How to report cyber fraud in India

Stolen money rarely stays where it first lands. It is usually moved on within minutes or hours, through a chain of accounts opened in other people's names, until someone withdraws it as cash or converts it into something harder to trace. Every hop makes it harder to stop.

Calling 1930 puts your complaint into the Citizen Financial Cyber Fraud Reporting and Management System, run by the Indian Cyber Crime Coordination Centre under the Ministry of Home Affairs. It alerts the banks and wallets the money passed through so that they can hold it. That works on money that is still inside the banking system. It does very little for money that has already been withdrawn, which is why the order of the steps below matters more than any single one of them.

Call 1930 as soon as you realise money has gone. Before you dial, or while you wait, gather what you will be asked for: the bank account, card or UPI ID the money left from, the reference number of every transfer (the UTR or transaction ID in your bank SMS or app), the date, time and amount of each one, and whatever you know about where it went — the receiving UPI ID, account number, wallet, or the phone number that contacted you.

Do not end the call without a reference or acknowledgement number, and write it down somewhere other than the phone that was used in the scam. If the line is busy, keep trying, and start the online complaint in parallel rather than waiting for a free line.

Use the number printed on the back of your card or in your passbook, or open the bank's official app or website by typing the address yourself. Never use a number from a search ad, a message, a social media comment or anything the other person sent. Fake customer care numbers are one of the most common ways these frauds start, and a second call to one turns a loss into a bigger loss.

Ask the bank to block the card, UPI or net banking that was used, to register a fraud complaint against each transaction, and to give you a complaint reference. Then follow up in writing, from your registered email address or through the bank's own complaint form, so there is a dated record of exactly when you told them.

How quickly you tell your bank matters for more than the freeze. The RBI's rules on unauthorised electronic banking transactions link how much of a loss can be placed on the customer to how quickly the bank was told. The RBI revised those rules in June 2026, with the new version applying to transactions from 1 January 2027, so ask your bank which version applies to yours. Under either one the advice is the same: report immediately, and in writing.

cybercrime.gov.in is the National Cyber Crime Reporting Portal. Choose the option for financial fraud, register with your mobile number, and enter every transaction separately with its reference number, date, time and amount. Upload the screenshots described below. If you have already called 1930, this is where you complete that complaint with the full details — the helpline asks you to, and a complaint with complete transaction data is far easier for a bank to act on.

Save the acknowledgement number the portal gives you. Your bank, the police and the portal's own complaint tracking will all ask for it.

The same portal takes complaints that do not involve money: a fake profile using your photos, harassment, sextortion, or a hacked account being used to message your contacts. Crimes against women and children have their own route on the portal.

Sanchar Saathi, the Department of Telecommunications' portal at sancharsaathi.gov.in and in its own app, has a facility called Chakshu for reporting suspected fraud calls, SMS and WhatsApp messages. It will not bring your money back, but it is how fraud numbers get investigated and disconnected, and it takes a few minutes.

While you are there, use TAFCOP to see every mobile connection registered in your name, and report any you did not take. SIM cards issued in someone else's name are how these operations stay anonymous. If the fraud involved a lost or stolen phone, CEIR on the same portal lets you block it.

Finally, report the account that contacted you inside the app it used — WhatsApp, Telegram, Instagram or wherever it was — so the platform can act on it too. Take your screenshots first, because reporting or blocking can change what you are still able to see.

Take screenshots before you block, delete or report anything: the full chat with the other party's number or profile visible, every payment confirmation showing its reference number, the bank SMS for each debit, and any page you were sent to. Copy the full web address of a fake site as text rather than visiting it again.

Keep the originals. Do not crop out the parts that feel embarrassing, and do not edit images. An edited screenshot is worth far less to an investigator than an awkward one.

Write a short timeline while it is fresh: when the first contact came, what was said, what you did, and when each payment went. Ten honest lines written today are more useful than a perfect account reconstructed a month from now.

Complaints made on the portal are routed to the police of your state or union territory, who may contact you for more details or to register an FIR. Keep printed copies of your evidence and the acknowledgement number ready. You can follow the status of your complaint on the portal using the acknowledgement number.

Be realistic about the outcome. Money that was held quickly is sometimes returned, through a process that runs via your bank and the police and can take time. Money that was withdrawn before anyone could act is often not recovered. Reporting is worth it either way, because the same accounts and numbers are usually being used against other people as well, and reports like yours are how they get shut down.

Do not pay anyone who promises to get your money back — a 'recovery agent', an 'ethical hacker', a lawyer you have never met, or someone claiming to call from the cyber cell. Police and banks do not charge a fee to process a fraud complaint. These offers appear precisely because people who have just been defrauded are searching for help, and they are run by the same kind of people who took the money.

Do not share an OTP, install a screen-sharing app or approve a payment request for anyone who is 'helping' you, however official they sound. Do not call the number back to argue or plead; it only confirms that your number is live. And do not stay quiet out of embarrassment. These scripts are rehearsed on millions of people, and being caught by one says nothing about your intelligence.