If you suspect a fraudulent payment, stop interacting with the caller or chat account. Contact your bank immediately through its official channel and report the incident through India’s 1930 financial cyber-fraud helpline and National Cyber Crime Reporting Portal. Preserve the transaction reference and follow the reporting instructions you receive. Early reporting can help intervention, but it does not guarantee recovery.
What to do now
- Protect the account: tell the bank what happened and ask it to block affected payment access or take other appropriate protective action. If the phone may be compromised, use another trusted device to contact the bank.
- Report the fraud: call 1930 promptly and complete the portal complaint and any follow-up requested. Do not wait to assemble a perfect file before starting the report.
- Preserve evidence: save transaction IDs, amounts, dates, recipient details, messages and complaint acknowledgements. Do not keep exchanging messages to investigate the scam yourself.
- Secure affected access: follow the bank’s recovery instructions. Review unfamiliar sessions and payment mandates through official services.
The Ministry of Home Affairs describes the reporting system’s role in coordinating action on financial cyber fraud. A report is the start of a process, not a promise that a beneficiary account has already been frozen.
Recognise the action you are being asked to take
| Story you hear | Action to question | Safer response |
|---|---|---|
| “Approve this to receive a refund” | An outgoing payment or recurring mandate | Read the screen; contact the merchant through its official channel |
| “Install this KYC or invitation file” | An APK sent through a message | Do not install it; independently open the official app or website |
| “Customer care needs to see your screen” | Remote access, PIN or OTP disclosure | End the call and obtain support details from the official service |
| “I overpaid; send the difference elsewhere” | A refund to a different recipient | Check the actual bank credit and ask the bank how to handle it |
| “Pay immediately to avoid arrest or release a prize” | A pressured transfer to an unfamiliar account | Stop and verify the claim independently |
NPCI’s fraud guidance warns against approving a payment QR and PIN request on the promise of receiving money. The precise rule is to understand the action, not “PIN always means a debit”: PINs can authenticate other functions too. Never disclose one to another person.
What RBI’s limited-liability rules actually say
The RBI’s 6 July 2017 circular distinguishes bank fault, third-party breaches and customer negligence. In qualifying third-party breaches where neither bank nor customer is at fault, notification within three working days of the bank’s communication gives zero customer liability. Where a customer negligently shares payment credentials, losses before reporting are treated differently. A transfer you were tricked into authorising also requires examination of the facts; a three-day refund promise is unsafe.
Describe exactly what occurred, including whether you approved a payment, disclosed information or found a debit you did not authorise. Ask the bank for a written decision and its reasons. Do not conceal details to fit a particular claim category.
Build a useful complaint record
Keep one chronology: time of contact, payment time, discovery, bank report, cybercrime report and each response. Attach evidence through official channels only. A public social-media complaint should not reveal account numbers, identity documents, OTPs or full private messages.
If the bank’s resolution is unsatisfactory, use its grievance process and check the current eligibility and waiting-period rules in the RBI Ombudsman guidance before escalating through RBI CMS. Payment-network resolution periods can affect when a complaint is eligible.
Reduce risk without blaming the victim
Enable device and app locks, keep apps updated, verify payees and review transaction alerts. Discuss a simple household habit: pause a pressured payment and contact the organisation independently. With the account holder’s consent, help them find official support and understand payment screens. No checklist makes someone immune to fraud, and a victim should not be discouraged from reporting because a scam was convincing.
Be wary of a second scam promising recovery for an upfront payment. Legitimate reporting does not require sending a “release fee” to a stranger. For technical payment failures rather than fraud, start with the UPI payment guide.
Reviewed on 27 October 2026. This is general safety information; liability and recovery depend on the evidence, applicable rules and the handling authority.
Techleez Editorial Team
The Techleez publishes practical digital guides. For our scope, use of AI assistance and corrections process, read our editorial policy.
More from this author →
