Short answer: report it within the first few hours, in this order — call 1930, file at cybercrime.gov.in, then notify your bank or payment app in writing. Under the RBI’s limited-liability framework for unauthorised electronic transactions, a customer who reports within three working days generally bears zero liability, and that protection narrows as the days pass. Speed is worth more than paperwork; you can add documents later, but you cannot recover the hours.
General consumer information, not legal advice. Outcomes depend on the facts, your bank’s investigation and how fast the money moved.
First, decide which of two things happened
The remedies are completely different, so spend thirty seconds classifying it.
| Unauthorised transaction | Authorised but deceived | |
|---|---|---|
| What it looks like | Money left your account without you approving it — card used elsewhere, OTP-less debit, account taken over. | You yourself paid, but the seller was fake, never delivered, or sent something entirely different. |
| Primary route | Bank, under the RBI limited-liability rules. Report immediately. | Merchant → gateway/card chargeback → consumer commission. Fraud reporting in parallel if the seller is untraceable. |
| Clock that matters | 3 working days for zero liability; 4–7 days for capped liability. | Chargeback windows set by the card networks, typically counted in months, but raise it early. |
| Also do | Freeze the card, change credentials, file at cybercrime.gov.in. | Keep every message; you will need the evidence trail. |
Many real cases are a mix — you authorised a small payment and an unauthorised debit followed. If in doubt, treat it as unauthorised and report to the bank on the fast clock. Nothing is lost by doing so.
The first hour
- Call 1930. This is the national cyber-crime financial fraud helpline. Its specific purpose is to get a request out to the receiving bank quickly enough to freeze funds before they are withdrawn or layered onward. Every hour materially reduces the chance of recovery.
- Stop further loss. Block the card in your banking app, disable UPI on the affected handle, and change the password on the email address linked to the account — email compromise is how many of these start.
- Do not talk to anyone who calls you afterwards. A second wave of calls offering to “recover” your money is a standard follow-on scam. No agency phones you to ask for a fee, an OTP or remote access to your device.
- Screenshot everything now — the transaction entry with reference number, the merchant page, the chat, the SMS, the UPI ID or account number involved. Some of it disappears when the seller pulls the listing.
The first 24 hours
- File a complaint at cybercrime.gov.in under the financial-fraud category. You will get an acknowledgement number; keep it, because every later step asks for it.
- Notify your bank in writing — not just by phone. Email the branch and the official grievance address, quote the transaction reference, state the date and time you first noticed it, and use the words “unauthorised transaction” if that is what it was. The written record is what fixes your reporting date for the RBI liability rules.
- Raise a dispute in the app you paid through. UPI apps have a built-in dispute-raising flow that routes to NPCI; card payments have a dispute option in the issuer’s app or netbanking.
- Write down a plain timeline. One page, in order, with times. You will retell this to four different people and inconsistencies cost you credibility.
Understanding the RBI liability clock
The RBI’s customer-protection framework for unauthorised electronic banking transactions sets liability by how quickly you report after receiving the bank’s communication about the transaction:
| When you report | Customer liability, broadly |
|---|---|
| Fraud or negligence by the bank | Zero, regardless of reporting time. |
| Third-party breach, no fault of bank or customer, reported within 3 working days | Zero. |
| Same, reported within 4 to 7 working days | Capped, by transaction and account type. |
| Reported beyond 7 working days | Determined by the bank’s own board-approved policy. |
| Loss due to customer negligence, e.g. sharing an OTP or password | Customer bears the loss up to the point of reporting. |
Two practical consequences. First, the clock starts from the bank’s notification, which is why ignoring transaction SMS is expensive. Second, the framework covers unauthorised transactions. A payment you made yourself to a seller who cheated you is a commercial dispute, not an unauthorised transaction — different route, longer timeline, still winnable.
If you were deceived rather than debited
You paid, and the goods never arrived or were not what was described. The escalation ladder, in order:
- The seller’s grievance officer. Indian e-commerce entities must publish one. Write once, specifically, with the order ID and what you want — refund, replacement, or delivery by a date.
- The marketplace, if you bought through one. Buyer-protection programmes exist and they work best when you use the in-platform dispute flow rather than email.
- A card chargeback, if you paid by credit or debit card. Contact the issuer, cite “goods or services not received” or “not as described”, and supply the evidence. This is the strongest lever an individual consumer has.
- The payment gateway, if a gateway was in the path. Gateways hold merchant settlements and can act, especially where a pattern of complaints exists.
- National Consumer Helpline, 1915, which mediates with a large number of registered companies and often gets movement without formal proceedings.
- A consumer commission complaint via e-Daakhil. Filing is online, fees are modest, and you do not need a lawyer. Jurisdiction follows the value of the claim.
What actually improves your odds
- Reporting inside hours, not days. This single factor dominates recovery outcomes for transferred funds.
- A written record with reference numbers at every step, including the acknowledgement number from cybercrime.gov.in.
- Precision about what you want. “Refund of ₹4,200 to the original payment method within 7 days” is actionable. “Please help” is not.
- Escalating on a schedule rather than in frustration. One clear message per rung, a stated deadline, then the next rung.
- Not deleting anything. Chats, emails, the listing screenshot, packaging, courier labels. Cases are won on the boring evidence.
Frequently asked questions
What is the number to report online financial fraud in India?
Call 1930, the national cyber-crime helpline for financial fraud, and file a written complaint at cybercrime.gov.in. Do both, as early as possible — the helpline exists specifically to get a freeze request to the receiving bank before the money is withdrawn.
How long do I have to report an unauthorised bank transaction?
Under the RBI’s limited-liability framework, reporting within three working days of the bank’s communication generally means zero customer liability for third-party breaches. Reporting within four to seven working days caps liability at a prescribed amount, and beyond seven days the outcome depends on your bank’s board-approved policy.
Can I get a refund if I paid by UPI to a scammer?
It is possible but difficult, and it depends on speed. A UPI transfer you authorised is not an unauthorised transaction, so recovery usually depends on the receiving account being frozen before the funds are withdrawn. That is exactly what calling 1930 within the first hours is for. Raise a dispute in your UPI app as well, and file at cybercrime.gov.in.
Is a chargeback the same as a refund?
No. A refund is the merchant voluntarily returning your money. A chargeback is your card issuer forcibly reversing the payment under the card network’s rules, usually because goods were not received or not as described. Ask the merchant first; a chargeback filed without any attempt to resolve is often rejected.
Do I need to file a police FIR for online fraud?
A complaint filed on cybercrime.gov.in is the standard route and is treated seriously; for many cases it is enough to start the process. For larger losses, or where a bank or insurer asks for it, a formal FIR at the local police station or a cyber-crime cell strengthens the file. The online complaint and the FIR are not mutually exclusive.
Someone called offering to recover my lost money. Is that real?
Treat it as a second scam. Recovery services that phone victims, ask for an upfront fee, request an OTP, or want remote access to your phone or computer are a well-documented follow-on fraud that targets people already on complaint lists. Genuine agencies do not work that way, and no legitimate process ever requires you to send money to get money back.
Comments (0)