How to get money back after cyber fraud: the real routes, the odds and 'recovery' scams

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Only police, banks, regulators and courts can return scammed money. The honest odds from official figures, RBI's liability rules and the 2027 compensation scheme, the free Ombudsman route, and how to spot fake recovery agents.

01 / The honest odds

Official figures show that recovery is the exception, not the rule:

• Held vs restored: the Home Ministry's January 2026 SOP says that from April 2021 to November 2025, ₹52,969 crore was reported lost. ₹7,647 crore of that was stopped from leaving the system, but only ₹167 crore was actually restored to victims.
• Cumulative total: by 30 June 2026, the government said more than ₹11,158 crore had been "saved" across 32.80 lakh complaints. "Saved" means held, not returned.
• Victims' experience: in the Status of Policing in India Report 2026 by Common Cause and Lokniti-CSDS, 72% of digital-fraud victims surveyed said they recovered nothing. That was despite 63% having told their bank within 24 hours.

Speed is the one thing you control. See what to do in the first hour.

02 / Route 1: 1930, NCRP and restoration

Report on 1930 and cybercrime.gov.in so the police can have the money held. If money is held, apply through the Home Ministry's Money Restoration Module or a court. Our guides cover getting held money released and tracking your complaint.

03 / Route 2: your bank and RBI's liability rules today

RBI's circular of 6 July 2017 covers unauthorised electronic transactions:

• Zero liability if the bank was at fault. You also owe nothing for a third-party breach that you report within three working days of the bank's alert.
• Four to seven working days: your liability is capped at ₹5,000 to ₹25,000, depending on the account.
• Credit and resolution: the bank must credit the disputed amount within 10 working days of your report, and resolve the complaint within 90 days.

Complain to your bank in writing, whether or not you think the payment counts as authorised.

04 / What changes on 1 January 2027

On 24 June 2026, RBI issued amendment directions that take effect on 1 January 2027. Under the version for commercial banks:

• Wider coverage: a "fraudulent" transaction now includes one made with credentials obtained from you by fraud, or one you approved under coercion or duress.
• Reporting window: zero liability for a third-party breach reported within five calendar days.
• Bank deadlines: the bank must decide within 45 days, or 60 days for cross-border cases. Any reversal must be value-dated to the date of the fraud, so you lose no interest.
• Compensation where you were negligent: individuals whose gross loss is up to ₹50,000 get 85% of the net loss or ₹25,000, whichever is less. You must have reported on NCRP or 1930 and to your bank within five calendar days. You can claim this only once in your lifetime. It covers frauds in the first year after the rules take effect, and the bank pays within five days of your application.

05 / Route 3: the RBI Ombudsman and consumer commissions

The Reserve Bank Integrated Ombudsman Scheme, 2026 took effect on 1 July 2026.

• When: complain to the bank first. You can go to the Ombudsman if the bank does not reply within 30 days or you are unhappy with its answer.
• Deadline: you then have 90 days to file.
• Where: online at cms.rbi.org.in, or through the toll-free number 14448.
• Cost: nothing. RBI says you do not need any third-party agency.
• Awards: up to ₹30 lakh for consequential loss, plus up to ₹3 lakh for harassment and expenses.

A police investigation does not count as the same grievance, so you can pursue both at once.

For deficiency of service, you can also go to a consumer commission. The e-Daakhil filing system is now part of e-Jagriti. Consider consulting a lawyer before filing.

06 / Route 4: the courts

A Magistrate can order held money released under Section 503 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), which replaced Section 457 of the old CrPC. Some states also use Lok Adalats to clear these cases. A lawyer can help with this step.

07 / The recovery scam

Under the SOP, money on hold is released only by a police notice under Section 106(3) BNSS or by a court order. No private agency, "ethical hacker" or recovery service can move it.

The FBI has warned about fake law firms that go after scam victims. Their red flags apply in India too:

• They claim to be tied to the government.
• They know the exact amounts and dates of your losses.
• They move you into WhatsApp groups.
• They ask for upfront "fees".

The FBI says law enforcement does not charge victims to investigate. Be equally wary of calls from so-called cyber police or lawyers who ask you to pay to release a refund. Hang up and verify through 1930.

08 / Your checklist

• Report on 1930 and NCRP right away.
• Complain to your bank in writing within three working days (five calendar days from 2027).
• If money is held, apply through the Money Restoration Module or a court.
• If the bank does not settle within 30 days, go to the RBI Ombudsman.
• Think about a consumer commission case for bank deficiency.
• Never pay a recovery agent, hacker or "officer".
• Report any recovery offer on 1930.