Bank account frozen by cyber police? What to do if you received tainted money without knowing

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Innocent people get caught when scam money passes through their account, often after a P2P crypto sale or a payment for work. How to find out who froze it, use the free grievance route, and cite High Court rulings against blanket freezes.

01 / Why an innocent account gets frozen

When a fraud victim reports on 1930 or cybercrime.gov.in, police trace the money from account to account and ask each bank on the trail to hold it. The Home Ministry's SOP of 2 January 2026 says money can be held at any layer. A draft RBI direction defines a mule account as one used "knowingly or unknowingly" to receive or move fraud proceeds.

So you can be caught up even if you did nothing wrong. It happens when a buyer in a peer-to-peer crypto trade paid you with stolen money, or when a client, tenant or customer paid you from a fraud. The SOP tells investigating officers to consider that an account may have been used without the holder's knowledge or consent.

02 / Lien or debit freeze: know which you have

A lien blocks a specific amount, and you can still use the rest of your balance. A debit freeze blocks the whole account. Several High Courts have pushed back on blanket freezes:

• Delhi HC (Neelkanth Pharma Logistics v. Union of India, 20 February 2025): an account with about ₹93.5 crore had been frozen over a suspect credit of ₹200. The court said a lien on the disputed amount should ideally be "the first and foremost option".
• Bombay HC (Nagpur bench): only the disputed amount can be placed under lien. The court held that Section 106 BNSS does not permit a debit freeze of the whole account, and that attachment needs a Magistrate's order under Section 107.
• Allahabad HC (Khalsa Medical Store v. RBI): police may seek a lien on a specific amount but may not ask a bank to block an entire account. The jurisdictional Magistrate must be told within 24 hours.
• Rajasthan HC (Justice Sameer Jain): a freeze can be imposed without prior notice, but it must be proportionate and reviewed from time to time. The court asked petitioners to use the SOP's grievance route first.
• Rajasthan HC (Jaipur bench, Shree Balaji Enterprises v. RBI and connected petitions, Justice Anand Sharma, 20 August 2026): deciding a batch of 105 petitions, the court said that where the disputed amount can be identified, the "ordinary course" is to hold that amount by lien rather than freeze the whole account. A full freeze is still possible, for example where there are mule-account indicators, repeated transactions or the holder's conscious involvement, but the reasons must be recorded and sent to the bank. Banks must not mechanically turn a request to hold one amount into a blanket freeze unless the police communication and the material in it justify the wider action. They must also make clear whether a restriction is their own KYC or anti-money-laundering action or a police restraint. These directions cover cyber-crime investigations in Rajasthan. The court also told RBI to issue a circular requiring banks to train their staff, and asked RBI and the Rajasthan police chief to report compliance within eight weeks.
• Gauhati HC (Justice Manish Choudhury, a footwear shop owner's petition against Bandhan Bank, WP(C) 2308/2026, 18 September 2026): his current account had been fully blocked since December 2020 over a suspicious credit of ₹1,700. The bank said it acted on a cyber complaint received through the Cyber Crime Incident Response Unit, Ahmedabad. The court said that when investigators specify an amount, the bank must place a lien to that extent and let the holder use the rest, unless the direction itself is for a complete freeze or a law requires one. It limited the restraint to ₹1,700, subject to the holder submitting a KYC form.

How courts apply these rulings depends on the facts, so consider consulting a lawyer if a large amount is involved.

03 / Find out who froze it

Ask your bank in writing for:

• the police station and state that sent the order;
• the NCRP acknowledgement number or case reference;
• the amount involved;
• whether it is a lien or a full debit freeze.

The SOP says the bank may give you the contact details of the police unit that ordered the action. It cites a Financial Intelligence Unit clarification of 2 June 2025 that sharing this is not a "tip-off". The bank will not give you the victim's details.

04 / Use the free Grievance Redressal Module

The SOP sets up an online grievance route that you enter through your bank branch:

• Branch: visit your branch with your explanation and documents. After due diligence, the bank should file your grievance on the portal within 7 days.
• Investigating officer: the IO verifies it, preferably by video call, and should decide within 15 days. If satisfied, the IO tells the bank to lift the hold.
• District Grievance Officer (Additional SP or DSP): gets the case automatically if the IO does not act in time, or you can ask for a review within 15 days of a refusal.
• State Grievance Officer (ADG, IG or DIG): hears an appeal against a seizure or suspension that is continued.
• 90-day rule: if no lawful direction to continue a contested hold arrives within 90 days, the bank should start removing it. Police can extend a hold by up to 90 days.
• Court: you can go to court at any stage.

On 4 August 2026 the Supreme Court recorded that the module covered 1,23,590 branches of 69 banks. It said people should ordinarily be encouraged to use it first, without losing any other legal remedy.

05 / Build your explanation

• Records of the P2P trade: order IDs, exchange chats and the buyer's profile.
• Invoices, contracts or emails for work or goods you supplied.
• Bank statements showing your normal pattern of transactions.
• ITR or GST records if the payment was business income.

If the IO sends you a notice, reply within the time given. The SOP allows up to 15 days.

06 / RBI's draft rules for holds banks place themselves

On 11 September 2026 RBI published draft Know Your Customer (KYC) Amendment Directions, 2026. The Supreme Court's order of 4 August had told RBI to adopt a procedure for temporary debit holds on amounts or accounts linked to money-mule activity. RBI invited comments until 2 October 2026. The rules would take effect on 1 April 2027, or earlier if a bank chooses. Update, 30 October 2026: comments closed on 2 October and RBI has not yet issued final directions. At the Supreme Court on 29 October, the Attorney General said RBI's measures were likely to be in place by December, LiveLaw and Business Standard reported (our report).

What it covers. The draft sets a procedure for holds that a bank places on its own, after its monitoring systems flag a payment. It says this process does not apply where a hold is placed or continued on a specific police instruction. For a freeze ordered by cyber police, the Home Ministry SOP and its grievance route in section 04 still apply. The draft would apply to commercial banks, including small finance banks, payments banks, regional rural banks and local area banks, and to urban cooperative banks. Nodal, pool, escrow and other special-purpose accounts are left out.

The draft proposes:

• Threshold: a "suspected money mule transaction" is one of ₹1,000 or more that the bank's systems, including AI tools, flag. The draft's examples: a payment that is unusual for, or out of proportion to, your declared profile, or one linked to an account already reported as a mule or fraudulent.
• Amount first: the bank holds the flagged transaction, and the whole account only if the account itself is suspected. Each bank's policy must use account-level holds "as a last resort and only in exceptional circumstances".
• Notice: immediately if the bank has your mobile number or email, otherwise by the end of the next day. It must give the reasons, the process for removal and an officer's contact details.
• Your reply: you get 20 days from the hold to explain. The bank decides within 10 days of your reply, or within 30 days of the hold if you do not reply.
• Police referral: if the bank keeps the hold, it reports the case to the police station concerned through NCRP-CFCFRMS, the cybercrime portal's fraud reporting system, and tells you. If no direction to continue arrives from the police or a competent authority, such as a court, within 30 days of that referral, the bank removes the hold on the 31st day.
• Upper limit: 60 days from the hold, unless the police or a competent authority directs otherwise.
• Complaints: banks would list nodal officers on their websites and in branches, and resolve complaints within 30 days.

Like the High Court rulings in section 02, the draft limits whole-account holds. It is a proposal, not a rule yet, and the final directions may change.

07 / Warnings and checklist

• Get the police unit, reference number and amount from your bank in writing.
• Ask whether the hold was ordered by police or is the bank's own KYC or anti-money-laundering action, so you know which route applies. For a police hold, use the Grievance Redressal Module in section 04. For the bank's own action, complain to the bank in writing first, then go to the RBI Ombudsman if the bank does not resolve it. How to complain to the RBI Ombudsman.
• File a grievance through your branch and keep the receipt.
• If the whole account is frozen, ask for a lien on the disputed amount only.
• Do not pay "agents", and do not send money to strangers to "settle" the case.
• Never let others use your account. Knowingly lending it for payments can expose you to criminal charges. How mule accounts work.

08 / Sources and updates

Confirmed (official and court documents): the Home Ministry SOP of 2 January 2026; RBI's press release and draft directions; and the Rajasthan (20 August 2026) and Gauhati (18 September 2026) High Court judgments, which we read in copies published by LiveLaw and Indian Kanoon. Reported (legal and business media): the Delhi, Bombay and Allahabad rulings, the earlier Rajasthan ruling by Justice Sameer Jain, the Supreme Court's remarks on the grievance module (4 August 2026), and Business Standard's explainer on the draft. LiveLaw and Bar & Bench reported the Rajasthan ruling, and SCC Online the Gauhati ruling.

Update, 1 October 2026: section 06 now sets out the RBI draft's threshold, notice and decision timelines, police referral, scope and comment deadline, taken from the draft itself. Section 02 adds the Rajasthan High Court ruling of 20 August 2026 and the Gauhati High Court ruling of 18 September 2026. Section 07 adds a check on who placed the hold, and where to complain in each case.