SEO poisoning how to recover money: legal steps in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Online fraud

SEO poisoning pushes a fake page or helpline to the top of your search results and turns a routine query into a fraud. Recovery depends on the channel the money left through and how fast the beneficiary account is frozen. Report to your bank and 1930 the same hour, preserve the poisoned page, and file a complaint the same day.

Search engine poisoning is not a virus that infects your computer; it is an attack on the search results themselves. A fraudster pushes a malicious page, or a sponsored listing carrying a fake customer-care number, to the top of the results for a term you were already searching. You click what looks like the official helpline, and within minutes you are persuaded to share an OTP, install a screen-sharing app or transfer a verification amount. The money leaves through your own account, so the question is what can actually be recovered and in what order to act.

Recovery depends less on the size of the loss than on the channel the money left through and on how fast the receiving account was frozen. Money that left through UPI or an IMPS bank transfer can sometimes be stopped at the beneficiary account; money converted into gift cards, crypto or a peer-to-peer wallet almost never returns. Understanding that difference before you act is the whole game.

How the poisoned search result works

The attack has three moving parts. First, the fraudster buys placement through a compromised website, a paid advertisement or a hacked page that already ranks for the term. Second, the page mimics a bank, a wallet, a courier or an electricity utility, complete with a phone number, a chat widget and a form that collects your credentials. Third, the victim calls or clicks and is walked through the fraud in real time.

The tell is usually in the detail. The domain is a near-miss of the real one; the number is a personal mobile rather than a landline helpline; the agent asks for a UPI PIN or an OTP, which no genuine bank ever does; or the agent insists on installing a remote-access tool so that screens can be mirrored. Each of these is a feature of the fraud, not an accident.

What the law says

The conduct is cheating under section 318 of the Bharatiya Nyaya Sanhita 2023, and where identity is misused and a computer resource is involved, it also falls under sections 66C and 66D of the Information Technology Act 2000. Section 66C covers identity theft and section 66D covers cheating by personation using a computer resource or communication device. Where the fraudster threatens you later to extract more money, section 351 of the BNS on criminal intimidation may apply.

On the banking side, the Reserve Bank of India directions on unauthorised electronic transactions require a bank to act promptly once an unauthorised transaction is reported and to fix liability by reference to the customer contribution to the loss. The critical word is unauthorised: if you yourself entered the UPI PIN under the fraudster instruction, the bank will argue the transaction was authorised, and the liability analysis changes.

Speed is the recovery. A freeze that lands while the money is still at the first beneficiary account is worth more than any argument made a week later.

What recovery realistically means

Recovery is not one remedy; it is a set of routes that apply to different channels. Money sitting in a frozen beneficiary account can be returned under the bank and portal process. Money already withdrawn from the account can still be pursued from the fraudster or the mule account holder through a criminal case and, in suitable cases, a civil suit. Money converted to crypto or gift cards is, in practice, rarely recovered, though the trail can still support a case.

Channel money left through	Best first route	Realistic outcome
UPI or IMPS bank transfer	Bank helpline, 1930, portal freeze	Recoverable if frozen before withdrawal
NEFT or RTGS transfer	Bank nodal officer, 1930	Partly recoverable within the freeze window
Credit or debit card	Card issuer chargeback	Often recoverable under the card scheme rules
Gift cards or crypto wallet	Criminal complaint, evidence trail	Rarely recovered, but supports the case

The order in which to act

Stop all contact with the fake helpline and do not send any further amount, however convincing the threat.
Call your bank or card issuer fraud line the same hour and ask for the transaction to be held or the beneficiary account frozen. Record the reference number and the agent name.
Dial 1930 and file on cybercrime.gov.in, quoting the bank reference. The helpline can relay a freeze request to the beneficiary bank.
Preserve the poisoned page as you saw it: the URL, the search result, the phone number, the chat transcript and any remote-access app you were asked to install.
Save your bank statement showing the debit and, if a screen-sharing app was installed, the app logs and any access history.
File a written complaint at the police station with jurisdiction, or a zero FIR under section 35 of the BNSS if the fraudster or account is elsewhere.

How the freeze actually works

When you report a UPI or bank fraud to 1930 or to your bank, a freeze request travels to the beneficiary bank through the nodal officer channel, and the beneficiary bank then checks whether the account still holds the funds. If the money is still there, it can be held; if it has already been forwarded, the freeze stops only what remains. This is why the same complaint made at the first hour and made on the third day produces completely different results, and why the phone call matters as much as the written complaint that follows it.

If a screen-sharing or remote-access app was installed

A common variant of SEO poisoning asks you to install a remote-access tool so that the agent can see your screen and, in some cases, control it. If that happened, your device is part of the evidence. Note the app name, the time of the connection and whether the agent could see your payment screen, and preserve the app logs. Uninstall the app only after you have recorded what it showed, then change your banking passwords and remove the app from any trusted-device list.

Card payments and chargeback

Where the loss was on a card rather than a bank transfer, the card scheme chargeback route can be more effective than a police freeze. Report the induced transaction to the card issuer in writing the same day, quote the reference, and state plainly that the payment was obtained by deception. The issuer then follows the scheme rules on dispute and liability. The RBI directions on unauthorised electronic transactions also apply to card transactions and link your liability to how promptly you reported the matter.

Preserving evidence of the poisoned page

The page that defrauded you may vanish within hours, so capture it before it disappears. Record the full URL and the search term that surfaced it; take a screen recording that starts from the search results and moves through the page and the chat; save the phone number and any email or handle used. If you installed a remote-access application on the fraudster instruction, note its name, the time of connection and whether your screen was mirrored during the payment. Electronic records are proved under section 63 of the Bharatiya Sakshya Adhiniyam 2023, so keep the originals unedited and be ready to give the prescribed certificate.

Reporting the fake page

Report the poisoned page or advertisement to the search provider and to the platform that hosted it, so that it can be taken down. A takedown protects the next victim and shows that you acted promptly once you understood the fraud. Keep the takedown request and any reply, because it corroborates your account that the page was fraudulent and has since disappeared, which is exactly the point a defence may otherwise dispute.

Your position with the bank

A bank facing a claim has two lines of defence: that the transaction was authorised, and that the customer was negligent, for example by sharing an OTP or installing a remote-access tool. Neither is a complete answer where the inducement was fraudulent, but both shape the negotiation. Keep every written complaint and reference number, because the record of how quickly you acted is the strongest counter to a negligence argument raised later.

What decides the outcome

Four things decide how much comes back. The channel the money used, because card and bank transfers are recoverable while converted value is not. The speed of the freeze, because every hour increases the layering. Whether the transaction is classified as authorised or unauthorised, because that governs the bank liability. And the clarity of the evidence linking the fake page to the beneficiary account. Where the victim entered the PIN under deception, the argument shifts to the criminal character of the inducement rather than the mechanical act of entering a PIN.

Common mistakes

Calling the same fake helpline again to complain, which restarts the fraud with a fresh script.
Paying a recovery fee to an online recovery agent, which is a second fraud built on the first.
Waiting for a police case to finish before approaching the bank, wasting the freeze window.
Deleting the remote-access app or the chat, which destroys the link between the page and the payment.
Treating the matter as closed once a complaint is filed; follow up on the freeze and the acknowledgement.

If the money left through a payment app or wallet

Where the loss moved through a payment app or a prepaid wallet rather than a bank account, the dispute runs to the issuer of the instrument. Report to the app support line and to your bank in writing, and ask which entity actually holds the funds. Many wallets are sponsored by a bank, and the freeze request must reach that bank, not only the app. Quote every reference you hold, because the layers here often outnumber the layers in a plain bank transfer, and each one narrows the window.

Following up on the freeze

A freeze request is not the same thing as a freeze. Confirm with your bank, in writing, whether the beneficiary account was actually held and, if so, for how long and for what amount. If more than one account was used, ask about each one separately. Where the answer is that the funds had already moved, ask for that in writing too, because the written answer fixes the point at which recovery became impossible and supports the case against whoever failed to act in time.

When to involve a lawyer

If the amount is large, if the bank has declined liability, or if your complaint has not moved, a lawyer can assemble the evidence into a single record, press the bank nodal officer for the freeze, and pursue the beneficiary and the fraudster. The same effort supports a restitution claim within the criminal case. Our cyber crime lawyer in West Bengal page explains how local jurisdiction works, and our contact page is the fastest way to get a first assessment. In every case, the first 24 hours decide the result.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

How quickly should I report SEO poisoning fraud?

Report to your bank and to 1930 within the first hour if you possibly can. A freeze that lands while the money is still held at the first beneficiary account can recover it, while the same request made days later usually cannot. Speed decides the outcome far more than any explanation you offer afterwards.

Can I recover money lost through a fake customer care number?

It depends on how the money left your account. A UPI or bank transfer frozen in the beneficiary account can be recovered, and a card payment may be recovered through a chargeback under the scheme rules. Money converted to gift cards or crypto is rarely recovered, though the trail can still support a criminal case against the fraudster.

Is clicking a poisoned search result my fault?

Not in criminal law. The fraudster committed cheating under section 318 of the Bharatiya Nyaya Sanhita and cheating by personation under section 66D of the Information Technology Act 2000. Your care may affect a civil liability argument with the bank, but it does not make you the offender and does not excuse the fraudster in any way.

What is the difference between authorised and unauthorised here?

If you entered your own UPI PIN under the fraudster instruction, the bank may call the transaction authorised and resist liability for the loss. The victim answer is that a PIN entered because of deception is not true authorisation, and the criminal law treats the whole conduct as cheating. The question is genuinely contested and decided case by case.

Should I use an online recovery agent?

No. Recovery agents who ask for an upfront fee to recover your money are running a second fraud built on the first, and they cannot do anything the lawful channels cannot already do. The proper routes are your bank fraud line, the 1930 helpline, the cybercrime portal and a police complaint, none of which requires a fee to a private agent.

What evidence should I preserve from the poisoned page?

Preserve the page URL, the search term that surfaced it, the phone number and the chat transcript, and any remote-access app you were asked to install. Record a screen video that begins at the search results and moves through the page. Electronic records are proved under section 63 of the Bharatiya Sakshya Adhiniyam 2023, so keep the originals unedited.

Can the bank refuse to help if I reported late?

A bank cannot simply ignore a reported unauthorised transaction, but delay weakens both the freeze and the liability claim. The RBI directions on unauthorised electronic transactions require prompt action and link liability to the customer contribution to the loss. Escalate in writing to the nodal officer and keep every reference number the bank gives you.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact