Job Scam: How to Recover Money You Lost in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Online fraud

Recovery after a job scam depends on speed, not on the amount. Call 1930 and file on cybercrime.gov.in the same day so the beneficiary account can be frozen. The offence is cheating under section 318 BNS, with IT Act sections 66C and 66D where a fake website or offer letter is used.

If you have already paid money to a fake recruiter, recovery is possible but it is never guaranteed, and the outcome depends almost entirely on how fast you act. Call 1930 and file a complaint on cybercrime.gov.in the same day you realise the offer was fake. The money you send to a job scam normally lands in a mule account — a bank account opened in someone else's name — and it is moved out again within minutes, so the first twenty-four hours decide whether anything is left to freeze.

The legal position is straightforward even when the recovery is not. Taking money from you on a false promise of employment is cheating under section 318 of the Bharatiya Nyaya Sanhita, 2023. Where a computer resource, a fake website or a forged appointment letter is used, section 66D of the Information Technology Act, 2000 (cheating by personation using a computer resource) and section 66C (identity theft) apply as well. Your complaint is a criminal complaint; getting the money back is a separate civil claim for recovery, and both can run at the same time.

Why job scam money disappears so quickly

A job scam is not one fraudster with one bank account. It is a payment chain. The "HR manager" who interviews you on a video call is often a paid operator working a script. The company website is cloned from a real firm's site, the offer letter carries a copied logo and a fake seal, and the account you are told to pay is a rented current account belonging to a small business or a student who sold their KYC documents.

Once your transfer clears, the operator instructs a second layer of accounts to split the amount. Some of it becomes cash withdrawn at an ATM in another state. Some of it is converted into prepaid wallets or gift vouchers. Some is routed into cryptocurrency through a peer-to-peer trader. Each hop makes the trail harder to follow and the money harder to attach. This is why the freeze request must reach the bank while the funds are still in the first account, and why the exact account number, IFSC code, UPI ID and timestamp matter more than the narrative you write later.

It also explains why recovery in job scams is harder than in a card fraud where the bank can reverse a chargeback. In a job scam you authorised the payment yourself and the bank was not breached; it processed a transfer you instructed. Recovery therefore depends on the investigation locating and attaching the money, or on a civil decree against an identifiable person who still has assets.

What the law says

Cheating and dishonest inducement. Section 318 BNS covers the core conduct: inducing a person to deliver property by a dishonest or fraudulent promise. The promise of a job that does not exist is a false promise, and the fee you paid is the property delivered. Section 316 BNS (criminal breach of trust) is added where the accused was entrusted with your money or documents in a fiduciary role, for example a consultant or an agent who took a placement fee and vanished.

Forgery and impersonation. A fake offer letter, a forged company seal or a fabricated ID card attracts section 336 BNS (forgery) and, where the letter is used to obtain money, the aggravated forgery provisions. Where a fake domain or a cloned website is used to personate a real company, section 66D IT Act is the charge that fits the technology, and section 66C covers the misuse of another person's identity, documents or electronic signature.

Criminal intimidation and extortion. Many job scams do not end at the first payment. The operator demands a "security deposit", then a "training kit fee", then threatens that your documents will be misused or that a case will be filed against you. Threats to publish or misuse personal data, or to cause injury, attract section 351 BNS (criminal intimidation); where the threat is used to extract more money, the extortion provisions apply. Do not pay again because of a threat — the threat is part of the script.

Investigation and process. A job scam complaint is a cognizable offence, so the police must register an FIR under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023. Section 173 BNSS allows registration on information, including information given electronically, and the officer must give you a copy of the FIR. If the station refuses to register, section 175(3) BNSS lets you apply to the Magistrate, who can direct investigation. Section 35 BNSS governs arrest and the notice of appearance, which matters when the accused is a company or a person in another state.

Electronic evidence. Chat logs, emails, call recordings, screenshots, bank statements and the scam website's HTML are electronic records. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 governs their admissibility and requires a certificate in the prescribed form when the record is produced as evidence. Preserve the original device and the original message threads; a forwarded screenshot without the source is weak.

Bank liability. The Reserve Bank of India's 2017 directions on limiting customer liability in unauthorised electronic banking transactions protect a customer where the transaction was unauthorised and was reported promptly. They do not automatically cover a transfer you authorised to a fraudster, which is why victims who paid a "registration fee" find the bank refusing to reverse. That refusal is not always the end of the argument: if the bank opened or operated the receiving account without proper due diligence, or ignored a fraud alert, the bank's own KYC and monitoring obligations become relevant, and a written representation to the nodal officer should say so.

Step by step: what to do after you realise it is a scam

Stop all contact and all payments. Do not send the "refund processing fee" or the "GST clearance" amount. Every further payment is a fresh loss and complicates the story you give the police.
Call 1930 immediately. The national cyber crime helpline logs the transaction and can raise a request to freeze the beneficiary account. Have the amount, the date and time, the beneficiary account number and IFSC, or the UPI ID and the UTR number ready.
File on cybercrime.gov.in. Choose "Report Financial Fraud", enter the transaction details and upload the offer letter, the chat export, the payment screenshot and your bank statement. Save the acknowledgement number; it is the reference every later office will ask for.
Write to your bank's nodal officer the same day. Send an email, not only a phone call, marking a copy to your branch. State that the transfer was induced by a fraudulent job offer, give the UTR, and ask for a lien or freeze request on the beneficiary account. An email creates a timestamp you can produce later.
Give a written complaint at the police station. Attach the 1930 acknowledgement and the portal acknowledgement. Ask for the FIR copy and note the FIR number. If the station treats it as a civil dispute, say plainly that a false promise of employment induced a payment and that cheating and cheating by personation are made out.
If the FIR is refused, move the Magistrate under section 175(3) BNSS. Attach your written complaint, the date you gave it, and any written refusal. The application is a short petition asking the court to direct investigation.
Follow the money in writing. Ask the investigating officer, in writing, for the status of the freeze request and the beneficiary account. Keep every reply. In Kolkata, complaints that begin at a local station are routed to the cyber crime unit, and a written trail shortens the loop.
Start the civil claim if the amount justifies it. A suit for recovery of money against the identified beneficiary, and against the operator where identified, can run alongside the criminal case. Freezing under the criminal process preserves the fund; a civil decree is what actually puts it back in your hands.

Where to go, and what each forum can actually do

Forum	When to use it	What it can deliver
1930 helpline	Within hours of the transfer	Transaction log, freeze request to the beneficiary bank
cybercrime.gov.in	Same day, and for every later update	Formal complaint, acknowledgement number, linkage to the cyber crime unit
Bank nodal officer	Same day, by email	Lien on the receiving account, internal fraud report, written response
Police station (section 173 BNSS)	Immediately, even if 1930 was already called	FIR, investigation, search and seizure, arrest where warranted
Magistrate (section 175(3) BNSS)	If the station refuses to register	Direction to investigate
Civil court	Once the beneficiary or operator is identified	Decree for recovery, attachment of assets

What decides the outcome

Speed. The single largest factor. Money still parked in the first mule account can be frozen; money withdrawn across four states usually cannot. A complaint filed on day one and a complaint filed on day fifteen are different cases.

Whether you authorised the payment. This decides the bank's liability and your credibility. A victim who was tricked into a voluntary transfer is still a victim of cheating, but the bank's reversal obligation is narrower than in a card skimming case. Be honest in the complaint about what you were told and what you paid — an inconsistent account is the fastest way to have the complaint treated as a commercial dispute.

Quality of the trail. A complaint that gives the beneficiary account number, the UTR, the exact time and the chat thread is workable. A complaint that says "I was scammed on Telegram" is not. The investigating officer can only send a freeze request against an identified account.

Identification of the accused. Mule account holders are often traced; the operator behind them is harder. Where the accused is identified and has attachable assets, a decree or restitution order becomes realistic. Where the trail ends in cryptocurrency or an overseas exchange, recovery narrows sharply.

Whether the offence is treated as cheating or as a commercial dispute. If you paid a genuine consultancy that failed to place you, the case may be a breach of contract rather than cheating. The distinction turns on whether the accused never intended to perform, and on the evidence of intent at the time the money was taken.

Mistakes that cost victims their money

Paying a second "recovery fee" to someone who found you on social media and promises to get the first amount back. Recovery agents who demand an advance are running a second scam on the same victim.
Deleting the chat, blocking the number, or clearing the call log in anger. The conversation is the proof of the false promise.
Waiting for the company to "refund" before complaining. The company does not exist; the wait only moves the money further away.
Filing only a police complaint and never informing the bank, so no freeze request ever reaches the beneficiary account.
Assuming that because the amount is small, no forum will look at it. Small ticket job scams are aggregated in the same payment chain, and one complaint can help identify the account used against many victims.

When to involve a lawyer

If the amount is significant, if the police have refused to register an FIR, if the money moved through a company account rather than an individual's, or if you are being threatened after the fraud, a lawyer is useful early rather than late. A cyber crime lawyer can draft the written complaint so that it pleads the right sections, pursue the section 175(3) BNSS application before the Magistrate, and run the civil recovery claim in parallel without waiting for the criminal trial to end. For the criminal side and the forum choices, see cyber crime lawyer in Kolkata. For the money claim itself, the process is set out under civil litigation.

None of this guarantees recovery. What it does is stop the losses from being compounded by procedural mistakes in the first week, when the money is still findable.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Can I get my money back after a job scam in India?

Sometimes, and mainly if you report within hours. Call 1930 and file on cybercrime.gov.in the same day so a freeze request reaches the beneficiary account while funds remain. Recovery also needs an FIR under section 173 BNSS and, where the accused is identified with assets, a civil suit for recovery. No outcome is guaranteed.

Is a job scam a criminal offence or only a civil dispute?

It is primarily criminal. Inducing payment on a false promise of employment is cheating under section 318 BNS, and using a fake website or forged offer letter adds sections 66D and 66C of the IT Act. A civil claim for the money can run in parallel, but the fraud itself is investigated as a crime.

What details should I give the 1930 helpline?

Give the exact amount, the date and time of each transfer, the beneficiary account number and IFSC or the UPI ID, the UTR or reference number, and the recruiter's phone number or profile link. Accurate transaction identifiers let the helpline raise a freeze request against a specific account instead of a general complaint.

What if the police station refuses to register my job scam FIR?

You can apply to the Magistrate under section 175(3) BNSS, attaching your written complaint and any refusal. Keep a dated copy of what you submitted at the station. The Magistrate can direct that investigation be conducted. Refusal to register a cognizable offence is itself a procedural irregularity you can place on record.

Does the RBI 2017 circular protect me if I paid the scammer myself?

Not automatically. The 2017 directions on customer liability address unauthorised electronic transactions. A transfer you authorised, even because you were deceived, generally falls outside zero liability. The argument shifts to the bank's KYC and monitoring failures on the receiving account, which is why a written representation to the nodal officer matters.

How long does a job scam investigation usually take?

There is no fixed timeline. Freeze requests are acted on quickly, but tracing layered accounts, obtaining records from payment aggregators and prosecuting the accused can take many months. The criminal case and any civil recovery suit proceed separately. Delay in reporting is the main reason investigations lose the trail.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact