The SMS arrives at 9.40 pm: ₹48,000 debited from your savings account, a payment you never made. Your heart races, but what you do in the next hour decides how much of that money you may get back. If you have been hit by online fraud, call 1930, the national cyber crime helpline, and then tell your bank. Speed is everything, because money moved by fraudsters is passed through several accounts within hours.
This guide sets out exactly what to do, step by step, where to report, how the Reserve Bank of India (RBI) limits your liability for unauthorised electronic transactions, the new and stronger rules that start on 1 January 2027, and the scams most often used against Indian families.
First hour after online fraud: what to do
Do these in order, as fast as you can:
- Call 1930. This toll-free national helpline, run under the Ministry of Home Affairs, takes immediate reports of financial fraud. Give the transaction details, time, amount and the account or UPI ID the money went to. Note the acknowledgement or complaint number you get.
- Tell your bank or card issuer. Use the bank’s 24×7 helpline, the reporting link in its app or website, or reply to the alert SMS if it gives a number for objections. Ask the bank to block the card, UPI or net banking access that was misused. Note the complaint number and the time.
- File the full complaint on cybercrime.gov.in, the National Cyber Crime Reporting Portal, using the reference from your 1930 call, and attach screenshots, SMS alerts and bank statements.
- Secure everything else. Change passwords and UPI PINs, log out of other devices, and uninstall any screen-sharing or remote-access app a caller asked you to install.
- Preserve evidence. Do not delete chats, call logs, emails or links. Take screenshots of the fraudster’s numbers, profiles and payment requests.
Do not pay anyone who promises to recover your money for a fee. That is usually a second scam aimed at the same victim.
How 1930 and cybercrime.gov.in help online fraud victims
The 1930 helpline replaced the older number 155260. Calls feed into the Citizen Financial Cyber Fraud Reporting and Management System, which connects police, banks and payment firms on one platform so that the money trail can be traced and, where possible, the fraudulent amount frozen before it is withdrawn. A government note in 2025 said this system had helped save more than ₹5,489 crore across over 17.82 lakh complaints.
The portal at cybercrime.gov.in is where you lodge the formal complaint and track it. It covers all kinds of cyber crime, not just money fraud. Reporting there also matters for your bank claim: under the new RBI rules described below, compensation depends on reporting both to the portal or 1930 and to the bank.
Informing your bank and the evidence to keep
Banks must ask customers who use electronic banking to register a mobile number, and they send transaction alerts to it. RBI rules also require banks to offer round-the-clock channels to report unauthorised transactions and to act at once to stop further misuse after you report.
When you contact the bank, keep a record of:
- the complaint or reference number and the date and time you reported;
- the alert SMS or email for each disputed transaction;
- your 1930 acknowledgement and the cybercrime.gov.in complaint number;
- any police complaint or FIR copy, if you file one.
The time of reporting is what RBI’s liability rules count from, so this record is your proof.
RBI rules on customer liability for online fraud
RBI’s framework on limiting customer liability in unauthorised electronic banking transactions decides who bears the loss. It covers online fraud and other unauthorised transactions through internet banking, cards, UPI and similar channels.
You have zero liability if the fraud happened because of the bank’s negligence or deficiency, whether or not you report it. You also have zero liability for a third-party breach, where neither you nor the bank is at fault but the weakness lies elsewhere in the system, if you inform the bank within three working days of receiving the bank’s alert.
If you report a third-party breach later, your liability is capped as follows:
| Time taken to report | Your maximum liability per transaction |
|---|---|
| Within 3 working days | Zero |
| 4 to 7 working days | Transaction value or the cap below, whichever is lower: ₹5,000 for basic savings bank deposit (BSBD) accounts; ₹10,000 for other savings accounts, prepaid instruments and gift cards, credit cards with limits up to ₹5 lakh and some smaller current accounts; ₹25,000 for other current accounts and credit cards with limits above ₹5 lakh |
| Beyond 7 working days | As per the bank’s board-approved policy |
Working days are counted by your home branch’s schedule, excluding the day you received the alert. If the loss was caused by your own negligence, such as sharing your PIN or OTP, you bear the loss until you report it; anything lost after you report is the bank’s burden. Once you notify the bank, it must credit the disputed amount to your account (a shadow reversal) within 10 working days, value dated to the day of the fraud, without waiting for any insurance claim.
Stronger RBI protection from 1 January 2027
In June 2026 RBI issued amendment directions for commercial banks and other bank types that apply to electronic banking transactions on or after 1 January 2027. For commercial banks, the main changes are:
- Wider cover: protection extends to fraudulent transactions where a fraudster obtains your credentials by deceit, or where you approve a payment under coercion or duress, not just to purely unauthorised ones.
- Simpler time limit: for a third-party breach, zero liability applies if you report within five calendar days of the transaction. After that, the bank’s policy decides.
- Bank must prove it: the burden of proving customer liability lies on the bank.
- Faster handling: the bank must decide your complaint within the time in its policy, and in no case later than 45 calendar days for a domestic fraud (60 for a cross-border one). Reversals must be value dated with no loss of interest, and on credit cards a shadow reversal is due within five calendar days.
- Alerts: SMS alerts are compulsory for every electronic transaction above ₹500, with email alerts wherever you have given an email address.
- Small fraud compensation: an individual, including a sole proprietor, with a gross loss of up to ₹50,000 can get 85% of the net loss or ₹25,000, whichever is less, once in a lifetime. The loss must be found bona fide and reported both to cybercrime.gov.in or 1930 and to the bank within five calendar days. The bank must pay within five calendar days of your application. This compensation covers frauds occurring up to one year from 1 January 2027.
As an illustration based on RBI’s own example: if ₹40,000 is lost and ₹15,000 is recovered before compensation, the net loss is ₹25,000 and the compensation is 85% of that, or ₹21,250.
Common scams to watch for
Almost every online fraud starts the same way: a call, SMS, email or chat that creates panic or greed and pushes you to act before you think. Learn these patterns and share them with older relatives, who are often targeted.
Digital arrest
The Ministry of Home Affairs has warned about criminals posing as police, CBI, narcotics officials, RBI or the Enforcement Directorate. They claim a parcel in your name holds drugs or a relative is in custody, then keep the victim on a video call, sometimes from studios built to look like police stations, until money is paid. The ministry describes this as organised crime run by cross-border syndicates. No genuine agency arrests anyone over a video call or asks for money to settle a case. Hang up and call 1930.
Fake KYC updates
A message says your bank account, SIM or wallet will be blocked unless you update KYC through a link or an app. The link captures your login details, or the app gives the caller control of your phone. Banks do not ask for OTPs, PINs or passwords. Update KYC only through your bank’s branch, official app or website.
Investment and trading apps
Groups on messaging apps promise big daily returns from stock tips, trading apps or crypto, show fake profits on a dashboard and then block withdrawals. Before paying anyone who claims to be a SEBI-registered adviser or broker, check the UPI ID on SEBI’s own verification tool, SEBI Check. For schemes taking deposits, use RBI’s Sachet portal (sachet.rbi.org.in), which lets you check whether an entity is registered with a regulator and allowed to accept deposits, and to lodge a complaint about illegal deposit collection.
Fake customer care and impersonation calls
Fraudsters plant fake helpline numbers online and pose as bank, telecom or courier staff. The Department of Telecommunications reports thousands of such complaints every year under categories such as fake customer care and impersonation of police, CBI, Aadhaar or RBI officials.
Reporting suspicious calls before you lose money
Reporting attempts helps stop online fraud before it reaches someone else. If you get a suspicious call, SMS or WhatsApp message but have not lost money, report it on the Chakshu facility of Sanchar Saathi (sancharsaathi.gov.in or its app). The Department of Telecommunications uses these reports to act against misused numbers. Simple habits help too: turn on transaction alerts, set daily limits on cards and UPI in your bank app, switch off international and online card use when you do not need it, and never scan a QR code to receive money, because a QR code is only ever used to pay. If you have already lost money, Chakshu is not enough: call 1930 and complain on cybercrime.gov.in.
If your bank does not respond
Online fraud complaints can take time, so stay persistent and polite, and keep escalating in writing. Ask the bank for a written decision on your complaint and, if it says you are liable, for the reasons and supporting details. Under the 2027 rules the bank must disclose the reason for rejecting a complaint. Keep copies of every letter and email.
Key takeaways
A short checklist to keep on your phone, or to share with family members who bank online:
- Call 1930 at once, then inform your bank, then complete the complaint on cybercrime.gov.in.
- Under current RBI rules, reporting a third-party breach within three working days gives zero liability.
- From 1 January 2027, the window becomes five calendar days, coerced payments are covered, and small losses up to ₹50,000 can qualify for compensation of up to ₹25,000.
- Never share OTPs, PINs or passwords, and never install apps a caller asks for.
- No agency conducts a digital arrest. Check investment offers on SEBI Check and deposit schemes on Sachet.
- Keep every complaint number, alert and screenshot as evidence.
This is general information, not legal or personal advice. Your bank’s customer protection policy sets out how it applies these rules.
