The Gap Between Design and Reality
On paper, India has a well-structured cybercrime reporting framework. The Ministry of Home Affairs runs a national portal at cybercrime.gov.in that accepts complaints across every category of digital crime. There is a 24/7 helpline (1930) specifically for financial cyber fraud, connected to a system that can freeze fraudulent bank accounts in real time. The Indian Cyber Crime Coordination Centre (I4C) sits at the national level, coordinating between state police forces. Every state has at least one dedicated cyber crime cell, and most large cities have their own. The RBI has published detailed circulars on bank liability for unauthorised transactions, with specific timelines for refunds. State cyber cells in Karnataka, Maharashtra, Telangana, Kerala, Tamil Nadu, and Uttar Pradesh have full-time staff trained in digital forensics. On the design side, the infrastructure looks solid.
What actually happens when a victim tries to use this infrastructure is a different story.
The 1930 helpline is frequently busy. During peak periods, callers report waiting on hold for thirty minutes to an hour, sometimes longer. The cybercrime.gov.in portal experiences slowdowns and outages during traffic spikes, which tend to follow large-scale scam campaigns, precisely when victims most need it. Police stations in smaller towns and tier-3 cities often lack staff who understand digital evidence handling. Officers at some stations still try to redirect complainants by saying "this is a cyber matter, file it online," even when the victim is standing in front of them requesting an FIR. And even when a complaint is registered, assigned to an investigating officer, and enters the queue, the investigation timeline can stretch across months.
In practice, the system works best when the victim is organised, persistent, and willing to file through multiple channels at once. That is an unfair burden, but it is the reality.
“Of the 6,94,000+ cyber crime complaints received on the national portal in 2023, only a fraction resulted in FIRs, and a smaller fraction led to convictions. The infrastructure exists. Capacity and follow-through remain the bottleneck.” — India Internet Freedom Report, 2024
None of that means you should skip the filing process. You should file, and you should file through every available channel. A registered complaint creates a legal record that triggers bank dispute procedures, contributes to I4C's pattern-detection databases, and is a prerequisite for insurance claims and court proceedings. An unfiled incident is a data point the system never gets. The I4C's own reports suggest that the number of actual cybercrime incidents vastly exceeds the number of complaints received. Every unreported case makes it harder for law enforcement to identify scam networks, trace mule account chains, and allocate investigative resources to the right places. Even a complaint that does not lead to an arrest still feeds the intelligence picture.
There is also a psychological barrier that does not get discussed enough. Many victims of small-value scams (Rs 2,000 lost to a fake UPI request, Rs 5,000 sent to a fraudulent "customer care" number) decide the amount is too small to bother with. Others feel embarrassed about being deceived and do not want to explain the situation to a police officer. Both reactions are understandable. But the aggregation of thousands of unreported small-value frauds is what allows scam operations to sustain themselves. The person who stole Rs 5,000 from you probably stole the same amount from a hundred other people that week.
Go in with realistic expectations. Prepare your evidence before you file. Use multiple reporting channels in parallel. Follow up. The system is imperfect, but outcomes improve significantly when the complainant treats the process as an active project rather than a one-time filing.
Every Reporting Channel, Explained
Cybercrime in India can be reported through at least five separate channels, and for financial fraud specifically, you should use several of them at the same time. Each channel serves a different function and operates on a different timeline. The mistake most people make is treating them as alternatives. They are not. They are layers.
The 1930 helpline. If money has been stolen from your account through UPI fraud, a phishing attack that captured your banking credentials, an unauthorised debit card transaction, or any other financial cybercrime, this is the first call you make. The 1930 number connects you to the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS), which is integrated with banks across India. When you report a fraudulent transaction through this system, it can flag the recipient's account in real time, triggering a hold that prevents the money from being moved further. The first hour after a financial crime is when recovery chances are highest, because stolen funds typically get moved through a chain of mule accounts and withdrawn as cash within hours. Have the following ready before you dial: your bank account number, the transaction ID, the amount lost, the date and time of the transaction, and any information about the recipient's UPI ID or bank account number. If the line is busy (and it often is), keep trying. While you wait, call your own bank's customer care and report the fraud directly. Ask them to block any compromised cards, freeze the affected account if you believe further transactions are at risk, and initiate a chargeback. Do not wait for the 1930 call to go through before contacting your bank. Do both in parallel.
The cybercrime.gov.in portal. This is the national cybercrime reporting portal, and it handles every category of cybercrime, not just financial fraud, but also identity theft, hacking, online harassment, sextortion, child exploitation, data theft, and other offences. The registration process requires a mobile number for OTP verification. Once registered, you choose a complaint category. The portal divides complaints into two tracks: "Women/Child Related Crime" (for cases involving sexual harassment, obscene content, and child exploitation) and "Other Cyber Crime" (which covers everything else, including financial fraud, identity theft, and hacking). Select the appropriate track, fill in the incident details with as much specificity as possible, upload any evidence files (screenshots, PDFs, call recordings), and submit. You will receive a complaint number. Save it. The complaint is routed to the relevant state or city cyber crime cell based on the location of the offence or the victim, and you can track its status through the portal. The portal also sends SMS updates when the status changes.
The portal has practical limitations. On high-traffic days, it can be slow to the point of unusability. The upload size for evidence files is limited. The complaint categories are broad, and the forms do not always have fields that match the specifics of your case. If the portal is down or unresponsive when you need it, you can file in person at the nearest Cyber Crime Police Station. Most state capitals and major cities have dedicated cyber crime police stations. You can find the list and addresses on the I4C website or through a search for "[your city name] cyber crime police station."
The portal steps, laid out plainly: visit cybercrime.gov.in, click "Report Cyber Crime," register or log in with your mobile number, select "Report Other Cyber Crime" (or "Women/Child Related Crime" if applicable), click "File a Complaint," fill in victim details (name, address, phone, email), fill in incident details (date, time, description, amount lost if financial), enter suspect details if known (phone number, UPI ID, website URL, email address, social media profile), upload evidence, review everything, and submit. Note the complaint number and the date of filing. Print or screenshot the confirmation page.
The police FIR. For large financial losses, for serious offences like extortion, blackmail, threats of violence, or sextortion, and for any case where you will need a formal legal document for court proceedings or an insurance claim, you need a First Information Report from the police. This is separate from the portal complaint. The portal complaint gets routed to a cyber crime cell, but it is not the same as an FIR, and courts and insurance companies typically require an FIR.
Under Section 173 of the Bharatiya Nagarik Suraksha Sanhita (BNSS) 2023, which replaced the old Code of Criminal Procedure, police are legally obligated to register an FIR for any cognisable offence. Cybercrime offences under the IT Act and BNS are cognisable. The police cannot refuse to register your FIR. If an officer at the station tells you "this is not our jurisdiction" or "you should file online" or "go to the cyber cell," they are wrong in law. Insist. If they still refuse, ask for the refusal in writing. Note the officer's name and designation. Escalate to the Station House Officer (SHO) if the initial officer is a constable or sub-inspector. If the SHO refuses, write to the Superintendent of Police (SP) of your district. If that fails, you can approach a Judicial Magistrate under Section 175(3) of BNSS to direct the police to register and investigate. That last step involves filing a brief application, and it works.
When you go to the police station to file the FIR, bring: a written chronological account of the incident (typed, not handwritten, with dates and times), all evidence on paper (printed screenshots, bank statements) and on a USB drive, your ID proof (Aadhaar, driving licence, or passport), and the complaint numbers from the 1930 helpline and the cybercrime.gov.in portal if you have already filed through those channels. The written chronology is the single most useful thing you can hand the investigating officer. It saves them the work of extracting the narrative from you verbally, and it shows that you are organized.
Understanding FIR vs NC. Not all offences are cognisable. Cognisable offences (like fraud, theft, cheating, identity theft under the IT Act) are those where the police can investigate without a magistrate's order. For these, the FIR is mandatory. Non-cognisable (NC) offences are less serious matters where the police file a Non-Cognizable Report and you may need to approach a magistrate for further action. Most cybercrimes that cause financial loss or involve identity theft fall in the cognisable category. If the police try to file an NC report when you believe a cognisable offence has occurred, challenge it. Cite the specific sections of the IT Act or BNS that apply to your case.
Your bank and the RBI. For unauthorised transactions (money debited from your account without your knowledge or consent), the banking complaint channel is separate from and parallel to the police channel, and it has its own deadlines that you must meet to protect your refund rights. Report to your bank immediately through their customer care number, mobile app, branch, or internet banking portal. Request blocking of any compromised instruments (debit card, credit card, net banking access) and initiate a chargeback or dispute for the unauthorised transaction.
The RBI's 2017 Master Direction on customer liability for unauthorised transactions sets out clear rules. If you report within three working days of the transaction: your liability is zero. The bank bears the entire loss and must credit the amount back to your account within ten working days. If you report between four and seven working days: your liability is capped between Rs 10,000 and Rs 25,000, depending on the type of account. If you report after seven working days: the bank's board-approved policy determines your liability, which could be higher. These timelines start from the date you received communication from the bank about the transaction (SMS alert, email notification, or account statement), not from the date the transaction occurred. This distinction matters. If your bank failed to send you a transaction alert, the clock may not have started yet.
If the bank does not resolve your complaint within 30 days, or if you are unsatisfied with their resolution, escalate to the RBI Ombudsman. File the complaint through the RBI's Complaint Management System at cms.rbi.org.in. The Ombudsman can direct the bank to reverse the transaction and pay compensation. For UPI-specific disputes, the payment apps (Google Pay, PhonePe, Paytm, BHIM) have their own dispute resolution mechanisms within the app. If those do not work, escalate to the National Payments Corporation of India (NPCI) at npci.org.in. NPCI oversees UPI and can intervene in disputes between payment service providers.
State cyber cells. Each state has a dedicated cyber crime investigation unit that handles the more complex cases. Some of the more established ones include the Karnataka CID Cyber Crime Division (Bengaluru), the Maharashtra Cyber Department (Mumbai and Pune), the Telangana State Cyber Security Bureau (Hyderabad), the Kerala Cyber Cell (Thiruvananthapuram), the Tamil Nadu Cyber Crime Wing (Chennai), and the UP Cyber Crime Cell (Lucknow). These cells have staff trained in digital forensics, social media tracing, and financial transaction analysis. If your case involves significant amounts, sophisticated fraud (such as investment scams, business email compromise, or SIM swap attacks), or if the local police station is not acting on your FIR, you can approach the state cyber cell directly. Contact information for each state's cyber cell is available on the I4C website and the NCRP portal.
Building a Case That Actually Moves Forward
The difference between a complaint that leads to investigation and one that sits untouched in a queue is usually not about the size of the loss. It is about documentation. Cyber crime cells across India are handling caseloads that far exceed their staffing. Investigators look at the stack of complaints and move first on the ones that are well-documented, clearly narrated, and accompanied by usable evidence. A complaint that arrives as a vague paragraph with no supporting files goes to the bottom. A complaint that arrives with a timeline, labelled evidence, and a clear account of what happened gets attention.
Start collecting evidence before you file anything, and collect it systematically.
For financial fraud, the evidence list is: transaction IDs from your payment app or bank statement, dates and times of each fraudulent transaction, amounts, the recipient's UPI ID or bank account number (this is often visible in the transaction details), your bank statement for the relevant period (highlight the fraudulent entries), screenshots from the payment app showing the transaction flow, SMS and email alerts you received about the transactions, call logs if the scammer contacted you by phone (take a screenshot of the call history entry showing their number, date, and duration), and chat screenshots from WhatsApp, Telegram, SMS, or any other messaging platform where the scammer communicated with you. If the scammer sent you a link to a fake website, screenshot the website and note the URL. If they asked you to install a screen-sharing app (AnyDesk, TeamViewer, QuickSupport), note the app name and take screenshots of any confirmation or session IDs.
For identity theft, collect: screenshots of any fake accounts or profiles created using your identity, your Aadhaar authentication history from myaadhaar.uidai.gov.in (check for authentications you did not initiate), your credit report from cibil.com or any other credit bureau (look for loans or credit lines you did not apply for), communications from banks or services about accounts you never opened, and any notices or demands related to obligations you did not create.
For online harassment, gather: screenshots of every threatening or abusive message with visible timestamps and sender information (profile name, phone number, email address), the URL of any offensive content posted about you (copy this before the content is taken down, because once deleted, it is much harder to use as evidence), a record of any reports you filed with the platform (Twitter, Instagram, Facebook, YouTube all provide confirmation when you report content), witness information if others saw the content or received similar messages, and medical or psychological records if the harassment caused documented harm.
Organise everything into a single folder, digital and physical. Name files descriptively. "UPI_fraud_transaction_12Aug2025.png" tells the investigating officer what they are looking at. "Screenshot_48291.jpg" does not. Create a one-page written timeline that answers: when did the incident start, what happened at each step, what actions did you take in response, what is the total financial loss, and what personal impact has resulted. Print two copies of everything: one for the police, one for yourself. Put digital copies on a USB drive.
Hand the investigating officer the timeline first, then the evidence folder. This approach saves them the work of extracting the story from you verbally, which is how most complaints arrive. An officer handling 40 active cases will spend more time on the one where the victim has already done the organisational work.
One thing to avoid: do not contact the scammer after you have decided to file. Some victims, understandably angry, call the scammer's number or message them on WhatsApp. This alerts the scammer that you are taking action, and they may destroy evidence, abandon the phone number, or close the bank account before investigators can act. Let the police handle contact with the suspect.
After Filing: Follow-Up and Escalation
Filing is not the end. It is the beginning of a process that requires active follow-up from you. The system is not designed to operate in a fire-and-forget mode, even though that is what most victims expect. What actually happens after filing depends on which channels you used, how well-documented your case is, and how much you push.
If you filed through the cybercrime.gov.in portal, check the status within the first week using your complaint number. The portal shows basic status updates: "Pending," "Under Investigation," "Transferred to [state/city]," or "Disposed." If the status changes to show an investigating officer assignment, that is progress. Note the officer's details. If the status stays at "Pending" for more than two weeks, it means the case has not yet been picked up. That is common, not unusual. High-volume cyber cells receive hundreds of complaints per week, and triage takes time.
If you filed an FIR at a police station, get the FIR number and the name of the investigating officer from the station. If an IO has not been assigned within a week, call the SHO and ask. Be polite but direct. Write down the date, time, and content of every call and visit. If two weeks pass without contact from the IO, call them. If a month passes without any update, send a written follow-up by email or registered post to the SHO. Keep a copy. If two months pass without movement, write to the SP of your district. Mention the FIR number, the date of filing, and the absence of investigation progress.
There are formal escalation paths beyond the police hierarchy. Section 175(3) of the Bharatiya Nagarik Suraksha Sanhita allows you to approach a Judicial Magistrate and request that they direct the police to investigate your complaint. This is a legal remedy, not just an administrative one. The magistrate can order the police to register the FIR (if they had refused), appoint a specific officer to investigate, or set a timeline for the investigation. It requires filing a brief application, and it works. People rarely use it, but those who do tend to see results.
You can also write to the State Human Rights Commission or the National Human Rights Commission if you believe the police have been negligent or have refused to act on a legitimate complaint. These bodies can issue notices to the police department and demand an explanation. A notice from the NHRC gets attention in a way that a phone call from a victim often does not.
For financial fraud cases where you are seeking a refund from your bank: the bank's internal complaint process and the police investigation run on separate tracks. Do not wait for the police to recover money before pursuing the bank refund. Under the RBI's rules, the bank's liability determination is based on when you reported the fraud and whether you were negligent, not on whether the police have caught the scammer. If the bank denies your refund claim or does not respond within 30 days, file with the RBI Ombudsman at cms.rbi.org.in. If the Ombudsman's process is slow, you can also approach the consumer forum under the Consumer Protection Act 2019. Financial disputes below Rs 50 lakh go to the District Consumer Disputes Redressal Forum. Claims between Rs 50 lakh and Rs 2 crore go to the State Commission. These forums are designed to handle cases faster than regular civil courts, though in practice backlogs vary by state.
Throughout the process, maintain a single file with every document: copies of all complaints filed (portal, FIR, bank, RBI), complaint and FIR numbers, dates of every communication with police and bank, names and designations of every officer you spoke with, and a running log of what was said. If the case ever reaches a court or tribunal, this file is your entire evidentiary foundation.
A counterpoint that needs honest acknowledgement: the system puts a heavy burden on victims. You are the one who has to collect evidence, file across multiple channels, follow up with overworked officers, and sometimes fight to get your own FIR registered. For someone who just lost their savings to a scam, this is a lot. Advocacy groups have pushed for a single-window complaint system where the victim files once and the system handles all the routing, assignment, and inter-agency coordination automatically. Until that exists, the layered approach described above is the practical one.
File the complaint. Collect the evidence. Follow up. The system is imperfect, but it is also the only one we have, and it works more often than most people assume. Just do not expect it to be fast.
Comments (0)