Data breach how to recover money lost in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Online fraud

Recovering money lost after a data breach is rarely a single act. It depends on two pockets. The first is the money itself, which is pursued through your bank under the RBI directions on unauthorised electronic transactions. The second is the loss caused by the organisation that failed to protect your data, which is pursued as compensation under the IT Act 2000. Confusing the two is the most common reason a victim neither gets the money back nor builds a claim.

The first pocket rewards speed and the second rewards proof. If you act quickly on the transaction and keep a careful record of the security failure, you give yourself the best realistic chance in each. This guide sets out what to do, in what order, and what actually decides the result rather than what merely feels reassuring.

What the RBI directions say about your liability

When money leaves your account through an unauthorised electronic transaction, your liability is not automatic. RBI directions on limiting the liability of customers in such transactions allocate the loss according to whether you were negligent and how quickly you reported the problem. The framework distinguishes between a transaction you did not authorise and one where your own credentials were shared or your device was compromised through carelessness.

The practical consequence is blunt: the faster you report, the smaller your share of the loss. A customer who calls the bank on the same day stands in a very different position from one who discovers the debit a month later. This is why the first call after any breach that touches money should be to the bank, before the helpline, before the police station, and before a friend who might offer advice that wastes a day.

Keep the response you get in writing. Ask for the bank's position on liability, the reference number of the dispute, and the expected resolution window. Those few lines convert a verbal reassurance into a record you can rely on later if the reversal does not happen on its own.

Step one: freeze the loss fast

Work through these steps on the day you discover the loss. Each one takes minutes and each one matters.

1. Call your bank or payment provider, block the instrument if needed, and ask that the transaction be flagged and disputed.
2. Call the national cyber-crime helpline on 1930 and note the acknowledgement number.
3. File the complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in, attaching the evidence as one set.
4. Download the bank statement covering the debit and note the transaction reference, amount and time.
5. Write to the bank's nodal officer asking for the written liability position and the dispute reference.
6. Give a written complaint at the police station with jurisdiction and keep a stamped receipt.

Doing these in parallel rather than in sequence saves days. The bank does not need the police complaint to begin its process, and the police do not need the bank's decision to register a complaint. Treat the two as running side by side.

Why the money and the breach often surface at different times

A breach and the loss it causes rarely happen on the same day. The data may have leaked weeks or months earlier, and the debit may come from a fraudster who assembled your details with pieces from another source. This gap matters because it is often the first thing a bank or an investigator will test: whether the loss really flows from this incident, or whether it is an unrelated scam that simply happened afterwards.

The way to handle the gap is to build a timeline rather than an argument. Note when the breach was notified, when you first noticed anything unusual, when the debit occurred, and when you reported it. A clean sequence does more to connect the two events than any amount of explanation, and it is the single document that most often decides how seriously the bank treats the dispute.

How money is actually recovered

There are two realistic mechanisms, and most cases use the first alone.

The ordinary route is reversal by the bank or payment provider. Where the transaction is treated as unauthorised and you reported promptly, the institution may credit the amount back and resolve the dispute internally with the beneficiary bank. This is the fastest route and the one most victims successfully use. It does not require a court, a lawyer or a long proceeding; it requires a clear, prompt report and a documented dispute.

The second route is recovery through a proceeding, where the money is not returned voluntarily. This may involve pursuing the wrongdoer in a criminal case, or claiming compensation against an organisation whose failure caused the loss, under the IT Act. This route is slower and depends on identifying a party worth pursuing, which is why it is usually reserved for larger sums or for cases where an organisation's negligence is clear.

Which route fits your loss

The right route depends less on how you feel about the loss than on what you can actually prove.

What the bank will ask you

Banks follow a standard script when a customer disputes an unauthorised transaction, and knowing it in advance lets you answer before being asked.

• When did you first learn of the transaction, and how?
• Was the instrument, card or app in your possession at the time?
• Had you shared any credential, code or device access with anyone?
• Have you reported the matter to the police, and what is the reference?
• Do you have a breach notification connecting the incident to this loss?

Answer honestly and specifically. An inaccurate answer discovered later damages the whole dispute, whereas a clear admission that you were unsure of a detail is normal and expected. The bank's decision on liability turns on the same questions the RBI framework uses, so your answers are effectively your case.

The civil route under IT Act sections 43 and 43A

Where the loss flows from an organisation's failure to protect data it held, the IT Act offers a civil route that many victims overlook. Section 43 addresses unauthorised access, downloading, copying or extraction of data and supports a claim for compensation. Section 43A goes further: a body corporate that handles sensitive personal data and fails to implement reasonable security practices is liable to compensate affected persons.

The strength of such a claim rests on showing two things. First, that the organisation held the data and that it leaked. Second, that the security practices it used fell short of what was reasonable. That second element is where most claims are won or lost, and it is why preserving the breach notification and the organisation's public statements matters. Where the law is unsettled on a particular point, or where the implementing rules are still taking shape, a claim should be framed cautiously rather than with certainty.

If the loss went through a wallet or UPI

Wallet and UPI losses move faster than card disputes and leave a shorter trail. The money often passes through several accounts within minutes, which is why the first hour matters more than the first week. Report the debit in the app, call the provider's support line and record the complaint reference, then file on the portal and with the police. Do not wait for the app's automated review to finish before telling the helpline.

Keep the screenshots of the app's transaction screen, because the reference shown there is often the only identifier an investigator can use to trace the receiving account. If the app's support response is a standard reply with no reference number, follow up in writing and keep that too. A dispute without a reference is difficult to escalate, whereas one with a reference can be tracked and pressed.

Keeping the claim alive while you wait

Recovery takes time, and cases weaken when the complainant goes quiet. Set a reminder to follow up in writing at sensible intervals, quoting the original reference each time. If the bank rejects the dispute, ask for the reason in writing rather than accepting a phone call, because a stated reason tells you whether to escalate within the bank or move to the civil route. If the police take no step, a written reminder to the station, followed by an escalation to the Superintendent of Police, keeps the complaint visible.

What decides the outcome

• How quickly you reported the transaction, which directly affects your share of the loss under the RBI directions.
• Whether the transaction is genuinely unauthorised rather than the result of voluntarily shared credentials.
• Whether the bank reversed or rejected the dispute, and what it recorded as its reason.
• Whether the loss can be connected to a specific breach and a specific organisation.
• Whether the organisation implemented reasonable security practices, which is the heart of a section 43A claim.
• Whether a solvent, identifiable party exists against whom a claim can realistically be pursued.

Common mistakes

• Waiting to see whether the problem resolves itself before telling the bank.
• Assuming the police complaint alone will return the money.
• Accepting a verbal "we are looking into it" with no reference number.
• Deleting the scam message or transaction alert that proves when you learned of the loss.
• Pursuing an organisation for compensation without first exhausting the bank process.
• Confusing the criminal case against the offender with the civil claim against the organisation.

When to involve a lawyer

Small, promptly reported losses are usually handled by the bank. A lawyer becomes useful when the bank disputes liability despite a prompt report, when the sum is large enough that the eventual decision will be made by a court rather than a call centre, when an organisation refuses to acknowledge its security failure, or when you are weighing a compensation claim under section 43A. In those cases, a civil litigation route can recover what a bank process cannot, and a cyber crime lawyer in Kolkata can run the criminal complaint and the civil claim together so that they reinforce rather than contradict each other.

It helps to arrive with a short file: the statement showing the debit, the reference numbers, the bank's written position, and the breach notification if there was one. That bundle lets a lawyer tell you quickly whether you have a recovery worth pursuing, and it avoids the common situation in which a strong case is weakened at the start by missing paperwork.

The realistic outlook is worth stating plainly. Money is recovered most often when it is reported fast and the transaction is treated as unauthorised. Where that first pocket fails, the second pocket, compensation for a security failure, is a genuine but slower remedy that depends on proof. Pursuing both, in the right order, is what gives a victim the best chance of not simply absorbing the loss.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Patient Data Breach: Legal Duties of Hospitals in India
• Data Breach Duties for CA Firms in India: What to Do
• Data breach what it is and how it works in India
• Data Breach Evidence to Preserve in the First 48 Hours
• Data breach legal remedies: criminal and civil recovery
• Data breach complaint process: documents and timeline

Cyber crime lawyer in your city · Bank account freeze help · Contact