Fake website scam how to recover money: a legal route
By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law
Recovering money from a fake website scam depends less on argument and more on speed. The bank freeze, the 1930 report, the FIR and, where needed, a civil suit each serve a different purpose; the realistic goal is to trace and hold the funds before they are layered away, then pursue the route that fits your facts.
Recovering money from a fake website scam is a race against the speed at which the fraudster moves it. The money is rarely sitting still after you pay; it is pushed into a chain of mule accounts and withdrawn, spent or converted within hours. What you can recover depends on how quickly you report, whether the funds can still be located, and whether your own conduct gave the bank or the fraudster a defence. The law gives you several routes, but they are not equally fast and they do not all aim at the same result.
There are four routes, and they work in parallel rather than in sequence. The bank freeze is the fastest and depends on your transaction reference. The criminal complaint under the Information Technology Act, 2000, sections 66C and 66D, and the Bharatiya Nyaya Sanhita, 2023, sections 318 and 319, aims at prosecution and can support restitution. The civil suit aims at a money decree against an identifiable defendant. The consumer route is available where the seller or platform is a real, traceable business rather than an anonymous site. Knowing which route does what prevents the common mistake of expecting the criminal case to return money quickly.
Recovery is a race, not a right
No provision of law guarantees that a defrauded customer gets money back. What the law does is create mechanisms that improve the odds if used early: the national tracing system behind 1930, the bank's obligation to act on a reported unauthorised transaction, and the court's power to order restitution where an accused is convicted or where property is identified. The outcome turns on facts that are fixed within the first day or two, which is why recovery advice that begins with "wait for the investigation" is usually wrong.
What the RBI directions say about your liability
The Reserve Bank of India's directions on customer protection and on limiting liability in unauthorised electronic banking transactions set the framework for how much of the loss a customer bears. The tiers are measured from the moment the customer notifies the bank, not from the moment the fraud happened.
| When you report | General liability position | What helps your claim |
|---|---|---|
| Within three working days of the debit | Zero liability, where the fraud was not caused by the customer's own negligence | Written notice with the reference number and a prompt acknowledgement |
| After three but within seven working days | Liability is limited and assessed under the bank's policy | Proof of the date and time you first reported |
| Beyond seven working days | Liability is decided under the bank's policy and the facts | Evidence that the delay was beyond your control |
The table is a general guide, not a guarantee. Banks assess each case on the facts, including whether the customer shared an OTP, a password or remote access. A written, timestamped notice is the single most useful document you can create in the first 72 hours.
The criminal route
Filing a criminal complaint does two things that matter for recovery. It triggers the investigation that can identify and freeze accounts, and it creates the legal basis for restitution if the accused is convicted. File with 1930 and cybercrime.gov.in first, then lodge an FIR under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023. Where the police decline to register, a magistrate can be approached under the BNSS for directions to investigate. The criminal route is not a debt-collection mechanism, but it is the only route that can reach across state lines and compel records from banks, platforms and service providers.
The civil and consumer route
A civil suit for recovery of the amount, with interest and costs, is possible where the defendant is identifiable, for example a registered company behind a portal, a named seller, or a payment aggregator that processed the transaction. A consumer complaint can be filed where the opposite party is a real business and the transaction was for a consideration. The civil route is slower than a freeze but can produce an enforceable decree. It is usually pursued alongside, not instead of, the criminal complaint, because the two gather different evidence and offer different remedies.
The routes compared
| Route | What it can achieve | Speed | Key evidence |
|---|---|---|---|
| Bank freeze and dispute | Hold and possibly reverse funds | Fastest | Reference number and written notice |
| Criminal complaint and FIR | Investigation, prosecution, restitution | Moderate to slow | Page capture and payment trail |
| Civil suit for recovery | Money decree against a named defendant | Slow | Contract, payment proof, identity of defendant |
| Consumer complaint | Refund or compensation from a real business | Moderate | Invoice, listing, correspondence |
What decides the outcome
Three factors decide whether money comes back. The first is traceability: funds still held in a beneficiary account can be frozen, while funds already withdrawn through cash or resold goods usually cannot. The second is the strength of the digital record, since the page capture, the payment reference and a section 63 certificate under the Bharatiya Sakshya Adhiniyam, 2023 determine whether the deception can be proved. The third is the customer's own conduct; sharing an OTP or granting remote access gives the bank a reason to limit liability and gives the defence an alternative explanation.
Common mistakes
- Waiting for the website to "process the refund" before notifying the bank.
- Reporting to the bank by phone only, without a written reference number.
- Deleting the payment SMS or the confirmation email.
- Paying a "recovery fee" to an agent who contacts you after the loss.
- Filing only a civil suit without the criminal complaint, or the reverse.
- Assuming the bank's first rejection is final and not escalating it in writing.
Why the first 72 hours matter most
The money from a fake website payment is moved out of the collection account on the same working day in most cases. Investigators and banks can only act on funds that are still identifiable, so the gap between your debit and your first written report is the largest single influence on recovery. In practice the sequence that protects you is fixed: capture the page, record the reference number, report to 1930, notify the bank in writing, then file the police complaint. Each step takes minutes, and each preserves something the next step needs.
Freezing funds: what the bank can and cannot do
A bank can flag a disputed transaction, place a hold on a beneficiary account where a valid request is received, and reverse a debit where the transaction is still within its settlement cycle. It cannot create money that has already left the banking system, and it cannot freeze an account indefinitely without a legal basis. That is why the bank notice and the criminal complaint must travel together: the bank acts on the reference, and the investigating officer's request extends the hold. A complaint that reaches only one of them usually produces only a partial result.
Restitution in a criminal case
Where an accused is convicted, a court can order the return of the property or the payment of compensation to the victim, and property identified during the investigation can be preserved for that purpose. Restitution depends on something being found and on the prosecution succeeding, which is why it is slower than a freeze. It is, however, the route that can reach funds held by a fraudster operating across states, and it is the reason the FIR should be filed even where the immediate freeze has failed.
Building a civil claim that survives
A civil suit for recovery needs a defendant who can be named and served. That may be a registered company behind a portal, an individual seller, or a payment intermediary that processed the transaction. The suit should plead the contract or representation, the payment, the failure to perform and the loss, and it should attach the page capture and the payment record. Interest and costs can be claimed, and a decree, once obtained, can be executed against the defendant's assets. The civil route rewards good documentation rather than speed.
When the defendant cannot be found
Many fake website cases have no identifiable defendant at the outset, because the operator is anonymous and the domain is registered abroad. In that situation the criminal complaint carries the load, because it is the only route that can compel records from banks, platforms and service providers. A civil suit can still be filed once a party is identified through those records, but filing it early against an unknown person achieves little. This is the practical reason the criminal route is started first even when the ultimate aim is money.
Documents that carry a recovery file
Keep a single folder holding the bank or wallet statement with the reference number, the full-page capture of the website with the URL and timestamp, the emails and chat showing what was promised, the acknowledgement from 1930 or cybercrime.gov.in, the written bank notice and its acknowledgement, and your one-page chronology. Every route, whether bank, criminal, civil or consumer, is argued from the same set of documents, so assembling it once and keeping the originals unedited is the most valuable preparation a victim can do.
What a realistic expectation looks like
It is honest to say that a victim who reports within hours has a real chance of a partial or full hold, while a victim who reports after several days has a real chance of nothing. Most recoveries that succeed do so because the funds were still held, not because a court later ordered payment. Setting the expectation correctly matters: the criminal case is worth pursuing for accountability and restitution, the bank route is worth pursuing for the fast hold, and the civil route is worth pursuing only where a defendant can be named.
Two small habits materially improve outcomes. First, keep every acknowledgement in one place, because a bank or a court will ask for the date and time you reported. Second, never delete the original messages or the site capture, since the earliest unedited version is what carries weight under section 63 of the Bharatiya Sakshya Adhiniyam, 2023.
Escalation in West Bengal
In Kolkata and the districts, a recovery file typically runs through the cyber cell, the bank's nodal officer and, where needed, a magistrate application under the BNSS. Where the matter is litigated it may come before the Bankshall Court or the City Sessions Court, with the Calcutta High Court as the supervisory court for the state. A cyber crime lawyer in Kolkata can coordinate the freeze, the FIR and any civil claim so that the routes do not undercut each other. For the procedural detail behind each step, see the cyber crime blog.
When to involve a lawyer
Involve a lawyer when the amount is significant, when the bank has rejected the liability claim, when the police have not registered an FIR, or when the fraudster is identifiable and a civil decree is worth pursuing. A lawyer can draft the bank notice so the freeze request is precise, move the magistrate application, and build the electronic-records certificate. Recovery is never certain, but a coordinated file gives it the best chance the facts allow.
Need help with a cyber crime matter?
Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.
Call +91-9007000603 WhatsAppFrequently asked questions
Can I recover money lost to a fake website scam in India?
Recovery is possible but not guaranteed. It depends on whether the funds are traced and held before they are layered away. Report to 1930 and cybercrime.gov.in and notify your bank in writing the same day, because the freeze window is short and the liability position is measured from the date you report.
How quickly must I report to keep zero liability?
Under the Reserve Bank of India's directions on unauthorised electronic transactions, reporting within three working days generally places a customer in the zero-liability position, provided the fraud was not caused by the customer's own negligence. Reporting later moves the case into limited or assessed liability, so a timestamped written notice matters greatly.
What if the bank refuses to reverse the transaction?
Ask for the refusal in writing and escalate to the bank's nodal officer and grievance redressal channel. If the rejection stands, you can pursue the matter before the banking ombudsman and, separately, keep the criminal complaint alive. A written refusal is itself useful evidence that the bank was put on notice and declined to act.
Is a criminal complaint enough to get my money back?
Not by itself. A criminal complaint triggers investigation and can support restitution if the accused is convicted, but it is not a debt-collection mechanism. Recovery usually needs the bank freeze to hold funds and, where a defendant is identifiable, a parallel civil suit or consumer complaint to obtain an enforceable order.
Can I file a civil suit and a criminal case at the same time?
Yes, and it is often sensible. The criminal complaint pursues investigation and prosecution across state lines, while the civil suit pursues a money decree against an identifiable defendant. The two gather different evidence and offer different remedies, so running them together is common where a defendant can be named, and choosing between them is rarely necessary.
What evidence decides a recovery claim?
The page capture tied to a timestamp, the payment reference or UTR, the bank statement, the correspondence showing the inducement and, where the matter reaches court, a section 63 certificate under the Bharatiya Sakshya Adhiniyam, 2023. Together these prove the deception and the loss, which are the two elements a recovery claim must establish.
Should I accept a refund offer from the website?
Treat any refund offer from the same site with suspicion. Fraudsters often use a refund or verification process to extract more money or fresh OTPs. Do not pay a fee to release a refund and do not share credentials. Keep the offer as evidence and continue the bank and police process rather than relying on the site's promise.
Does reporting late destroy my case completely?
Late reporting weakens the recovery and liability position but does not erase the criminal case. The fraud remains an offence and can still be reported. What changes is the practical chance of freezing funds and the bank's assessment of your liability, both of which are stronger the earlier the written notice is given.
Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.
Related articles
Cyber crime lawyer in your city · Bank account freeze help · Contact