What to do in the first hour
- Call 1930, the national cybercrime helpline run by state police. Give the amount, time, transaction IDs and the account or UPI ID the money went to. You get a 14-digit acknowledgement number by SMS.
- Use that number to complete your complaint on cybercrime.gov.in, as the SMS asks.
- Call your bank on the number in its app or on your card. Block cards, UPI and net banking, and report each fraudulent transaction.
- Write down every transaction: date, time, amount, UTR or reference number, and where it went. Keep all messages, call logs and screenshots.
Why speed matters
The Home Ministry's reporting system for financial fraud exists to stop money being siphoned off. When your complaint is accepted, notices go to the banks and wallets the money reached, and each one is asked to hold up to the reported amount and say where the rest went.
Fraudsters move money through several accounts quickly, then withdraw it or send it out of the banking system. A hold only works on money that has not left yet, which is why people call the first hour the golden hour.
Till 30 June 2026, the system had saved more than ₹11,158 crore across more than 32.80 lakh complaints, the Home Ministry says.
How held money comes back to you
If money is put on hold, you should get an SMS with a link that explains how it is released. It does not come back on its own. Under the Home Ministry's January 2026 procedure, you can apply for it through the Money Restoration Module on the portal using your acknowledgement number, and the police verify the claim.
After verifying your claim, the police can release a held amount below ₹50,000 without an FIR; above that, an FIR is needed. You may be asked to sign an indemnity bond. You can also apply to the local court for release, and Lok Adalats may be used where possible.
Be realistic. For the three financial years 2023-24 to 2025-26, people reported losing more than ₹56,087 crore; more than ₹9,079 crore was put on hold and more than ₹206 crore was refunded, according to the Home Ministry.
When your bank must refund you
RBI's July 2017 rules on unauthorised electronic transactions (circular RBI/2017-18/15) cover payments made from your account without your involvement, such as a card or account misused by someone else. If the bank was at fault, or the fault lay elsewhere and you report within 3 working days of the bank's alert, you lose nothing. The bank must credit the amount provisionally within 10 working days of your report, settle the complaint within 90 days, and prove any liability it puts on you.
Report in 4 to 7 working days and your loss is capped at ₹5,000, ₹10,000 or ₹25,000 depending on the account, or the amount itself if lower. After 7 working days, the bank's own policy applies. If you shared a PIN or OTP, you carry the loss until you report it.
Usually covered by RBI's rules
- Your card or account used without you
- A cloned card or hacked account you report fast
- A fault in the bank's own systems
Usually not covered
- A payment you approved after being tricked
- Losses before you report, if you shared a PIN or OTP
- Reports made long after the bank's alert
New RBI rules apply to commercial bank transactions from 1 January 2027. Zero liability for a third-party breach will need a report within five calendar days. For one year from that date, individuals who lose up to ₹50,000 can get a one-time compensation of 85% of the loss, up to ₹25,000, if they report to the bank and to 1930 or the portal within five calendar days.
If it already happened
- Track your complaint on cybercrime.gov.in with the acknowledgement number, and answer any police request quickly.
- Give your bank a written complaint as well, and keep its reference number and the date; under RBI's rules, when you reported matters.
- If you get an SMS saying money is on hold, apply for its release through the Money Restoration Module or ask the investigating officer how to apply.
- If your bank does not reply within 30 days or rejects your complaint, you can complain to the RBI Ombudsman at cms.rbi.org.in.
- Keep every SMS, email, statement and screenshot until the case is closed.
- Call 1930The national cyber fraud helpline. Call within hours if money left your account.
- cybercrime.gov.inFile a complaint online and keep the acknowledgement number.
- Chakshu on Sanchar SaathiReport a fraud call, SMS or WhatsApp number.
Questions
Is there a time limit to report cyber fraud?
How long does it take to get frozen money back?
Will my bank refund me if I shared my OTP?
Someone says they can recover my money for a fee. Is it real?
Realr does not check payments or recover money, but next time you deal with a stranger you can ask them to prove who they are with a Realr check first.
Ask them to verifySources
- RBI: Customer protection, limiting liability of customers in unauthorised electronic banking transactions (RBI/2017-18/15, 6 July 2017)
- RBI: Commercial Banks (Responsible Business Conduct) Third Amendment Directions, 2026 (RBI/2026-27/167, 24 June 2026)
- PIB (MHA): National cybercrime response mechanism, 22 July 2026
- MHA: Standard operating procedure for NCRP-CFCFRMS, custody, restoration of money and grievance redressal, 2 January 2026
- Moneylife: 1 lakh citizens benefit from cyber fraud refund system (June 2026)
- National Cyber Crime Reporting Portal



