Cyber Crime Lawyer: Online Fraud, Sextortion and Frozen Accounts

Lost money in an online fraud? What to do in the first hour

Call 1930 or file on cybercrime.gov.in straight away, with the transaction IDs, amounts, times and the account or UPI ID the money went to. The helpline is linked to the Indian Cyber Crime Coordination Centre's financial fraud reporting system, which sends your complaint to the banks and payment apps involved so they can put a hold on the money in the receiving accounts. Speed matters because fraudsters move money through several mule accounts and withdraw it within hours. A complaint made the same day has a real chance of catching some of it; one made a week later usually does not.

Then call your bank's fraud line and block the card, UPI or net banking access used. Ask the bank to record the complaint in writing and note the reference. Under RBI rules on unauthorised electronic transactions, how quickly you inform your bank affects how much of the loss you bear: reporting within three working days of being told of the transaction gives the strongest protection where the fraud happened outside your control. Change passwords, and if your phone may have been compromised by a screen-sharing or remote access app, uninstall it and reset the device.

Do not respond to anyone who calls offering to recover the money for a fee. Recovery scams target people who have just been defrauded, often using the names of police officers or lawyers.

Reporting a cyber fraud: from 1930 to the FIR

These steps apply in Delhi, Noida and Ghaziabad. The same portal and helpline work across India.

1. Call 1930 or report on cybercrime.gov.in

   Give the amount, date and time, your bank and the beneficiary's account, UPI ID or wallet. You get an acknowledgment number. Keep it; everything later refers to it.

2. Inform your bank in writing

   Report the unauthorised transaction to your bank by its official channel and email, block the instrument used and ask for a written acknowledgment. This protects your position under RBI rules and creates a record.

3. Follow up on the hold

   The portal complaint should show which receiving accounts were put on hold and for how much. Ask the cyber police station for this information if it does not appear. That figure is what can realistically come back to you.

4. File or confirm the FIR

   Visit the cyber police station for your district with printouts, or check whether your portal complaint has been registered as an FIR. In Delhi, larger losses reported through the portal may be converted into a zero FIR automatically. Get the FIR number and the name of the investigating officer.

5. Apply for release of the frozen money

   Once the receiving accounts are identified and frozen, you apply to the magistrate, with the IO's report, for the held amount to be returned to you. This is where most victims need a lawyer, because the application must show that the money is yours and trace the chain.

Will I get my money back after a cyber fraud?

Some of it, sometimes. The honest answer depends on how much was frozen before it was withdrawn. If the receiving accounts still held your money when the hold was put on, that amount can usually be returned through the court. If the money had already been withdrawn in cash, converted to cryptocurrency or sent abroad, recovery depends on the police tracing the people behind it, which is slower and less certain.

Return of frozen money normally requires an order from the magistrate. Applications are made under the provisions of the Bharatiya Nagarik Suraksha Sanhita 2023 on custody and disposal of property during investigation and trial (sections 497 and 503, which replaced sections 451 and 457 of the old Code). The magistrate looks at the IO's report, the money trail and whether anyone else claims the same funds. Where several victims' money landed in the same mule account, the amount may be shared out. Courts can order release against an indemnity bond, so that the money can be recovered if facts change.

Separately, your bank may be liable to reimburse you if the fraud happened because of a lapse on its side or a third-party breach that you reported in time, under the RBI's customer protection directions. If the bank refuses, you can go to the RBI Ombudsman or the consumer commission; our page on consumer cases in Delhi explains that route.

Common cyber frauds and the sections police usually apply

Cyber police stations in Delhi, Noida and Ghaziabad

Delhi Police has a cyber police station in each of its districts, which register and investigate cyber FIRs for that district, and a specialised unit in the Special Cell, known as IFSO, which handles larger, organised and inter-state cyber crime. Local police stations also receive cyber complaints and forward them. In Uttar Pradesh, the Gautam Buddh Nagar and Ghaziabad police commissionerates each have a cyber crime police station and cyber help desks in local stations.

Under section 173 of the BNSS, an FIR can be registered at any police station regardless of where the offence happened, as a zero FIR, and then transferred to the station with jurisdiction. An e-FIR can be lodged electronically and must be signed within three days. For offences punishable with three to seven years, which includes cheating under section 318(4) of the BNS, the police may hold a preliminary enquiry of up to fourteen days before deciding whether to register the FIR. Victims should not take that as a refusal, but should follow up in writing.

Where to go depends on where you live and where the money went, and the first contact can be at whichever station is nearest. Our page on criminal cases in Delhi covers the district courts and police structure more generally.

The police will not register my cyber FIR: what now?

Refusal or delay in registering an FIR is common in smaller cyber cases, especially where the amount is low or the station considers the matter civil. Put your complaint in writing at the station and get a receiving stamp or diary number. If nothing happens, send the complaint to the Deputy Commissioner of Police for the district (or the Superintendent or Commissioner in UP) under section 173(4) of the BNSS, by post and email.

If that also fails, you can file an application before the magistrate under section 175(3) of the BNSS asking for a direction to the police to register and investigate. The application must show that you approached the senior officer first and must be supported by an affidavit. The magistrate may call for a report from the police before deciding. This route takes weeks, not days, so the portal complaint and bank hold should already be in place before you start it.

Digital arrest calls and threats from fake officers

There is no such thing as a digital arrest under Indian law. No police force, CBI, ED, NCB or customs officer arrests a person over a video call, keeps them under watch on camera, or asks for money to be transferred to a 'safe' or 'verification' account. Real agencies issue written summons or notices, such as a notice under section 35 of the BNSS or a summons under the relevant statute, and you can verify them with the agency.

These scams often target retired people, doctors and professionals living alone. The callers use names of real officers, fake warrants and video backgrounds that look like police stations. If you receive such a call, disconnect, do not transfer anything, tell a family member and report on 1930. If money has already been sent, follow the fraud steps above immediately. If you genuinely receive a notice from an agency, our pages on ED cases and CBI cases explain what a real notice looks like and what to do.

Someone is threatening to share my private images

Stop responding and do not pay. In almost every sextortion case, payment leads to a bigger demand. Take screenshots of the profile, messages, phone numbers and any payment IDs requested, then block the person. Report on cybercrime.gov.in, choosing the category for women and children if it applies, or at the cyber police station. You can also report to the platform where the threats came from.

If any image or video has been posted, ask the platform's grievance officer to remove it; under the IT Intermediary Rules 2021, platforms must act within two hours (24 hours before the February 2026 amendment) on content showing a person in a sexual act or nudity, including morphed images. The offence is extortion under section 308 of the BNS, with sections 66E and 67A of the IT Act. A woman's identity is protected by law and her statement is recorded by a woman officer. Men are targeted at least as often and are equally entitled to complain; the police deal with these cases routinely.

Feeling ashamed is the reason most victims stay silent, and it is exactly what the blackmailer relies on. The conversation with us is confidential, and in many cases the matter can be handled without anyone in your family or workplace learning of it.

My bank account has been frozen by cyber police: what can I do?

This is now one of the commonest reasons people come to us. When a fraud victim reports, the system follows the money to every account it passed through, and banks put a debit freeze on those accounts. If you received money from a buyer, a client or a crypto counterparty, and that money was traced to a fraud, your account may be frozen even though you did nothing wrong. Often the whole account is frozen, not just the disputed amount, and the bank cannot tell you more than the name of the police station or the complaint number.

Start by asking your bank in writing for the details of the freeze: which agency, which police station, the complaint or FIR number and the amount involved. Then contact the investigating officer with proof that your receipt was genuine, such as invoices, GST records, delivery proof or chat history. The Ministry of Home Affairs has issued a standard procedure for grievances about frozen accounts, so check the current process with your bank as well. Many freezes are reduced to the disputed amount once the IO is satisfied.

If that does not work, there are two court routes. You can apply to the magistrate for release of the account or the money. Or, where the freeze is wholly disproportionate, unexplained or has continued for months without any step by the police, you can file a writ petition before the High Court. High Courts have questioned freezes made under section 106 of the BNSS (seizure) without following section 107, which requires a magistrate's order to attach proceeds of crime, and many have held that only the disputed amount should be held, not the whole account. The law on this is still developing across High Courts, so the right route depends on the facts and the court.

Accused in a cyber crime case: what to expect

If you are named in a cyber FIR, you may first receive a notice under section 35 of the BNSS asking you to appear before the IO, in place of arrest, especially where the offence carries up to seven years. Comply with the notice and attend with a lawyer's advice; ignoring it can lead to arrest. Under section 77B of the IT Act, offences punishable with three years are bailable, so cases registered only under sections 66, 66C or 66D usually do not lead to custody. But most FIRs also include section 318(4) of the BNS for cheating, which is non-bailable, and sometimes section 111 for organised crime, which is far more serious.

Where arrest is likely, an application for anticipatory bail under section 482 of the BNSS can be filed before the Sessions Court and then the High Court. Courts look at the role alleged, the amount, whether money has been returned, previous record and cooperation with investigation. Supreme Court guidance in Arnesh Kumar v State of Bihar (2014) and Satender Kumar Antil v CBI (2022) against unnecessary arrest applies here too. Our bail lawyer page explains the bail process in detail.

Do not delete chats, reset your phone or move money after you learn of a case. Each of these is treated as an attempt to destroy evidence and can be used against you at the bail stage.

Sections you are likely to see in a cyber FIR, and what they mean for bail

Mule accounts: when your account was used for fraud money

A mule account is a bank account used to receive and pass on fraud money. Fraud networks rent accounts from students, delivery workers and small traders for a small fee, or open them with borrowed KYC documents. When the money is traced, the account holder is the first person the police find, and many are arrested or summoned even if they never knew what the money was.

If you lent or sold your account details, the law treats that seriously, and investigating agencies increasingly add conspiracy and organised crime sections. Your defence will depend on what you knew, what you were paid, what you did with the money and whether you cooperate in identifying the people behind it. If someone opened an account in your name using your documents without your knowledge, collect proof of that at once, including any complaint about lost documents, and give it to the IO. In both situations, early legal advice and cooperation usually affect bail and the eventual outcome more than anything else.

Seizure of phones and laptops in cyber cases

In a cyber investigation, the police will usually seize the phones, laptops and storage devices of the accused, and sometimes of the complainant. Insist on a seizure memo listing each device with its identifying details, and ask that hash values of the data be recorded at the time, so the contents cannot later be altered without detection. You are entitled to a copy of the seizure memo.

Devices are sent to a forensic science laboratory, and reports often take months. If a device is needed for work or holds unrelated personal data, apply to the magistrate for its return on terms, such as a bond and an undertaking to produce it, after the data has been imaged. For a complainant, giving the police a forensic copy rather than the phone itself is often sufficient.

Quashing and settlement in cyber crime cases

Where a cyber case is really a commercial dispute, a misunderstanding about a payment, or a case in which the money has been repaid and the parties have settled, the High Court can quash the FIR under section 528 of the BNSS, which replaced section 482 of the old Code. Some IT Act offences can be compounded under section 77A, and some cheating offences under the BNS can be compounded by the person cheated, with or without the court's permission depending on the section.

Courts are less willing to quash where many victims are involved, where the offence affects the public, such as large-scale phishing, or where it involves sexual images. A settlement with one complainant does not end a case built on a mule account linked to dozens of victims. The settlement terms should be in writing, with the payment made and the complainant's affidavit ready, before the petition is filed.

What to bring to the first meeting

Bring printouts and the phone itself. Do not delete anything before the meeting, including your own messages.

Mistakes that hurt victims and accused in cyber cases

• Waiting a day to report. By then the money has usually left the first accounts, and the freeze catches little.
• Paying a blackmailer. It almost never ends the threats, and it adds to the loss.
• Trusting a recovery agent. People who call promising to recover lost money for a fee are very often the same network.
• Deleting chats or resetting the phone. This destroys a victim's evidence and, for an accused, looks like tampering.
• Ignoring a section 35 notice. Not appearing before the IO is a common reason why arrest follows in a case that would otherwise have proceeded on notice.
• Lending a bank account. Allowing others to route money through your account, even for a commission, is how many people become accused persons.

How we work on cyber crime matters

Advocate Sadhna Singh usually takes the first call, works out the timeline and collects the documents and screenshots. Advocate B.K. Singh, whose MCA background helps in reading transaction trails, IP and device logs and forensic reports, reviews the technical material, drafts the complaint, release application, anticipatory bail or writ petition and appears in court. In cases connected to other states, we work with associate counsel there. You can read more about Advocate B.K. Singh.

Fees are discussed at the first meeting and agreed in writing, stage by stage. Court fees, certified copies, forensic charges and travel are separate. We do not promise that lost money will be recovered or that a case will end by a given date; we will tell you what the record shows and what can realistically be done. To send us your papers, use the online enquiry form.

What to do this week

• Call 1930 or file on cybercrime.gov.in if you have not already, and keep the acknowledgment.
• Inform your bank in writing and block the card, UPI or net banking used.
• Get the FIR number and the IO's name, or put your complaint in writing at the cyber police station.
• Collect screenshots, transaction IDs and statements in one folder.
• If your account is frozen, ask the bank in writing for the agency, complaint number and amount.
• If you have received a notice, note the date to appear and get advice before going.
• Do not delete messages, reset devices or move money connected to the case.