Money taken by an online scam — what to do in the first hour
Reporting speed is the single biggest factor in whether funds are recovered. The number to call, what to preserve, and what to do if police will not register the FIR.
Published · Lawdship
In online financial fraud, the first hour matters more than the first lawyer. Stop reading and do this now if money has just left your account.
Report immediately
Call 1930. It is the national cybercrime helpline, and it operates alongside the Citizen Financial Cyber Fraud Reporting and Management System. Reporting through it lets banks be alerted to hold the transaction before the money is withdrawn or moved onward.
Then file at cybercrime.gov.in. The helpline generates an acknowledgement; the portal creates the formal complaint record.
Then call your bank and ask for the receiving account to be flagged and your own account secured.
Scammers move funds through layered accounts within hours and withdraw at ATMs or through mule accounts. Every hour of delay materially reduces the chance of a hold. This is why reporting comes before everything, including advice.
Preserve this, before anything disappears
- Transaction ID or UTR number for every debit
- Screenshots of the chat, the app, the website or the call log
- The phone number, UPI ID, account number or wallet ID you paid to
- Any URL you clicked, copied in full
- Bank SMS alerts, unedited
Do not delete the conversation, however embarrassing it is. Do not confront the fraudster — it warns them to empty the account.
What kind of fraud it is changes the route
- UPI, net banking or card fraud — 1930 and the portal, then the bank. Report within three days for the strongest position on liability.
- Investment or trading app scams — often unregistered entities. The recovery route is criminal complaint plus civil action against whoever is identifiable.
- Loan app harassment — report on the portal, and separately complain to the RBI about unregulated lending.
- Sextortion and blackmail — report and preserve evidence. Do not pay; payment invites escalation rather than ending it.
- Job or task scams — increasingly the highest-volume category, and the money almost always moves through mule accounts.
If the police will not register an FIR
This is common, and there is a defined escalation path.
- Send a written complaint to the cyber police station, by registered post, keeping the receipt
- Escalate in writing to the Commissioner of Police
- If that fails, approach the Magistrate under the criminal procedure law seeking a direction to register the FIR
An advocate-drafted complaint that identifies the offences correctly is registered far more often than a narrative letter, which is the practical argument for taking advice at that stage rather than earlier.
On recovery
Be realistic. Where funds are frozen quickly, recovery is genuinely possible. Where the money has been withdrawn and the accounts were mule accounts opened on forged documents, criminal proceedings may continue but the money is frequently unrecoverable.
Anyone who contacts you offering to recover your lost funds for an upfront fee is running a second fraud on victims of the first. This is one of the most common follow-on scams in India, and the "recovery agent" often has your details because they bought them from the original fraudster.
General information, not legal advice. If money has just gone, call 1930 before doing anything else.
Have a matter along these lines?
Send us the documents and get an assessment from an advocate who appears in that court.