Email spoofing: how to recover money lost to a fake email

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Online fraud

Money taken out of your account because someone forged an email address is treated as an unauthorised electronic payment first and a crime second. The Reserve Bank of India's framework on customer protection in unauthorised electronic banking transactions fixes how much of the loss the bank must bear, and your recovery turns almost entirely on how fast you report. The spoof itself is separately punishable under the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023, which is what lets the police trace, freeze and eventually recover funds that have not yet been moved out of the banking system.

Spoofing is the forgery of the sender line of an email so that it appears to come from an address that is not the sender's. The harm lands in one of two ways. Either you are induced to authorise a transfer or to disclose a password, or a third party such as a customer, a supplier or an accounts clerk is induced to pay a criminal who was impersonating you. Both are recoverable in principle, and neither is recoverable if you spend the first week arguing with a branch instead of filing.

The two victims need different first moves. If your own account was debited, the bank is the primary counter-party and the RBI liability ladder is the main lever. If your business was impersonated and a customer paid the criminal, your customer's money is the loss, and your role is to produce the evidence that proves the sender was not you. Getting this distinction right in the first hour prevents the common error of chasing the wrong institution while the money is still traceable.

What the law says about spoofed-email payments

The Information Technology Act, 2000 punishes the conduct behind a spoof rather than the spoofing technique. Section 66 deals with computer-related offences where a person dishonestly or fraudulently does an act referred to in section 43, which covers unauthorised access, downloading and disruption. Section 66C punishes identity theft, the fraudulent use of another person's electronic signature, password or unique identification feature. Section 66D punishes cheating by personation using a computer resource or communication device. Under the Bharatiya Nyaya Sanhita, 2023 the same facts are usually charged as cheating under section 318, cheating by personation under section 319 and forgery under section 336 where a document is fabricated, with criminal breach of trust under section 316 where funds entrusted to a person are diverted.

The money is governed by the Reserve Bank's directions on customer protection in unauthorised electronic banking transactions. They divide transactions according to whether the loss flowed from the customer's own negligence, and they set a reporting ladder: report promptly and the customer's liability is nil, report late and liability moves up in defined steps towards the customer. The regulator revises the exact numbers from time to time, so treat the current circular or your bank's stated policy as the source rather than any figure you read online. The stable principle is that the speed of your report is the single largest factor in whether the bank credits you back.

Electronic proof is governed by the Bharatiya Sakshya Adhiniyam, 2023. Section 63 deals with the admissibility of electronic records and, in practice, requires a certificate in the prescribed form when such a record is produced as evidence. That is why exporting the mail headers, the message body and the bank statement in a form that can later be certified matters from the very first day rather than at the trial. On the police side, section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 requires a station to record the information, and section 175(3) lets a magistrate direct investigation if it does not.

How to recover the money, step by step

1. Report within the first hours. Call your bank's helpline and your home branch, state that the debit was unauthorised, and ask for the channel involved — card, net banking, UPI or wallet — to be blocked immediately. Note the time of the call, the name of the person you spoke to and any reference number, because that note may become the proof of your reporting date.
2. Put the complaint in writing the same day. Send an email and, where convenient, hand a written complaint at the branch. State the amount, the transaction reference, the date and time of debit and the fact that you did not authorise it. A written complaint fixes the date of reporting, which is what the liability ladder turns on.
3. Log the national cyber complaint. Call 1930 or file on cybercrime.gov.in. This registers the incident in the national system and is what allows a transaction to be traced across banks. Money still inside the banking system can sometimes be frozen at this stage, and the acknowledgement number you receive is worth keeping in the same folder as the bank's reply.
4. File the first information. If the amount is significant, or the bank refuses to act, lodge a complaint at the police station with jurisdiction, or use the online route, and obtain the FIR or the complaint acknowledgement. Under section 173 of the BNSS, 2023 the police must record the information, and section 175(3) allows an application to the magistrate if they decline to investigate.
5. Preserve the spoofed email and its full headers. Delete nothing. Export the complete message with headers, keep the original in the mailbox and take dated screenshots. The header is what shows the message did not originate from the address it claims to come from, and it is the one piece of proof the attacker cannot erase from your side.
6. Close the loop with the bank in writing. Ask for a written decision on your liability. If the bank rejects the claim, its reasons must be reduced to writing, and that letter becomes the foundation of a complaint to the banking ombudsman or a consumer complaint.
7. Escalate if the bank stalls. Approach the Reserve Bank's integrated ombudsman scheme for your bank, and keep the criminal complaint alive in parallel rather than in place of it, because the two do different work.

Begin with the bank because the bank controls the money; the police trace the person who took it. Doing these in the wrong order costs time that the liability ladder does not give back, and time is the only resource in this kind of case that cannot be recreated later.

Timelines and forums at a glance

Keep together the bank statement, the spoofed email with full headers, your written complaints with dates, the bank's replies and the FIR or its acknowledgement. Few of these matters fail for want of law; many fail because the date of reporting cannot be proved when it matters, months later, in front of an officer or a judge who was not there on the first day.

What the bank will ask you

Expect a short, pointed questionnaire. Did you receive a one-time password and enter it? Did you click a link in the message? Was the message on a device you control? Had you shared the password with anyone? The bank is not being hostile; it is classifying the transaction under the RBI framework, and your honest, consistent answers decide the classification. Give the same answers to the police, because a story that changes between the two complaints is what sinks otherwise strong claims.

What decides the outcome

Three things carry weight. The first is the reporting date, because the earlier you reported the larger the share of the loss the bank bears. The second is negligence, because if the bank can show that you shared an OTP, clicked a link or ignored a warning it will argue that the loss was authorised, or at least was made possible by your carelessness, and that shifts liability towards you. The third is traceability, because money that has not yet left the banking system can realistically be frozen and returned, while money already withdrawn in cash leaves the criminal case alive but the funds usually gone.

There is a fourth, quieter factor: the quality of your record. A victim who can produce a timestamped complaint, a clean email export and a consistent account of the day is treated as credible from the start, while a victim who reconstructs everything from memory three weeks later is treated as uncertain. Build the record on day one and the rest of the case runs on rails.

None of this is a guarantee. The bank's assessment, the police investigation and, if it comes to it, a court's view of the evidence each decide their own part, and no honest adviser can say in advance how one particular bank will classify one particular transaction.

Common mistakes to avoid

• Deleting the spoofed email or the forwarded chain. The header is the evidence and a deleted header is not recoverable.
• Reporting only to the police and not to the bank on the same day, which forfeits the favourable position on liability.
• Accepting a verbal "we are looking into it" from the branch instead of a written complaint reference.
• Sharing OTPs, passwords or remote-access permission with anyone who calls claiming to be from the bank.
• Waiting to see whether the money returns before filing, which resets the clock against you.

A note on timing

Two clocks run at once, and they run at different speeds. Your liability position against the bank is set on the first day, while the police investigation is set by the life of the money trail. A victim who files everything on day one loses nothing by acting early, even when the amount and the offender are not yet known, because every report can be supplemented afterwards with the details that arrive later.

If your business has been impersonated rather than debited, add a written notice to your customers and vendors within the day, because a fresh spoofed mail is the fastest way for the criminal to convert one victim into several and to make your own name look unreliable.

When to involve a lawyer

Most clean cases are resolved by the bank once reporting is timely and documented. A lawyer becomes useful when the bank refuses despite prompt reporting, when the amount is large enough that the police need to be prodded through an application under the BNSS, when the same fraud is hitting your business repeatedly, or when you need to recover from an identified wrongdoer through a civil suit. A cyber crime lawyer in Kolkata can review the sequence of reporting, draft the complaint and the ombudsman representation, and keep the criminal and civil tracks from contradicting each other. If a bank has already refused the claim, the cyber crime legal services in Kolkata page explains what the next stage looks like for a Kolkata complainant. Start with the free national channels, and contact the office when the channels stop working.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• How to recover money lost to hacking of email
• Business email compromise how to recover money
• Email spoofing: what it is and how it works in India
• Hacking of email: complaint, remedies and civil recovery
• Business email compromise: evidence to preserve in 48 hours
• Work from home scam how to recover money in India

Cyber crime lawyer in your city · Bank account freeze help · Contact