Cyber Fraud Money Recovery: How to Get Money Back in India

"I lost ₹2 lakh to a fraud call. I reported it. Will I ever get it back, and how?" There are two separate routes, and you should use both: recovery of money frozen in the fraudster's accounts (through 1930, the police and the Money Restoration Module), and reimbursement by your own bank where RBI's liability rules make the bank responsible. The single most important step is reporting on 1930 or cybercrime.gov.in within the first hour.

This guide explains what happens after you report. If you are still working out whether an offer is a scam, read our guide on how to spot investment scams first; for the immediate checklist after a UPI fraud, see UPI scams: what to do.

Two routes to your money

The routes do not cancel each other. If the bank reimburses you and money is later recovered, the recovered money goes to settle the bank's claim; you cannot be paid twice.

Why the golden hour matters

When you call 1930 or file at cybercrime.gov.in, the complaint goes into the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS). Banks and payment apps that received the money get an alert and can place a hold or lien on it. Fraudsters know this, so they split and move money within minutes through layers of "mule" accounts, and withdraw it at ATMs or convert it.

Officials describe the first hour as the golden hour, and some police units now say the real window is closer to 15 minutes. Official figures show that by mid-2026 the system had helped save over ₹11,000 crore from more than 32 lakh complaints, while police note that the main reason money is not recovered is that victims realise or report late.

Step-by-step: what to do

In the first hour

1. Call 1930 (or file at cybercrime.gov.in). Give the transaction IDs or UTR numbers, amounts, times, and the fraudster's account, UPI ID or phone number. Write down the 14-digit acknowledgement number; every later step needs it.
2. Report to your bank's 24x7 fraud channel. Ask the bank to block the card, UPI or net banking that was used. Get a complaint number with the time.
3. Stop any further payments. Fraudsters often call back asking for "fees" to reverse the transaction.

On the first day

4. Complete the online complaint. If you called 1930, you may get an SMS link or need to log in at cybercrime.gov.in to add details and upload evidence: screenshots, chats, call logs and statements.
5. File an FIR if the amount is large or the police ask for it. Larger releases usually need it.
6. Secure your phone, email and accounts. Change passwords, remove remote-access apps and check for SIM or email changes.

Over the following weeks

7. Track the hold. Your cybercrime complaint status shows whether money was put on hold and in which bank. The police station handling your complaint can tell you the frozen amount.
8. Apply for restoration. The Money Restoration Module (MRM) launched by I4C in 2026 lets victims raise a refund request online with the NCRP acknowledgement number and an OTP. Banks or police may ask for an indemnity bond and, for higher amounts, an FIR and a court order.
9. If a court order is needed, apply to the magistrate through the investigating officer for release of the held money. The release of property provisions are in the Bharatiya Nagarik Suraksha Sanhita, 2023 (Sections 497 and 503, which replaced old Sections 451 and 457 of the CrPC). Free legal aid is available through your District Legal Services Authority.
10. Pursue the bank route in parallel. If the bank rejects your claim or does not respond within 30 days, file with the RBI Ombudsman at cms.rbi.org.in. Under the Reserve Bank – Integrated Ombudsman Scheme, 2026, file within 90 days of the end of that 30-day period or the bank's last reply, whichever is later.

What your bank owes you under RBI rules

Up to 31 December 2026

RBI's 2017 customer liability framework applies to electronic banking frauds:

• Bank's fault: zero liability, whenever you report.
• Third-party breach (such as a data leak or skimming), reported within 3 working days: zero liability. Within 4 to 7 working days: liability capped at ₹5,000 to ₹25,000 depending on the account.
• Your negligence (you shared an OTP, PIN or password): you bear the loss until you report it; the bank bears losses after that.
• The bank must credit eligible amounts within 10 working days of your report.

From 1 January 2027 (commercial banks)

Under RBI's Commercial Banks (Responsible Business Conduct) Third Amendment Directions, 2026:

• Zero liability for third-party breaches reported within 5 calendar days.
• For frauds caused by your own negligence, a once-in-a-lifetime compensation for individuals with a gross loss of up to ₹50,000: the lesser of 85% of the net loss (after any recovery) or ₹25,000, if you report to both 1930/NCRP and the bank within 5 calendar days. The bank must pay within 5 calendar days of your application. As notified, this compensation covers frauds in the first year of the new rules, so check whether RBI extends it.
• Domestic fraud complaints must be resolved within 45 days; the bank must prove customer liability and give reasons if it rejects a claim.

Worked example

On 5 February 2027, Sanjay is tricked into sharing an OTP on a fake courier call and loses ₹40,000 from his savings account. He calls 1930 within 30 minutes and reports to his bank the same day.

Route 1, recovery: ₹40,000 was sent to one account and then ₹30,000 moved onward. The first bank holds the ₹10,000 still in the account; the second bank holds ₹18,000 of the ₹30,000. Frozen total: ₹10,000 + ₹18,000 = ₹28,000. He applies through the Money Restoration Module.

Route 2, compensation: this was customer negligence, so zero liability does not apply, but he qualifies for the one-time compensation because the gross loss is under ₹50,000 and he reported to both within 5 days.

• If he applies before any recovery: net loss ₹40,000; 85% = ₹34,000; capped at ₹25,000.
• If the ₹28,000 is restored first: net loss = ₹40,000 − ₹28,000 = ₹12,000; 85% = ₹10,200.

Under the directions, if money is recovered after compensation is paid, the bank recalculates the compensation on the new net loss. So once everything settles, Sanjay ends up with ₹28,000 + ₹10,200 = ₹38,200 of the ₹40,000, instead of possibly nothing. Without the fast report, both routes would have been weaker.

Fraudsters often promise "guaranteed" returns of 3 to 5% a month. Compare that with what a real bank deposit pays using our FD calculator before you trust any offer.

Ready-to-copy follow-up message

Use this with the police station or cyber cell handling your complaint, and adapt it for your bank.

Subject: Request for status and release of held amount – NCRP acknowledgement [14-digit number]

Respected Sir/Madam,

I reported a cyber financial fraud on [date and time] through [1930 / cybercrime.gov.in], acknowledgement number [number]. I lost ₹[amount] through [UPI / net banking / card], transaction IDs [IDs], from my account [bank, last 4 digits].

Please tell me the amount held in the beneficiary accounts and the banks concerned, and the documents required to release it to me. I am ready to submit an indemnity bond, FIR copy and any other document needed, and I request that the case be forwarded to the court for a release order if required.

Bank complaint reference: [number]. Contact: [mobile], [email].

Regards, [Name]

What not to do

• Do not pay any "recovery agent", lawyer or official who calls you first offering to get your money back for a fee. Fraud victims are targeted again.
• Do not delay reporting out of embarrassment. Every minute lets the money move further.
• Do not delete messages, apps or call logs. They are evidence, even if they are upsetting to keep.
• Do not report only to the bank or only to 1930. The new compensation rule needs both, within 5 calendar days.
• Do not share the acknowledgement number on social media. Scammers use public complaints to pose as police.
• Do not give up after a month. Court releases and restoration can take months; follow up regularly.

Key takeaways

• There are two routes: recovery of frozen money through 1930, police and the Money Restoration Module, and reimbursement by your bank under RBI liability rules. Use both.
• Report on 1930 or cybercrime.gov.in within the golden hour and keep the 14-digit acknowledgement number.
• Held money is released via the Money Restoration Module; larger amounts may need an FIR, indemnity bond and a magistrate's order under BNSS.
• Until 31 December 2026, third-party breaches reported within 3 working days carry zero liability; from 1 January 2027, the window is 5 calendar days at commercial banks.
• From 2027, frauds caused by your own negligence may still qualify for a one-time compensation of up to ₹25,000 if the loss is up to ₹50,000 and you report within 5 days.