KYC update scam how to recover money: a practical guide

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Online fraud

A KYC update scam begins with a message, call or email that claims your bank account will be frozen unless you re-verify your details. The link opens a page that looks like your bank's website, or the caller asks you to install a screen-sharing app. You enter your customer ID, password and the OTP, and the money leaves your account within minutes. The first thing to understand is that you have not authorised that transfer, even if you tapped a button. Indian law treats this as identity theft and computer-based cheating, not as a legitimate payment you cannot dispute.

Recovery is a race against the movement of funds. Your complaint creates a legal trail that lets the bank and the police freeze the receiving account, and it preserves your right to challenge the debit under the RBI's customer-protection rules. This page sets out the law, the exact sequence to follow, the documents that matter, and the points a bank or court actually weighs when you claim the money back.

What the law says about a KYC update scam

The offence is covered by two statutes, because the fraud uses both a computer resource and a dishonest inducement. Under the Information Technology Act 2000, Section 66C punishes identity theft: the dishonest use of another person's electronic signature, password or other unique identification feature. Section 66D punishes cheating by personation using a computer resource or communication device. Both are cognizable offences, which means the police can register an FIR without waiting for a magistrate's order.

Under the Bharatiya Nyaya Sanhita 2023, the underlying conduct is cheating under Section 318, and where property is dishonestly induced to be delivered, Section 318(4) applies. If the fraudster was entrusted with your credentials or documents and betrayed that trust, Section 316 (criminal breach of trust) may also be invoked. Forgery of a bank page or a KYC form can attract Section 336. These provisions matter because the FIR should name the correct sections; a vague complaint about a fraud call is easier for a bank or a magistrate to treat as a civil dispute.

Two regulatory instruments decide the bank's duty. The RBI Master Direction on Know Your Customer (2016, as amended) requires banks to carry out KYC through authorised channels and expressly warns customers that the bank never asks for an OTP, password or PIN. The RBI circular on limitation of customer liability in unauthorised electronic banking transactions (2017) sets out when a customer bears zero liability and when liability is shared. Where the fraud is a third-party breach and the customer reports promptly, the bank's own circular points to zero liability. That circular is the strongest lever you have before any court proceeding.

The recovery ladder, in the order that works

Do not start with a lawyer's letter. Start with the free, time-bound channels, because they are the only ones that can freeze funds while the money is still recoverable.

1. Call 1930 immediately. This is the National Cyber Crime Helpline. Give the exact transaction IDs, the amount, the time, the receiving account or UPI handle if shown, and the phone number or link used by the fraudster. The operator raises a ticket in the national cyber crime portal and routes a freeze request to the banks involved.
2. File a formal complaint on cybercrime.gov.in. Use the Report Financial Fraud option, upload screenshots and the bank statement, and save the acknowledgement number. The portal complaint is what lets the police later link your case to the mule account and to other complaints against the same beneficiary.
3. Call your bank's fraud or nodal officer line and put it in writing. Ask for the transaction to be marked as unauthorised, for the beneficiary account to be put on hold, and for a written acknowledgement with a complaint number. Follow the call with an email so there is a timestamped record. The RBI circular expects the customer to report within three working days to preserve zero liability, so do not wait for the branch to open.
4. Ask for the dispute form and the chargeback route. For UPI, card and net-banking transactions, the bank has an internal dispute process. Complete the form, attach the FIR copy or portal acknowledgement, and ask for the transaction to be raised as a chargeback with the network or the payment aggregator.
5. Go to the police station if the bank does not act. A written complaint at the station, or to the cyber crime cell, should be treated as information about a cognizable offence under Section 173 BNSS 2023. If the station refuses to register it, you can approach the Superintendent of Police under the BNSS and, if that fails, the magistrate under Section 175(3) BNSS 2023 to direct an investigation.
6. Escalate to the RBI Ombudsman if the bank sits on the complaint. The RBI's integrated ombudsman scheme covers complaints about unauthorised transactions and bank failures to follow the liability circular. This is free and can run alongside the police case.
7. Preserve everything before you clean your phone. Screenshots of the SMS, the caller's number, the fake page URL, the app installed, and the bank alerts. A screenshot taken after the app is deleted or the chat is cleared is worth far less than one taken on the day.
8. Consider a civil suit only after the freeze route has been tried. A suit for recovery of the amount, against the beneficiary and, where the bank breached its own circular, against the bank, is the long route. It is useful when the amount is large and the bank denies liability.

Where the money goes, and what can still be frozen

The recovery outcome depends less on the legal section and more on where the funds are when the freeze request lands. A complaint made within the first hour usually catches money in the first receiving account. A complaint made after a day often finds the account emptied through a chain of transfers.

Build one case file and use the same set of documents everywhere. It should contain your bank statement covering the debit, the transaction reference, a screenshot of the fraudulent message with the sender details visible, a screenshot of the fake page or the app permissions, the 1930 acknowledgement, the portal complaint number, and the written complaint to the bank. Keep the original phone or device untouched until the police or the bank asks for it. If the bank later disputes that you reported in time, this file is what proves the date and the content of your report. A short covering note listing the sequence of events in chronological order also helps the nodal officer and the investigating officer work faster, because neither has to reconstruct the story from scattered screenshots.

What decides the outcome

Speed of reporting. The single biggest factor. The RBI's 2017 circular ties your liability to how quickly you tell the bank. A report on the same day, with a ticket number, is treated very differently from a report made after a week.

Whether you shared the OTP. Banks often argue that a customer who disclosed an OTP authorised the transaction. That argument is not decisive. The fraudster obtained the OTP by personation, and Section 66D IT Act is built for exactly that conduct. But the argument affects how quickly the bank will credit the amount, so your complaint should state plainly that the OTP was obtained by deception and was not given to authorise a transfer to that beneficiary.

Quality of the paper trail. A complaint that lists the exact transaction reference, the beneficiary, the time and the device used is actionable. A complaint that says money was taken from my account gives the bank and the police nothing to freeze.

Whether the bank followed its own process. If the bank failed to acknowledge your report, failed to flag the beneficiary, or ignored the liability circular, that failure becomes a ground before the Ombudsman and, in a suitable case, before a consumer or civil forum.

The beneficiary's profile. A newly opened account with no history and a large credit is a classic mule. Police and banks can act on that pattern. An account that belongs to a real business with a genuine dispute is treated as a commercial quarrel, and the criminal route becomes much weaker.

Common mistakes that cost victims the money

• Calling the number on the fake KYC message again to cancel the request. That confirms you are reachable and gives the fraudster another chance to extract an OTP.
• Waiting for the branch to open instead of calling 1930 and the bank's 24-hour fraud line. The freeze window closes while the branch is shut.
• Filing only a portal complaint and not an FIR. The portal complaint triggers a freeze, but the FIR is what creates a police investigation and a case you can later pursue.
• Deleting the fraudulent SMS or clearing the chat. The sender ID, the link and the wording are evidence, and they are often the only way to connect your case to an organised ring.
• Paying an online cyber recovery service. Genuine recovery is done through the bank, the police and the courts; anyone demanding an upfront fee to retrieve your money is running a second fraud.
• Assuming the bank's first refusal is final. The liability circular and the Ombudsman route exist precisely because banks sometimes refuse first and reconsider when a written escalation lands.

When to involve a lawyer

You can complete the 1930 call, the portal complaint and the bank escalation yourself. A lawyer becomes useful when the bank denies liability in writing, when the police refuse to register an FIR, when the amount is large enough that a civil suit is worth the cost, or when you are being treated as an accused because your account received tainted funds. For the court route in Kolkata, see the cyber crime lawyer in Kolkata page; if your bank or the beneficiary is elsewhere in the state, the West Bengal cyber crime practice explains jurisdiction. A short consultation is usually enough to decide whether the next step is the Ombudsman, a Section 175(3) application or a recovery suit.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• KYC Update Scam: What It Is and How It Works in India
• KYC Update Scam Complaint: Process and Documents
• KYC update scam legal remedies: complaint and recovery
• KYC update scam evidence to preserve in the first 48 hours
• Work from home scam how to recover money in India
• How to recover money lost to a stock market scam

Cyber crime lawyer in your city · Bank account freeze help · Contact