Phishing how to recover money: a practical guide

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Cyber law

Recovering money lost to phishing is a race against the movement of funds, not a single application. There are four routes, and they work in parallel. This guide explains what each route can realistically achieve, how bank liability is decided under RBI's directions, and the steps that preserve your best chance of getting the money back.

Money lost to phishing is stolen twice: once when the payment leaves, and again when it is layered through accounts you cannot see. Recovery therefore starts with freezing what can still be frozen and then pursuing the rest through formal claims. The most useful mental shift is to stop looking for one remedy. There are four routes, and a well-handled case uses more than one of them at the same time.

Route one is the freeze, seeking to block the beneficiary account while it still holds your funds. Route two is the bank liability claim under RBI's directions on unauthorised electronic transactions. Route three is the criminal case, which traces the funds, identifies the persons behind the fraud and supports a claim for restitution. Route four is a civil recovery against recipients who can be shown to hold your money without a lawful basis. Each has a different forum and a different standard of proof.

The four recovery routes at a glance

It helps to see the routes side by side before choosing effort. The table below is deliberately cautious: it describes what each route can achieve, not what it guarantees.

Route	Forum	What it can realistically achieve
Freeze of the beneficiary account	Bank and 1930 or portal	Returns funds still held in the receiving account
Bank liability claim	Bank, then its grievance and ombudsman mechanism	Refunds where the bank's process or the transaction failed the RBI standard
Criminal case and restitution	Police station, then the criminal court	Traces the network and can lead to recovery through the court
Civil recovery	Civil court	Recovers from identifiable recipients holding the money without basis

Route one: the freeze

The freeze is the only route measured in hours. When you report to 1930 and to your bank, the bank can place a hold on the beneficiary account so that the funds cannot be withdrawn. This works when the money has not yet been moved onward, which is why the earliest possible report matters more than anything else you will do. If the funds are still in the first receiving account, a freeze converts an investigation into a return.

Practically, give the bank everything it needs to identify the account without asking: the exact amount, the date and time, the transaction reference and the beneficiary details from your statement. Vague instructions produce delay, and delay is what defeats a freeze.

Route two: the bank liability claim

RBI's directions on unauthorised electronic transactions create a framework in which the bank must investigate a reported unauthorised transaction and decide how the loss is shared. The framework distinguishes between a loss caused by a deficiency on the bank's side or by a third party, a loss caused by the customer's negligence, and a loss where the customer reports promptly but the bank fails to act. Where the failure is on the bank's side, the customer is generally not liable; where the customer was negligent, liability may be shared within limits set by regulation.

A phishing payment is usually reported as unauthorised because the victim did not intend to pay the person who actually received the money. The bank may resist this on the ground that the victim authorised the transfer by entering credentials. That contest is the heart of most phishing liability disputes, and it is resolved on how the inducement worked, what warnings the customer had, and how quickly the customer reported. A written complaint, a prompt report and a preserved original message all help.

Two practical points improve this claim. First, put the request in writing even if you have already called, because the record that matters is the written complaint with a number. Second, ask the bank to confirm in writing whether it froze the beneficiary account and when; a bank that was slow to freeze weakens its own position under the RBI framework.

If the bank rejects or dilutes the claim, escalate in writing to its nodal officer, then to the grievance redressal and ombudsman mechanism that RBI maintains for banking customers. Keep every reference number; the escalation is only as strong as the paper beneath it.

Route three: the criminal case and restitution

The criminal route does not recover money directly, but it is what makes the other routes credible. A police complaint or FIR sets the investigation in motion, and the investigating officer can seek the bank records, the beneficiary details and the service provider data that a private complainant cannot obtain. If the accused are traced and funds are recovered, the court can order restitution to the victim during the proceedings.

For this route, the complaint must describe the offence accurately: cheating under section 318(4) of the Bharatiya Nyaya Sanhita 2023, with section 336 BNS where a false identity or forged document was used and section 316 BNS where money was entrusted and misappropriated. Sections 66C and 66D of the Information Technology Act 2000 cover the dishonest use of credentials and the impersonation through a computer resource. Registration follows section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023, and section 35 BNSS allows a zero FIR at any station.

Tracing the money: what investigators actually look for

When a phishing payment is traced, investigators follow the transaction hop by hop. Your money enters a first account, often a mule account, and is then split into transfers to second and third accounts or converted into crypto or prepaid instruments. Every hop leaves a record: the bank's internal ledgers, the payment system logs, and the exchange or wallet records. The trail is provable, but it lengthens with each hop, and the account holder at the far end may be a person whose identity was borrowed rather than the person who planned the fraud. This is precisely why the first freeze matters, and why a complaint that names the first beneficiary clearly is more useful than one that describes only the scam story.

Card payments, chargebacks and why they differ

Where the loss was on a credit or debit card rather than an account transfer, a chargeback may exist alongside the RBI liability claim. A chargeback asks the card issuer to reverse the transaction and raises it with the acquirer and the merchant's bank. It works reasonably well where a merchant received the payment. It works poorly where the payment went to a wallet or a person-to-person transfer, because there is no merchant to charge back to. The deadlines and evidence requirements are set by the card network and the issuer, so the request should be made immediately and supported by the message and the transaction record.

Whichever route you use, the request must identify the money. A complaint that describes a scam but cannot name the account that received the payment gives the bank nothing to freeze and the investigator nothing to trace. Write the beneficiary details down first, straight from your statement, and use the same figures in every filing, because a mismatch between the bank complaint and the police complaint is one of the quickest ways to lose momentum.

It also helps to keep a single master copy of the case file: the message, the link, the statement, the bank reference, the 1930 reference and the police receipt, all in date order. Copies go to each forum, while the master, complete and unedited, stays with you.

Route four: civil recovery

A civil suit is worth considering when a specific recipient or institution holds identifiable funds, or when the loss can be tied to a failure of duty by a service provider. It is slower and costs more, and it is not a substitute for the criminal case. But where the criminal case cannot reach a foreign controller, a civil claim against a domestic recipient who received the money without a lawful basis can be the only practical route to a decree. A legal assessment should decide whether the defendant is worth suing before a suit is filed.

What the law says, in one place

Section 318(4) BNS is the core cheating provision and section 336 BNS covers forgery or false documents used in the fraud; section 316 BNS applies where trust was betrayed. Sections 66, 66C and 66D of the IT Act 2000 address the computer-related side, and sections 67 and 67B apply where obscene material is used. On procedure, section 173 BNSS governs FIR registration, section 35 permits a zero FIR, and section 175(3) BNSS allows a magistrate to direct an investigation when the police decline to act. Electronic records are proved under section 63 of the Bharatiya Sakshya Adhiniyam 2023 with the prescribed certificate. RBI's unauthorised-transaction directions set the liability framework for the bank.

What decides how much you recover

The amount returned is decided less by the size of the loss than by a handful of conditions. The first is where the money sat when you reported. The second is whether your conduct allowed the transaction to be framed as authorised rather than induced. The third is how promptly and consistently you reported. The fourth is whether the loss is traceable to specific accounts or recipients at all. When none of these favour recovery, that is important to know early, so that effort is directed to the criminal case and to prevention.

One further point is worth stating plainly: partial recovery is a normal outcome. A transaction split across several hops may return only the portion still held, and the bank claim may cover a further share. Pursuing all four routes is therefore not overkill; it is how the separated parts are added together.

Speed: the freeze window closes as the funds move.
Framing: an induced payment is argued as unauthorised, not as a regretted transfer.
Consistency: identical facts before the bank, the portal and the police.
Traceability: named accounts and recipients that a court can reach.

Mistakes that cost recovery

Do not delay the report while you search for the scammer yourself; the bank's freeze is time-sensitive. Do not describe the payment to the bank as one you authorised and now regret. Do not file only at the portal and assume the bank has been informed. Do not accept a verbal refusal from the bank. Do not pay anyone who offers to recover your money for a fee, since that is itself a common second fraud.

Avoid signing anything from an unverified party, including a settlement or an authorisation to a supposed recovery service. Genuine recovery runs through the bank, the police and the court, never through an upfront payment to a stranger who contacted you after the fraud.

Waiting for the fraudster to respond before reporting.
Mixing up the facts between the bank, portal and police complaints.
Deleting the original message after taking a screenshot.
Letting the bank's response deadline pass without escalation.
Paying a recovery agent, an investigator or an advocate who demands an upfront fee online.

When to involve a lawyer

A lawyer adds most value where recovery has stalled: a bank that has reduced or rejected the claim, a station that will not register the offence, or a decision about whether a civil suit is worth the cost. A cyber crime lawyer in Kolkata can build the liability argument and the evidence index, and where a recipient holds identifiable funds, a civil litigation route can be assessed alongside the criminal case. Bring every acknowledgement, statement and message you hold to the first consultation, which can be arranged through the contact page. The earlier the assessment, the more routes remain open.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Can I recover money lost to phishing in India?

Yes, partly, and the outcome depends on speed and tracing. If the beneficiary account is frozen before the funds are moved, the money can often be returned. If the funds are layered or converted to crypto, recovery becomes much harder, though the bank liability claim and the criminal case can still produce a result.

What is the first thing I should do to recover phishing money?

Report to your bank immediately and ask it to freeze the beneficiary account, then call 1930 and file on cybercrime.gov.in. The freeze is the only recovery step measured in hours, so it should come before any detailed correspondence about liability. Preserve the original message at the same time, because the bank and the police will both ask for it.

Will the bank refund money lost to a phishing payment?

The bank will refund only if its liability investigation under RBI's unauthorised-transaction directions finds the loss falls on it, or on a deficiency in its process. Because phishing involves the customer entering credentials, banks often contest the claim, so a written complaint, prompt reporting and preserved evidence matter greatly. Keep the written complaint number, because escalation is only as strong as that record.

Can the bank refuse to return money if I shared an OTP?

Sharing an OTP is generally treated as customer negligence, which can reduce liability under RBI's framework. But sharing an OTP during a phishing call is not the same as authorising a transfer, and the bank must still assess how the disclosure occurred and whether the customer reported promptly before deciding the split.

Is a civil suit useful for recovering phishing money?

It can be, where a specific domestic recipient holds identifiable funds without a lawful basis, or where a service provider failed in its duty. A civil suit is slower and costs more than the criminal route, so it should be assessed on whether the defendant is actually worth pursuing before it is filed.

How long does phishing money recovery take?

A successful freeze can return funds within days, while the bank's liability decision usually takes weeks and a criminal case takes months or longer. Civil recovery is slower still. Because the routes run on different clocks, starting the freeze and the bank claim at once gives the best chance of an earlier outcome.

Does Section 63 of the BSA affect my phishing recovery claim?

Yes, it governs how your electronic evidence is proved. Section 63 of the Bharatiya Sakshya Adhiniyam 2023 requires a certificate identifying the device, the record and how it was produced. Keep the original message and the original device until the case is closed, avoid editing, and take advice early so the certificate is prepared correctly.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact