If money has just gone, stop reading in a moment and make the call. Everything on this page can wait; the next few minutes cannot. Stolen money does not sit still. It lands in one account and is broken up and pushed onward, frequently within minutes, through a chain of further accounts held in other people’s names. Every action anybody can take depends on reaching an account while something is still in it. That is why the ordinary instinct — work out what happened, gather the details, write it up properly, then report — is exactly the wrong one here. A partial report made now is worth far more than a complete one made this evening. Three things follow, and they are the whole of the emergency. Report to your bank or payment provider and to the cyber reporting channel at the same time, not one after the other; they can do different things and waiting for the first before starting the second is how most of the available time gets spent. Do not delete anything — not the chat, not the call log, not the app — because the instinct to clear away something that feels contaminating destroys the record of what happened. And understand what success looks like at this stage: a freeze is not a recovery. Stopping money from moving further is the thing that is achievable quickly; getting it returned is a separate, slower process, and knowing that now saves a great deal of false hope later. One more thing, said plainly because it matters more than any procedure. You are not the first careful person this happened to today. These are engineered operations, run at scale, designed by people whose whole occupation is producing the exact moment you just had. Embarrassment is the single most expensive emotion available right now, because it costs hours. Make the call.
Understanding this one mechanic explains every piece of advice on the page, so it goes first.
Money taken from you does not arrive somewhere and stop. It lands in an account — frequently one belonging to somebody who has been paid a small sum to lend it, or who has themselves been deceived into providing it — and within a very short time it is broken into pieces and pushed onward to several more. Each of those does the same thing again. Within a few hops it has been converted into something that moves faster still.
So there is a window, and the window is not measured in days. Anything anybody can do — a hold placed, an account marked, a transfer stopped — requires reaching an account while the money is still inside it. This is why the advice is so insistent about minutes rather than accuracy.
It also explains something that otherwise looks unfair: two people can suffer identical frauds an hour apart and have completely different outcomes, with nothing separating them except when they picked up the telephone.
Every instinct pushes the other way. People want to understand before they report. They want to be able to answer questions. They do not want to sound confused, or to be told they are missing information.
Set that aside. The person taking your report does not need a narrative. They need to know that money left an account without authority and roughly what and when, so that something can be done about the account it went to. Everything else can be added later and almost always is.
So the rule for the first call is: say the essential facts, get the report on record, note the time, and supplement afterwards. If you do not know the exact amount, say approximately. If you do not know the reference, say you will provide it. If you are not sure how it happened, say you are not sure.
The only thing that cannot be supplied later is the hour you spent preparing.
This is the second thing people get wrong, and it costs as much as the first.
Your bank or payment provider can act on its own systems and its own customers: block the instrument, mark the transaction, communicate with the receiving institution. The national cyber reporting channel operates across institutions, and reaches accounts your bank has no relationship with. They do different work and neither one covers the other.
Yet the overwhelmingly common pattern is sequential: call the bank, be told it is being looked into, wait, hear nothing, and report to the cyber channel the next day. By then the chain has done its work.
So, practically: if there is anybody with you, hand them the second report while you are on the first call. If you are alone, make the bank call first because it is usually faster to reach, and start the second the moment it ends — not after you have taken a breath, not after you have told your family, not after you have checked the balance again.
There is a national channel for reporting financial cyber fraud, and it exists precisely because speed matters. This page prints no number, no address and no portal name, and the reason is worth stating: those details change, and a wrong one handed to somebody in the middle of an emergency is worse than no detail at all.
Two reliable ways to get the current one in under a minute. Ask your bank while you are already on the call — every bank has it and will give it to you. Or ask us, and we will tell you immediately, at no cost and without any engagement, because that is not the sort of thing anybody should be charging for.
What you should not do is search for it under pressure and use whichever result appears first. Fraudulent helplines advertised as recovery or complaint numbers are a known and active problem, and a person who has just lost money and is searching in a hurry is exactly who they are for.
The same caution applies to numbers found in messages, on social media replies to complaints, or given by somebody who telephones you. Get the number from the institution, not from the internet.
When something is achieved quickly, what is usually achieved is a hold: money in a downstream account is stopped from moving further. That is genuinely valuable and it is worth understanding exactly what it is and is not.
It is the interruption of a process. It is not a decision that the money is yours, not an order to pay it back, and not a guarantee that the amount held is the amount you lost. By the time a hold takes effect the original sum has usually been split several ways, and what sits in any one account may be a fraction of it.
Getting money returned from a held account is a separate stage with its own process, its own timeline and its own uncertainties — including the possibility that other people are claiming against the same account for the same reason.
We say this plainly not to discourage anybody but because false expectation causes real harm. People who believe a freeze means the matter is resolved stop following it up, and following it up is precisely what the next stage needs.
Sixty seconds of writing makes the call three times faster. On one sheet, or a note on another device:
Write that last one honestly. An incomplete account given out of embarrassment makes the report less useful and, occasionally, makes the difference between an institution being able to act and not.
And leave a space on the same sheet for what you are about to be given: the reference number, the name of the person, the time of the call. You will need all three.
After a fraud there is a powerful urge to erase it — delete the conversation, block and remove the number, uninstall the application, reset the phone. It feels like taking back control. It destroys the record.
Keep all of it, and capture it before anything changes:
Screenshot everything with the clock in the frame, and store the images somewhere other than the device concerned. If you believe the device itself is compromised, take it off the network and stop using it for anything financial — but do not wipe it, because it may matter.
Running alongside the reports, and often forgotten in the panic: the access that was used once may still be open.
Block the instrument that was used. Change the password on the account concerned, and then on anything that shares that password or uses the same registered email or number — which in most people’s lives is considerably more than they think. Review what is authorised on the account: standing instructions, mandates, linked applications, devices that are still signed in.
Check your email account with particular care. Access to an inbox is access to the reset mechanism for almost everything else, and an inbox that has been quietly reachable is how a single incident becomes a series.
And check whether anything has been changed rather than only whether money has gone: a registered number altered, a nominee added, an address updated, a beneficiary saved. Those changes are how a second attempt is prepared.
Within days, and sometimes within hours, somebody may telephone offering to recover what you lost. They may say they are from an authority, a cyber cell, a bank, a recovery agency, a portal you reported to. They may know details about your case, which is what makes it persuasive.
Treat it as part of the same fraud, because it almost always is. People who have just been defrauded are a market, lists of them circulate, and the second approach is frequently better prepared than the first — it arrives at a moment of distress, offers exactly what you want, and asks for something small to unlock it.
Three absolutes. Nobody legitimate telephones a stranger offering recovery in exchange for an advance payment. Nobody legitimate asks you to install an application during a call, whoever they say they are. And nobody legitimate asks for a code sent to your phone.
If you receive such a call, do not argue with it and do not try to establish who it is. End it, and report it — the call itself is useful information for the case you have already opened.
A short section, and the one that changes outcomes most.
The people running these operations do it full time. They use scripts refined over thousands of attempts, spoofed numbers, real-looking pages, genuine references to your own bank, and the two pressures that reliably suspend judgement in anybody: urgency and authority. Doctors, engineers, bankers and police officers have all had exactly the moment you just had.
The reason to say so is not comfort. It is that shame costs hours, and hours are the only currency that matters today. People who delay because they do not want to explain what they did, or who report an incomplete version to make themselves look less careless, reduce the chance of anything being stopped.
Nobody taking your report is judging you. They took several of these before lunch.
A very large share of these cases involve the person themselves entering, reading out or approving something. That is what the design is for.
It does not mean there is nothing to be done, and it does not mean you should report a different version of events. Report exactly what happened, including what you shared or approved. Institutions deal with this constantly and an accurate account is more useful to them than a flattering one.
What it does affect is the later conversation about liability, which turns on facts, on the circumstances and on how quickly the matter was reported. That last element is the one still in your hands — which is one more reason the timing of the first report matters as much as this page keeps saying.
Where that conversation becomes a formal dispute with your bank, it is a written process and our banking complaint guide sets out how it is conducted, escalated and evidenced.
The reporting steps are the same. What differs is the machinery behind them, and it is worth naming the instrument precisely when you call.
Two questions worth asking in the first call whatever the instrument: what have you done about the receiving account, and what is the next step from your side with a date? Both are answerable, and both give you something to follow up against.
Statements go unread, small amounts go unnoticed, and a good many frauds are discovered long after they happened. The advice does not change: report now.
Three reasons, even when the window has clearly closed. There may still be something in the chain, particularly where the fraud is continuing rather than a single event. A report on record with a date matters for everything that follows, including any claim about how the transaction was authorised. And the access that was used may still be open, which makes this a present risk rather than a past loss.
What changes with delay is expectation, not action. Be realistic about recovery and thorough about the record.
And check backwards while you are at it. Where one unauthorised transaction is found late, others are often found in the same statement, and a small one some weeks earlier is frequently the test that preceded it.
People do not report small losses, and the reasons are understandable: the effort seems disproportionate and nobody expects a hundred rupees back.
Report them anyway, for two reasons that have nothing to do with the amount. A small debit is frequently a test — a check that the access works before a larger attempt on the same route, which means a report now may prevent the real loss next week. And these operations run at volume, so the same receiving account appears in many reports; yours joins others, and that aggregation is often how anything is identified at all.
It takes ten minutes. And it puts a dated record on your own file, which occasionally matters a great deal later if the same account is used again.
Once the immediate steps are done, the work becomes written, and the written complaint is what every later stage is built on.
It should set out, in order: who you are and which account; what happened, in dates and times; what you reported, to whom, at what time, and with what reference; what you are asking the bank to do; and what you are attaching. Keep it factual and unemotional. A complaint that argues is weaker than one that states.
Send it through a channel that produces a reference, and keep everything. Our banking complaint service prepares these, and our banking complaint guide covers the ladder above it — escalation, the nodal route and the ombudsman stage — which this page does not repeat.
Two things to include that people leave out: the exact time of your first report, because it is frequently the single most important fact in the file, and a list of every reference number you have collected, so that nobody has to ask.
Reporting through the cyber channel and involving the police are connected rather than alternative, and in most cases both happen.
What matters first is that a report exists with a time attached to it. What follows — a written complaint at the appropriate police office, a first information report where the matter warrants it, and whatever the investigating officer then requires — is a process with its own shape.
This page does not set that shape out, because it belongs elsewhere: our police complaint drafting, FIR guidance and online FIR assistance services handle it, and they should be started in parallel with everything else rather than after the bank has finished responding.
One practical note for that stage: take your one-page record with you. A complaint supported by times, references and screenshots is treated differently from one that describes an upsetting event in general terms, and the difference is visible within the first two minutes.
Most cases do not fail loudly. They simply stop being anybody’s priority, and the person who follows up is the person whose file keeps moving.
A workable rhythm: ask, in writing, for the position within a reasonable interval of your report, quoting every reference you hold. Ask one specific question rather than a general one — what action has been taken on the receiving account, and what is the next step from your side and by when? — because a specific question is answerable and a request for an update is not.
Then repeat it at intervals, in writing, attaching the earlier correspondence each time. Two dated messages a fortnight apart are a record; ten messages in three days are a nuisance, and nuisances get set aside.
Where nothing moves at all, escalate once, formally, to the head of the relevant function, with the whole chain attached. Our application drafting service writes that letter, and the reasoning behind why the specific request outperforms the forceful one is set out in our application drafting guide.
Frequently the money is the visible loss and the identity details are the lasting one. A name, a date of birth, an identity number and a photograph of a document are enough to attempt a great deal in somebody else’s name.
So treat this as a second, continuing problem with its own actions. Check your credit record now and again in a few months, not once. Watch for accounts, loans or enquiries you do not recognise. Be alert to communications about products you never applied for, because those are usually the first visible sign.
Our credit record guide sets out how to obtain and read the record, and what to do about an entry that is not yours — which is a different process from the one on this page and needs to be started as soon as something appears.
Where documents of yours are circulating, be careful about how you supply documents in future: send what was asked for and nothing more, and prefer routes that do not leave a full copy in somebody’s inbox.
A pattern with its own shape: a group, a mentor, an application showing a balance that grows, small withdrawals that succeed early, and then a larger balance that cannot be withdrawn without one more payment — a tax, a fee, a margin, a verification.
Two things to understand, and the second is the harder one. The balance you can see is a display, not money. The application showing it is controlled by the people who took your funds. And the request for one more payment to release your funds is the design, not an obstacle within it. There is no amount at which the release occurs.
So the action is: stop paying, immediately, however far in you are; preserve the group, the application, the dashboard and the identities of everybody who introduced or encouraged you; and report with the same urgency as any other loss.
The reason this one needs saying explicitly is that the sunk cost is what keeps people paying. The most expensive decision available at that point is the next payment, not the previous one.
Another recognisable shape: a message offering simple paid tasks, small payments that genuinely arrive, then a set of tasks requiring a deposit, then a larger one, then an account that cannot be settled without clearing a “pending” balance.
The early payments are the investment the other side makes in you, and they are what makes the later requests credible. By the time the deposits become large, the person has been receiving money for a fortnight and has no reason to doubt the arrangement.
The same instruction applies: stop paying, preserve everything including the small successful payments, and report. And a caution about a second layer that often follows — being asked to receive and forward money for somebody else, which can place a person on the wrong side of a chain without understanding it. If that has already happened, say so when you report; it is far better disclosed than discovered.
Where the approach came through a marketplace, a messaging group or a platform, say which; that detail is frequently useful and almost always omitted.
Written carefully, because this is the version that people report least and lose most in.
An acquaintance builds over weeks or months — attentive, consistent, apparently ordinary. Then there is an investment they want to share, or a difficulty they need help with, or a package held somewhere requiring a payment. By then the person is not evaluating a proposal from a stranger; they are helping somebody they know.
The loss here is not only financial and the reluctance to report is understandable. Report anyway, and as quickly as in any other case, because the money moves the same way. Preserve the conversation from the beginning rather than the last few messages, and keep the profile, the photographs and anything sent to you.
Our matrimonial and dating app fraud service handles this specifically, including the platform side. And a plain thing to say to anybody in this position: being deceived by somebody who spent three months preparing to deceive you is not a failure of judgement.
A distinct problem that arrives in the same territory: an application that lends a small amount, takes access to contacts and photographs on installation, and then pursues repayment through threats, calls to family and colleagues, and material sent to people in the contact list.
Three things matter. Preserve everything — messages, calls, anything sent to your contacts — rather than deleting it out of embarrassment. Tell the people being contacted yourself, briefly and first, because the harassment depends on shame. And report it; this conduct is not a debt-collection practice you are obliged to tolerate.
Our fake loan app harassment complaint service deals with it, including the platform and the content side. Where material about you has been published, our content takedown request service handles removal.
Do not borrow further to settle it. The second loan from the same source is part of the same mechanism.
Where the loss is access rather than money, the order changes: secure first, then report.
Recover or lock the account through the platform’s own process, change the password, remove sessions and devices you do not recognise, and check the recovery email and number on the account — an altered recovery address is how an account is kept even after a password change.
Then tell people, quickly and publicly. An account that has been taken is usually taken in order to approach the people who trust it, and a message from you warning them is worth more than any amount of private tidying.
Our social media account hacking complaint service handles the recovery and reporting, and where the account is being used to impersonate or defame, our online defamation notice service covers the other half.
Businesses are targeted differently: an invoice with altered bank details, an email that appears to come from a director instructing a payment, a vendor whose account has been compromised, a payment diverted at the last moment before a deadline.
The emergency steps are identical and two more are added. Tell the counterparty immediately, because they may be compromised and may be about to lose money themselves. And check whether it is a single event — look at recent payments to the same vendor, and at whether anybody else in the organisation received the same instruction.
Afterwards, the control is dull and it works: verify every change of bank details by telephone, on a number you already had, before paying. Not on the number in the email, and not by replying to it. That single habit prevents almost all of this category.
Where the incident touches personal data held by the business, that is a separate obligation, and our data protection guide is the place to start.
Often the person who reads this page is not the person who lost the money — it is a son, a daughter, a colleague.
Two things matter more than any procedure. Do the urgent steps first and the conversation afterwards. The instinct to establish how it happened is strong and it costs the window. And do not scold. Shame is the reason frauds are reported late, and an older person who is made to feel foolish will not tell you about the next call — which, given that they are now on a list, is likely to come.
Practically: make the calls with them rather than for them where consent is needed, write the one-page record yourself, and take over the follow-up, which is tedious and is where families can genuinely help.
And afterwards, quietly reduce the exposure: separate the account used day to day from savings, review what is linked to a phone, and agree a simple rule in the household — that nobody acts on a call about money without telling one other person first.
Not a lecture, and not about being more careful. These are structural habits that limit damage regardless of judgement in the moment.
None of these depend on recognising a fraud, which is the point. The good ones are not recognisable, which is why they work.
Some of these end with money returned. Many do not. That is the plain position and everybody working in this area knows it, however it is presented to you.
What is genuinely within reach: stopping further loss, getting the incident properly on record, closing the access that was used, protecting against the identity side, and building a file that supports any claim you make about how the transaction was authorised.
What nobody controls: whether anything was still in the chain when it was reached, whether the accounts can be identified, and how long any of it takes. We would rather set that out on the first call than let a fee be paid on an impression we allowed to form.
And one consequence of saying it: if anybody tells you otherwise, particularly anybody charging for recovery, the confidence itself is the warning.
One document, added to as you go, and it will be the most useful thing you own in a month:
Keep it somewhere other than the device that was involved, and share it with one person you trust. Where copies of documents have to be produced for any of this, our notary affidavit and declaration services prepare whatever statement an institution or an officer asks for.
Not one of those was about being careless with money. All six were about the hours after.
Do not wait to have everything. Send what you have and keep going with the calls while you do it: the transaction entries with times, whatever messages or call logs exist, the reference number of any report you have already made, and one or two lines about how it reached you.
Tell us immediately if any of it is still in progress — a call scheduled, a payment they are pressing for, an application still installed — because that changes what we do first.
Clear phone pictures are enough and nothing needs to be neat. You will normally hear back within the hour in these cases rather than the same day, because that is the nature of it: what is urgent gets handled urgently and the paperwork follows.
And we tell you where things actually stand, including when the honest answer is that the window has closed and the remaining value is in the record and the protection rather than in recovery.
Preparing complaints, assembling evidence and conducting correspondence is our work. Conducting a case, appearing anywhere, or advising on the merits of proceedings is not. Court work is for your advocate, whose fee is engaged and paid by you directly; we do not quote, collect or share it. Our find an advocate page is where to start, and the arrangement is between you and them alone.
We will point you there early where it belongs there — a large loss, a dispute with a bank about how a transaction was authorised, or a matter that has moved into a proceeding — rather than after weeks of correspondence that was never going to be the answer.
Our work begins at ₹2,499, the usual span at our end is Same day – 3 days, you are told the entire figure before anything starts, and nothing is payable in advance — which matters more here than anywhere else on this site, because you have just lost money and should not be asked for more against a promise.
Telling you the correct reporting channel and what to do in the next ten minutes costs nothing and is not conditional on engaging us. Ask, and get on with it.
Anything a third party charges — a notary, an attestation, an official fee — is its own figure, is told to you separately, and never sits inside ours.
And the closing note, because the decisive part of this belongs to the next few minutes and not to us: call the bank now, not after you understand it. Report to the cyber channel at the same time, not afterwards. Delete nothing. Write down every time and every reference. Assume the recovery call is the same people. And do not let embarrassment cost you an hour — nobody taking your report is judging you, and the hour is the only thing you still control.
Stolen money moves through a chain of accounts within minutes, which is why the first hour is about speed rather than accuracy and why a partial report now beats a complete one tonight. Ask us for the current reporting channel and we will give it to you immediately, free and with no engagement. Then we put the evidence in order while it still exists, prepare the written complaint and the police documents, start both sides in parallel, and keep following it up — which is the stage at which these cases usually go quiet. What we will never do is promise recovery or take a share of it.
Two doors, both free. Clients search a factual directory of enrolled advocates. Advocates apply to be listed on it — no fee, no commission, nothing paid in either direction.
Search Bar Council enrolled advocates by what your matter is about, by court, or by city. Searching and sending a request are both free.
Enrolled advocates anywhere in India can apply to be listed. Your entry is published only after we verify your enrolment number with your State Bar Council.
This directory carries no ratings, no reviews, no rankings and no fees — only the factual particulars the Bar Council of India permits, published at each advocate's own request. Browse the network · Terms for Advocates