In short. Stop paying, call 1930 or file on cybercrime.gov.in with every transaction ID, and then register an FIR at the cyber police station. Banks can freeze the money in the receiving accounts. To get frozen money back, you apply to the magistrate with the FIR, your bank statement and an indemnity bond. Ignore anyone who offers to recover the money for a fee.
This post is about two kinds of fraud that now account for a large share of cyber complaints in Delhi NCR: part-time job or 'task' scams, and investment scams run through WhatsApp groups, Telegram channels and fake trading apps. It covers how the scheme is built, what to do once you realise, which offences apply, and how money is actually traced and returned. For a single fraudulent UPI transaction, such as a fake buyer or a QR code trick, our post on reporting and recovering money lost in a UPI fraud is the better starting point.
Victims of these scams are not careless people. They include software engineers, chartered accountants, retired officers and homemakers. The schemes are run by organised groups, often with call centres outside India, and they are designed by people who understand exactly how trust is built and how to keep someone paying. Shame keeps many people from reporting, and that silence costs them the few hours in which money can still be stopped.
- Report first
- Helpline 1930 or cybercrime.gov.in, as soon as possible
- FIR
- Cyber police station; e-Zero FIR in Delhi for losses above ₹10 lakh
- Main offences
- Section 318(4) BNS cheating; sections 66C and 66D IT Act
- Freezing
- Banks place a lien on the traced amount in receiving accounts
- Getting money back
- Application to the magistrate for release of the frozen amount
- Bank liability
- RBI zero-liability rules do not cover payments you authorised
How does an online task or job scam work?
It starts with a message on WhatsApp, Telegram or Instagram offering part-time work from home: liking YouTube videos, rating hotels or products, writing reviews, or 'boosting' app downloads, for ₹50 to ₹200 per task. The first few tasks are real in the sense that you are paid, promptly, into your bank account. That small payment is the hook. It proves to you that the work is genuine and it gets your bank details.
Then you are moved to a Telegram group with a 'mentor' and other 'members' who post screenshots of their earnings. The tasks change. You are now asked to make a 'prepaid' or 'merchant' task: deposit ₹1,000 to get a task that pays ₹1,300. That also pays out. The next one asks for ₹5,000, then ₹30,000, then ₹1.5 lakh for a 'combination task' that must be completed in one go. At this point the balance on the website shows large profits, but withdrawal is blocked because of an 'error', a 'negative score', or a 'tax' or 'unfreezing fee' that must be paid first.
The other members of the group are usually part of the scam. The website is a shell built for the purpose. And the payments go not to a company but to a chain of personal and small-business bank accounts, rented from people who sell access to their accounts for a commission. Each time you pay, a different account is given. That detail matters later, because every account you paid into is a lead for the police.
How do WhatsApp stock tips and fake trading app scams work?
The investment version is slower and usually involves larger sums. You are added to a WhatsApp group named after a well-known fund manager, a brokerage or a 'research institute'. For a few weeks the group shares free stock tips, some of which work, and lectures on trading. Then members are invited to open an account on a special app or website for 'institutional' trading, IPO allotments at a discount, or block deals not available to ordinary investors.
The app looks like a real trading platform and shows your investment rising. Some apps use the name and logo of a genuine broker. You add more money. When you try to withdraw, you are told to pay a service charge, a 20% profit share, a 'SEBI fee' or tax in advance. When you refuse or run out of money, the group disappears and the app stops working. There was never any trading: the numbers on the screen were typed in by the operators.
Variants include crypto platforms that show high returns, 'forex' schemes, and romance-led investment frauds in which someone you met online slowly introduces you to a platform. The legal response is the same in each case. What changes is how far the money has travelled, because crypto and overseas withdrawals are much harder to trace than money sitting in an Indian bank account.
Signs that you are dealing with a scam
If any of these has happened to you, stop paying before anything else. Paying 'one last fee' to release your profits has never released anyone's money in these schemes.
- You must pay to earn. No genuine employer asks a worker to deposit money before giving out tasks or paying salary.
- Each payment goes to a different account. A real company collects money in its own name, not through individuals' savings accounts or unrelated shops.
- Withdrawal needs a fee or tax first. Genuine platforms deduct charges and tax from what they pay out; they do not ask for fresh money to release your balance.
- The app is not on an official store, or is downloaded from a link. Fake trading apps are often installed through an APK file or a web link sent on WhatsApp.
- The adviser or broker is not registered with SEBI. SEBI-registered intermediaries can be checked on SEBI's website, and since October 2025 registered intermediaries collect payments through validated UPI IDs with the '@valid' handle, which can be verified with the 'SEBI Check' tool.
- There is pressure and secrecy. Deadlines, 'limited slots', and instructions not to tell your family or your bank are standard features.
I have been scammed. What should I do in the first hour?
Stop all payments, then report. Call 1930, the national cyber fraud helpline run under the Indian Cyber Crime Coordination Centre, or file a financial fraud complaint on cybercrime.gov.in. Give every transaction: date, time, amount, UTR or reference number, and the account number or UPI ID you paid. The helpline enters the complaint into a system shared with banks and payment apps, which allows the receiving bank to put a hold on the money if it is still there.
Call your own bank's fraud line too, and ask it to raise the fraud report with the beneficiary banks. Do not close your own account, and do not delete the app, the chats or the Telegram group, even if you feel like wiping it all. Take screenshots of the chats, the group members, the website or app showing your 'balance', and the payment confirmations, then export the WhatsApp and Telegram chats with media.
Write down the complaint number (the acknowledgement number from the portal or the 1930 call). You will need it for the FIR, for the bank, and for the court later. If the fraudsters contact you again, do not argue or threaten. Some victims are told their 'account will be frozen by police' unless they pay more; that is part of the same script.
Reporting the fraud: from 1930 to an FIR
A 1930 call or portal entry is a complaint, not an FIR. Both are needed. The steps below are how it usually runs in Delhi, Noida and Ghaziabad.
Call 1930 or file on cybercrime.gov.in
Choose 'financial fraud' and enter each transaction separately with its reference number. Note the acknowledgement number. Report all payments, not only the large ones, because the small early ones often identify the first-layer accounts.
Inform your bank in writing
Email your branch and the bank's fraud desk with the transaction list and the acknowledgement number. Ask for a written confirmation that the fraud has been reported to the beneficiary banks.
Go to the cyber police station
In Delhi each police district has a cyber police station; in Noida and Ghaziabad, the district cyber police station or cyber cell. Carry a written complaint, printouts and a pen drive with the evidence. Losses above ₹10 lakh reported on 1930 or the portal in Delhi are converted into an e-Zero FIR, and the victim must visit the police station within three days to have it converted into a regular FIR.
Get the FIR registered
Cheating under section 318(4) BNS carries up to seven years, so the police may hold a short preliminary enquiry of up to 14 days under section 173(3) BNSS before registering. Ask for the FIR number and a copy, which you are entitled to free of cost.
Follow up with the investigating officer
Give the IO a single, ordered file: a transaction table, chat exports, the app or website link, and the list of accounts paid. Ask which accounts have been frozen and how much is held in each. Keep notes of every visit.
Apply for release once money is frozen
When the IO confirms that an amount traceable to you is held, apply to the magistrate for its release, as explained below.
If the police refuse to register an FIR despite a clear cognizable offence, you can write to the DCP and then apply to the magistrate under section 175(3) BNSS. Our post on what to do when the police refuse to register an FIR covers that route, and our post on zero FIR and e-FIR explains how online FIRs work.
Which offences apply to job and investment scams?
Most FIRs in these cases cite several sections together. The ones that usually appear are below.
Section 318(4), BNS
Cheating and dishonestly inducing delivery of property, punishable with up to seven years and fine. This is the core offence: you were deceived into paying money. It replaced section 420 IPC.
Section 319, BNS
Cheating by personation, where the fraudster pretends to be someone else, such as a known brokerage, a fund manager or an employer.
Section 61, BNS
Criminal conspiracy, which ties together the callers, the group operators and the people who rent out bank accounts.
Sections 111 and 112, BNS
Organised crime and petty organised crime. Section 111 expressly includes cyber crimes committed by an organised crime syndicate, and investigators increasingly invoke it in large multi-victim scam networks.
Sections 66C and 66D, IT Act 2000
Identity theft (fraudulent use of passwords or other identification features) and cheating by personation using a computer resource. Each carries up to three years and fine.
Section 107, BNSS
A new power under which the police can ask the magistrate to attach property, including money in bank accounts, that is the proceeds of crime. Courts have said that freezing and attaching proceeds must follow the procedure the law lays down.
Where does the money go, and how is it traced?
Your money first lands in a 'first-layer' account, usually a savings account or a small current account opened in the name of a real person who has sold or rented access to it. Within minutes or hours it is split and sent on to second and third-layer accounts, withdrawn at ATMs, used to buy gold or gift cards, or converted into crypto such as USDT and moved abroad. These rented accounts are known as mule accounts.
When you report on 1930, the complaint travels through a system linking banks, payment apps and the police. The receiving bank checks whether your money, or part of it, is still in the account and marks a lien or debit freeze on that amount. The same is done down the chain as far as the money can be followed. This is why reporting in the first hours matters so much: an amount sitting in the first-layer account can be held; the same amount scattered across fifteen accounts in three states is much harder to hold.
When Advocate B.K. Singh reads the transaction trail in a scam case, the first thing he looks for is which payments went to accounts that were frozen with money still in them, because those are the payments where recovery is realistic, and the release application should be built around them. Payments to accounts that were emptied before the freeze are pursued through the investigation and, where the account holders are found, through the criminal case and civil claims.
How do you get frozen money back?
Money frozen by a bank on a police request does not come back to you automatically, even when the bank knows it is yours. It is treated as property connected with an offence, and its release needs an order. The usual route is an application to the magistrate having jurisdiction over the police station, under the BNSS provisions on custody and disposal of property during investigation and trial (sections 497 and 503, the successors of the old sections 451 and 457 CrPC).
The application sets out the FIR, the transactions, the account in which your money is frozen and the amount, and asks for release to you. The court calls for the IO's report, which should confirm the trail from your account to the frozen account. Courts commonly order release on an indemnity or surety bond and an undertaking to return the money if the court later directs. Where several victims' money is mixed in one account, the court may divide what is available among them in proportion to what each lost.
This takes time, typically weeks to a few months depending on the court and how quickly the IO files a report. The most common cause of delay is an IO report that does not clearly link your payment to the frozen amount, so give the IO a clean transaction table and follow up for the report. In large matters handled by the Economic Offences Wing or the IFSO unit of Delhi Police, the same principle applies, though the volume of victims means the process can be slower.
What recovery realistically looks like
No one can promise recovery in these cases. This is how the chances usually change with what happened to the money.
| Situation | What can usually be done | Realistic outlook |
|---|---|---|
| Reported within a few hours, money still in the first account | Freeze on the full or part amount; release application to the magistrate | Recovery of the frozen part is often achievable, with patience |
| Reported after several days | Freeze on whatever remains in the accounts traced | Usually partial; the rest depends on the investigation |
| Money withdrawn in cash or converted to crypto | Investigation of account holders and exchanges; possible arrests | Recovery is slow and uncertain |
| Account holders traced and arrested | Seizure, attachment under section 107 BNSS, compensation at trial | Possible, but over a long period |
| Money sent abroad | Requests through agencies and international channels | Low in most cases |
| You paid through a genuine broker's account | Not a scam in the same sense; dispute with the broker through SEBI and the exchange | Depends on the broker's records |
Can the bank be made to pay for the loss?
Usually not, for the loss itself, and it helps to understand why. The RBI's 2017 framework on customer liability for unauthorised electronic banking transactions protects you when money leaves your account without your authority, such as when your card or UPI is misused. In job and investment scams you made the payments yourself, after being deceived, so they are authorised transactions. The zero-liability rules do not apply to them.
The bank can still be accountable for its own failures. If it ignored a timely fraud report, delayed passing it to the beneficiary bank, or refused to give you the transaction details you need, that may be a deficiency in service. The receiving bank's role in opening and running a mule account is a harder question, and courts and consumer commissions have treated it case by case. These claims go to the RBI Integrated Ombudsman or the consumer commission; our post on bank deficiency in service and the consumer court explains when each fits.
Do not delay the police complaint while you argue with the bank. The freeze depends on the police and the banking system acting quickly, not on who is ultimately responsible.
Your own account frozen because scam money passed through it
A side effect of task scams catches many victims off guard. The small 'salary' payments you received at the start often came from another victim's money. When that victim reports, the trail leads to your account, and your bank account is frozen as a suspected recipient, sometimes weeks after you lost your own money.
If this happens, do not panic and do not ignore it. Find out from the bank which police station or which complaint caused the freeze, and approach the IO with your own FIR, your bank statement and a short explanation. The freeze should be limited to the disputed amount, and courts have been critical of freezes on entire accounts without justification. Our post on getting a bank account unfrozen after a cyber complaint explains the remedies, including an application to the magistrate and, where the freeze is plainly unlawful, a writ petition.
A made-up example: the hotel rating 'job'
Here's a made-up example. Ritu, who lives in Indirapuram, Ghaziabad, receives a WhatsApp message offering ₹150 per hotel rating. She does six ratings on the first day and receives ₹900 in her account from an unknown individual. Over the next nine days, she is moved to 'prepaid tasks' and pays ₹6.4 lakh in fourteen transactions to eleven different accounts. The website shows a balance of ₹11 lakh. When she tries to withdraw, she is asked for ₹1.8 lakh as 'tax'.
She tells her husband, and that evening they call 1930 and file on the portal. The next morning they go to the cyber police station with a printed table of all fourteen transactions and the exported chats. An FIR is registered under section 318(4) BNS and sections 66C and 66D of the IT Act. The IO's inquiry shows that ₹2.1 lakh is still held in three of the accounts; the others were emptied within hours of each payment.
Ritu's advocate files an application before the magistrate for release of the ₹2.1 lakh, with the FIR, her bank statement, the IO's report on the trail and an indemnity bond. The court orders release after a few hearings. The remaining ₹4.3 lakh depends on the police tracing the account holders, which may take much longer. Three weeks later, her own account is briefly frozen because the ₹900 she received came from another victim, and the IO clears it after she shows her own FIR. Her outcome is a typical one: partial and slow, and better than it would have been if she had waited a week before reporting.
Beware the second scam: 'recovery agents'
Once you have lost money, you become a target again. Victims receive calls from people claiming to be from a cyber cell, a 'fraud recovery company', a bank's legal department or even a law firm, who say your money has been traced and can be returned on payment of a processing fee, tax or legal charge. Some create fake websites and fake court documents. All of this is another scam.
Police and banks do not charge fees to return frozen money. Money is released only by an order of the court, paid by the bank to your own account. If anyone asks for a payment to recover your loss, report that number on 1930 as well. And search for anyone offering legal help before you engage them: a genuine advocate will meet you, tell you who they are, and never ask you to pay into a personal account in someone else's name.
Documents to put together for the complaint and the court
Money trail
- Bank statement showing every payment
- UPI or NEFT confirmations with UTR or reference numbers
- List of every account number and UPI ID you paid
- Any amounts you received back, with dates
- 1930 or portal acknowledgement number
The scheme
- Exported WhatsApp and Telegram chats with media
- Screenshots of the website or app showing your balance
- Link to the app or website and how you installed it
- Phone numbers, usernames and group names
- Any fake certificates, IDs or agreements sent to you
For release of frozen money
- FIR copy
- IO's report or letter confirming the frozen amount
- Identity and address proof
- Cancelled cheque or account details for release
- Indemnity bond, if the court asks for it
Can you sue the account holders directly?
Sometimes. Where the investigation identifies the people whose accounts received your money, and particularly where they are traced to addresses in India, a civil suit for recovery against them is possible, alongside the criminal case. Account holders who knowingly lent their accounts for a commission have little defence on the merits, though many have little money either. A civil claim makes sense mainly where the amount is large and the defendants have assets.
In most cases the better use of time is to follow the criminal case closely: press for the IO's report, oppose release of frozen money to anyone else, and apply for compensation from the accused when the case reaches that stage. Where the fraud is large and has many victims, the case may be taken up by the Economic Offences Wing, and the approach is closer to that described in our post on how investors recover money in Ponzi and chit fund frauds.
Mistakes that cost victims money
- Paying the 'release fee'. Every additional payment goes the same way as the first. There is no withdrawal at the end.
- Waiting before reporting. Victims often spend a day or two trying to negotiate with the fraudsters or recover the money themselves. By then the money has moved.
- Reporting only the big payments. The small early payments identify accounts too, and each is a separate lead.
- Deleting chats and apps. Embarrassment leads people to wipe their phones. The chats, numbers and app links are the core evidence.
- Treating the 1930 call as the end of it. A complaint without an FIR and follow-up rarely leads to a release order.
- Trusting recovery agents. Anyone who asks for money to return your money is running a second scam.
Today and this week
- Stop all payments to the scheme, whatever you are told about losing your balance.
- Call 1930 or file on cybercrime.gov.in with every transaction listed.
- Email your bank's fraud desk with the transactions and the acknowledgement number.
- Export the chats and screenshot the app or website before it disappears.
- Go to the cyber police station with a printed transaction table and get the FIR number.
- Ask the IO in writing which accounts are frozen and for how much.
- Watch your own account for a freeze, and keep your FIR copy ready if it happens.
- Ignore anyone who offers to recover the money for a fee.
How we help victims of online scams
Our work in these matters is practical: getting the FIR registered with the right sections, putting the transaction trail in a form the police and the court can follow, applying for release of frozen money, and dealing with frozen accounts and bank disputes that follow. Advocate Sadhna Singh usually prepares the transaction table and the release application, and appears before the magistrate in Delhi and Ghaziabad.
Our pages on cyber crime cases, economic offences and banking and insurance laws explain the related work. If you want an advocate to look at your transactions and tell you where recovery is realistic, the team of Advocate B.K. Singh at B.K. Singh & Associates can review the papers through our online enquiry page.
Frequently asked questions
Can I get my money back after an online job scam?
Sometimes, and mostly in part. Money that was still in the receiving accounts when the fraud was reported can be frozen and released to you by the magistrate. Money already withdrawn or converted into crypto depends on the police tracing the people behind the accounts.
How long does it take to get frozen cyber fraud money released?
Usually weeks to a few months after the application is filed, depending on the court and how quickly the IO files a report linking your payment to the frozen amount. A clear transaction table and regular follow-up with the IO shorten the delay.
Is calling 1930 enough, or do I need an FIR?
You need both. The 1930 call or portal complaint starts the freeze through the banking system. An FIR starts the investigation and is what the court needs before it can order release of frozen money to you.
Which section applies to an online investment fraud?
Usually section 318(4) BNS for cheating, often with section 319 for personation, section 61 for conspiracy, and sections 66C and 66D of the IT Act. Large organised networks may also attract section 111 BNS.
Will my bank refund money I lost in a task scam?
Generally no. The RBI's zero-liability framework covers unauthorised transactions, and in task scams you made the payments yourself. The bank can be held responsible for its own failures, such as ignoring a timely fraud report.
Why was my bank account frozen after I was scammed?
In task scams, the small payments you received early on often came from another victim's money. When that victim reported, the trail led to your account. Approach the IO with your own FIR and bank statement to have the freeze lifted or limited.
How do I check if a stock market adviser is genuine?
Check SEBI's list of registered intermediaries on its website. Since October 2025, registered intermediaries collect money through validated UPI IDs with the '@valid' handle, which you can verify with the SEBI Check tool.
Is it a scam if the job pays me at first?
Yes, it can still be. Task scams deliberately pay small amounts at the start to build trust and collect your bank details. Being asked to deposit money before you can take tasks or withdraw earnings is the clearest sign.
Does the e-Zero FIR system apply to my online scam loss?
It is a scheme piloted in Delhi from 2025 under which cyber financial fraud complaints above ₹10 lakh filed on 1930 or the national portal are converted automatically into a Zero FIR. The victim must visit the police station within three days to have it converted into a regular FIR.
Someone says they can recover my scam money for a fee. Is it genuine?
No. Police and banks do not charge to return frozen money, which is released only by a court order into your own account. Report the caller on 1930.
Can I file a case in Delhi if the scammers are in another state?
Yes. You can report where you live or where you made the payment, and the police can investigate across states. A Zero FIR can be registered at any police station and transferred to the one with jurisdiction.
Do I need a lawyer to get frozen money released?
It is not compulsory, but the application, the IO's report and the bond must be in order, and courts deal with many such applications. An advocate can draft it, follow up with the IO and appear on the dates.
Written and reviewed at B.K. Singh & Associates
Advocate B.K. Singh
Founder of B.K. Singh & Associates. MCA, LL.B., LL.M., with more than twenty years of practice before the Supreme Court, the Delhi High Court, district courts and tribunals across Delhi NCR. This article explains the general law as of 24 October 2026; it is not legal advice on your facts.