Business email compromise legal remedies and recovery

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Cyber law

The legal remedies for business email compromise fall into four families: a criminal complaint, a civil claim for recovery, a regulatory complaint against the bank, and a contractual or insurance claim. They are not alternatives. A victim usually needs the criminal complaint to identify the money trail and the civil or insurance claim to actually recover the loss.

Business email compromise produces more than one legal dispute, and the remedies therefore fall into four families that run in parallel. The criminal complaint identifies offenders and the money trail. The civil claim recovers the loss from a party that owes a duty. The regulatory complaint addresses the bank's own conduct. The contractual and insurance remedy covers a vendor's breach or an indemnity under a policy. Choosing one and abandoning the others is the mistake that leaves most victims with a conviction and no money, or with a decree against someone who cannot pay.

The criminal provisions are section 66D of the Information Technology Act, 2000, which punishes cheating by personation using a computer resource, and section 318 of the Bharatiya Nyaya Sanhita, 2023, which covers cheating. Adjacent provisions are section 66C of the IT Act for the misuse of credentials, section 336 of the BNS for forgery of invoices or headers, and section 316 of the BNS where an insider betrayed an entrustment.

The criminal remedy

The criminal route begins with an FIR registered under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, because a cyber offence is cognizable and the police are bound to record it. The complainant should set out the deception chronologically and name the sections, so the file is not read as a commercial quarrel. An investigating officer can then requisition the beneficiary bank's records, examine the mule account, and escalate through the national portal. Where a station declines to register, section 175(3) of the BNSS allows the victim to ask the jurisdictional Magistrate to direct an investigation. On conviction, a court may order compensation to the victim, which is why the criminal and recovery goals are not entirely separate. Electronic evidence — headers, logs and statements — is proved under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, with the accompanying certificate. The honest limit of this route is that it depends on identifying and catching a person who often sits outside India, and on that person having assets.

The civil remedy

The civil route exists because the loss was often preventable by someone who had a duty to prevent it. Two defendants are realistic. The bank can be sued where it opened the beneficiary account without proper verification, or failed to flag a transfer pattern that should have alerted it, or delayed after the fraud was reported. A vendor, a service provider or an insider can be sued where the fraud came through systems they controlled and the security obligations in their contract or in law were not met. A claim against the attacker is available but usually pointless unless the person has been identified and has money. The forum depends on the value of the claim, with smaller money suits before the civil judge's court and larger original-side suits before the High Court, including the Calcutta High Court. Limitation runs from discovery of the loss, so delay narrows the remedy as the evidence fades.

The regulatory remedy

Your own bank's conduct is a fit subject for the RBI's grievance and ombudsman machinery, which can direct redressal where a deficiency in service is established. This route is quick relative to a suit but narrow: it acts against the bank and not against the fraudster or the mule. Where the fraud touched personal data of clients, separate duties arise under the Digital Personal Data Protection Act, 2023, and a regulated business may also owe its sectoral regulator an account of what happened. The regulatory route is best used as pressure in writing alongside the others, not as a standalone plan.

Comparing the remedies

Remedy	Principal objective	Forum
Criminal complaint	Identify offenders, trace funds, obtain compensation on conviction	Police station, then criminal court
Civil recovery suit	Recover the loss from a bank, vendor or insider who breached a duty	Civil judge's court or High Court by value
Regulatory complaint	Compel the bank to redress a service failure	Bank's grievance cell and RBI ombudsman
Contractual claim	Enforce a vendor's security obligation	Civil court or arbitration, as the contract provides
Insurance claim	Indemnity for the loss under the policy	The insurer's claims process

Which remedy to lead with

The freeze is always the first action, because it is the only step that can return the same money. After that, the lead remedy depends on what the victim wants. Where the objective is to identify and punish, the criminal complaint leads. Where the objective is to recover a sum from someone who can pay, the civil claim against the bank or vendor leads, with the criminal case running alongside. Where the loss is insured, the insurance claim must be notified on time regardless of the others. Where the bank's conduct is the issue, the regulatory route applies pressure. A victim who assigns every resource to one remedy usually discovers that the money was recoverable only through another.

What decides which remedies succeed

Four factors decide. The first is the speed of the freeze, which determines whether there is any res to recover. The second is the beneficiary bank's verification and monitoring record, which decides the strength of the civil claim. The third is the quality of preserved evidence, because a section 63 certificate and unedited logs support every route while screenshots support none. The fourth is the company's own conduct, since a business that ignored a prior warning or failed its own controls will face a reduced insurance claim and a hostile civil defendant. Where the offence and the mule are abroad, expect the criminal route to depend on mutual legal assistance and the recovery to rest on the bank, the vendor and the insurer.

The civil recovery claim in practice

A civil claim in business email compromise is built on a breach of duty, not on the fraud itself. Against a bank, the duty is the verification of the beneficiary at account opening and the monitoring expected of a bank; against a vendor, it is the security obligation written into the contract or the standard of care the law implies. The claim should therefore be pleaded as a loss that the defendant's default allowed, supported by the written hold request, the bank records and the preserved emails with their full headers. Where the contract provides for arbitration, that route displaces the court. Limitation runs from discovery of the loss, and the value of the claim decides the forum, with larger claims going to the original side of the High Court, including the Calcutta High Court. A well-chosen defendant with means is worth more than a broader claim against many parties who cannot pay.

Contractual and insurance remedies in practice

Two remedies are often overlooked until it is too late. The first is the contract with the vendor or service provider whose mailbox was the vector: entitlement to indemnity, a security schedule or a stated standard of care may be written in, and the claim can be enforced in court or in arbitration as the contract provides. The second is insurance. A policy covering fraud, crime or social engineering may respond to the loss, but the insurer will test whether internal controls were followed and whether notice was given within the period the policy sets. Notify the insurer early, in writing, even before the investigation concludes, and do not wait for the police case to finish, because late notice is the commonest reason a valid claim is refused. Keep the insurer's correspondence separate from the police file so the two are not confused.

How the remedies fit together over time

In the first hours, only the freeze matters. In the first week, the FIR, the bank representation and the insurance notice are filed together. In the following weeks, the bank's records are obtained and the regulator complaint is prepared if the bank refuses to engage. Within months, the civil or arbitration claim is filed against a chosen defendant before limitation narrows the choice. The criminal case continues at its own pace, and its findings may later strengthen the civil claim, though the civil court decides on its own evidence. Treated as a sequence rather than a single filing, the four remedies support one another; treated as rivals, they waste the only resource that cannot be replenished, which is time.

Which facts steer you to which remedy

The facts, not preference, choose the remedy. If the money is still in the beneficiary account, the freeze leads and everything else supports it. If the beneficiary account was opened weeks earlier with no genuine business and no verification, the civil claim against the beneficiary bank and your own bank is the centre of the case. If the fraud came through a vendor's compromised mailbox, the contractual claim against that vendor, or an arbitration under its contract, is often the strongest money remedy. If the loss is insured, the policy claim must be notified on time regardless of the others. If an employee approved the payment after ignoring an obvious warning, the company's own remedies shrink, and the sensible focus becomes the insurance route and the criminal complaint rather than a speculative suit. Matching the remedy to the fact that will actually be argued is what separates recovery from activity.

Two overlays sit above all of them. The first is limitation, which quietly closes the civil and arbitration doors while a victim concentrates on the police case. The second is evidence, because every remedy depends on the same preserved originals and the certificate required by section 63 of the BSA, 2023; evidence gathered once, properly, serves all four routes at once.

In every case, ask one question before spending on any remedy: who holds money, or owes a duty that the fraud defeated? The answer usually points to the bank or the vendor, and that is where recovery work should be concentrated while the criminal complaint runs its own course.

Mistakes that weaken every remedy

Treating the police case as the only remedy and letting the civil limitation run.
Notifying the bank by telephone and having no written record.
Suing the attacker instead of the party that holds funds or owes a duty.
Missing the insurance notice period while the investigation proceeds.
Relying on forwarded copies of emails instead of originals with headers.
Authorising an insider to settle the matter without legal advice, creating admissions.

Where a lawyer fits

Business email compromise is a case where remedies have to be sequenced rather than multiplied. A cyber crime lawyer in Kolkata can frame the FIR so it pleads section 66D of the IT Act and section 318 of the BNS, prepare the written representation and regulatory complaint that hold the bank to its duties, and file the civil recovery suit against the bank or vendor that should have prevented the loss before limitation becomes an issue. Where the defence side matters because an FIR names an employee, the position is explained at criminal defence, and where the dispute is contractual it is covered at civil litigation. Businesses in the state can begin from cyber crime lawyer West Bengal.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What are the legal remedies for business email compromise in India?

There are four: a criminal complaint under section 66D of the IT Act, 2000 and section 318 of the BNS, 2023; a civil suit to recover the loss from a bank, vendor or insider who breached a duty; a regulatory complaint against the bank through the RBI's grievance and ombudsman machinery; and an insurance or contractual claim. They run in parallel, not as alternatives.

Can I sue the bank for a business email compromise loss?

Yes, where the bank failed in a duty it owed: opening the beneficiary account without proper verification, ignoring a transfer pattern that should have raised an alert, or delaying after you reported. Because the payment was approved by your employee, the RBI's unauthorised-transaction protection rarely applies directly, so the claim is built on the bank's own conduct.

Which court hears a civil suit for business email compromise?

The forum depends on the value of the claim. Smaller money claims go before the civil judge's court, and larger claims are filed on the original side of the High Court, including the Calcutta High Court. Limitation runs from the date the loss was discovered, so the suit should be prepared early even while the criminal investigation continues.

Does a criminal case get my money back?

Only partly. A criminal court may order compensation to the victim on conviction, and the investigation can identify the mule account and trace funds. But it depends on the offender being identified, caught and having assets. That is why a civil recovery claim against a bank, vendor or insurer is usually necessary as well, rather than relying on the criminal case alone.

How does the RBI ombudsman fit into business email compromise remedies?

It addresses your own bank's conduct, not the fraudster's. Where the bank refused to act on a valid complaint or failed to follow the required turnaround, the ombudsman can direct redressal. It is quicker than a suit but narrow, and it cannot order the mule or the attacker to repay. Use it alongside the other routes rather than instead of them.

Which remedy should I pursue first after a business email compromise?

The freeze, because it is the only step that can return the same money. Call 1930 and send the bank a written hold request within hours. After that, the lead remedy depends on the objective: the criminal complaint to identify offenders, the civil claim to recover from a party who can pay, and the insurance notice to protect the policy.

What evidence supports the legal remedies in a business email compromise case?

Original emails with full headers, the invoice and the bank-change request, mailbox and server logs, the bank statement and UTR reference, and proof of who was authorised to sign. All are electronic records proved under section 63 of the BSA, 2023, which requires an accompanying certificate, so originals must be preserved and never edited.

Does my own conduct affect the remedies available?

Yes. A company that ignored a prior warning email or failed its own payment controls faces a reduced insurance claim and a weaker case against the bank and vendor, because those parties will argue the loss was self-inflicted. Documenting the controls that were followed, and reporting promptly, protects the remedies rather than adding to the loss.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact