputed transaction and ask how to prevent further unauthorised payments. Save the complaint number and reporting time.
- Call 1930. Report the financial cyber fraud and follow the instructions provided.
- Complete the online report. Use cybercrime.gov.in and retain the acknowledgement.
- Preserve the evidence. Keep transaction references, payment alerts, screenshots, messages, and the details of any accounts involved.
- Follow up through official channels. Keep a record of each response. Never share an OTP, PIN, or password with someone offering to recover your money.
Your liability under RBI rules
| When you report | Your liability for a third-party breach, where neither you nor the bank was at fault |
|---|---|
| Within 3 working days | Zero |
| 4 to 7 working days | Limited, capped by transaction and account type |
| Beyond 7 working days | As per the bank’s board-approved policy; you may bear the loss |
Three things scope this table. First, the working-day count runs from the moment you receive the bank’s transaction notification, not from when you noticed the debit — so alerts you have muted or ignored are still running the clock. Second, it is the report to your bank that stops it; a complaint to 1930 or cybercrime.gov.in does not substitute, so do both and do the bank first. Third, this table covers third-party breaches only. If the bank was at fault, you bear zero liability regardless of when you report; if the loss arose from your own negligence, such as sharing a PIN, OTP or password, you bear it until the point you report, after which the bank bears anything further. Banks are required to credit the disputed amount within 10 working days of notification in eligible cases.
The scams that account for most losses
- OTP and PIN sharing: a caller posing as bank, KYC, electricity board or delivery staff persuades you to read out a code. No genuine organisation ever asks for one.
- UPI collect request fraud: you are sent a payment request disguised as a refund. Approving it sends money out. You never enter a UPI PIN to receive money.
- Fake customer care numbers found through search results, which lead to fraudsters rather than the company.
- Screen sharing apps such as AnyDesk or TeamViewer, installed on the pretext of fixing an issue, giving the fraudster full access to your banking app.
- Job, loan and investment offers demanding an advance fee.
- Digital arrest scams, where callers impersonate police, CBI or customs, claim a parcel or case in your name, and pressure you into transferring money. No agency in India conducts arrests or demands payment over a video call.
- QR-code payment scams: Do not scan a QR code and enter your UPI PIN to receive a refund or payment. Check the payee and amount before authorising a payment. See NPCI’s fraud-awareness guidance.
What happens after you file
Your complaint is routed to the police unit with jurisdiction and to the banks involved. You can track it with the acknowledgement number on cybercrime.gov.in. Expect to be asked to visit a local cyber cell or police station to complete formalities and submit copies of your evidence. Recovering money from the recipient and obtaining reimbursement from your bank are different processes. Prompt reporting can help efforts to trace and freeze funds, while reimbursement depends on the circumstances and the applicable customer-liability rules. Neither outcome is guaranteed.
If your bank does not resolve the matter within 30 days, escalate to the RBI Integrated Ombudsman at cms.rbi.org.in, which is free.
Protecting yourself from here
- Never share OTP, PIN, CVV or passwords. Not with bank staff, not with anyone.
- Set transaction limits in your banking and UPI apps to cap the damage from any single incident.
- Enable SMS and email alerts for every transaction, however small.
- Find customer care numbers on the official website or the back of your card, never through search results.
- Uninstall any screen sharing app you were asked to install.
- Keep UPI apps updated.
- Check your credit report periodically for loans taken in your name; see how to check it free.
Frequently asked questions
Will I definitely get my money back?
No. Recovery depends on whether the funds were frozen in time and on how the liability rules apply to your case. Reporting within three working days gives the strongest position, but it is not a guarantee.
What if I shared the OTP myself?
That is generally treated as customer negligence, and you may bear the loss up to the point you report it. Notify your bank immediately. Where the loss is due to your own negligence, the bank bears any further unauthorised losses occurring after that report — but reporting does not erase the loss that happened before it.
Should I contact the bank or 1930 first?
Notify your bank immediately and also report to 1930 without delay. These reports serve different purposes; neither should be treated as a substitute for the other. Keep both complaint references.
Is there a deadline for filing?
File as soon as possible. For liability purposes the relevant clock is working days from when you receive the transaction communication.
Last updated September 2026. Rules on customer liability are set by RBI circulars and bank policies and can change; verify with your bank and rbi.org.in. General information, not legal advice.
Sources
The liability discussion draws on the RBI’s Customer Protection — Limiting Liability of Customers in Unauthorised Electronic Banking Transactions. Its three-working-day zero-liability provision concerns third-party breaches where neither the bank nor the customer is at fault. Different provisions apply to bank fault and customer negligence. The reporting period runs from receipt of the bank’s transaction communication. Ask your bank to explain the provision it applies to your case.
Correction, 19 September 2026: we made the reporting instructions consistent across the introduction, checklist and FAQ, and clarified that reporting does not guarantee reimbursement.
Article Was Generated By AI.