Net banking fraud complaint process: steps and timeline
By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Online fraud
A net banking fraud complaint process in India starts with the bank, not with the police station. The account holder must block the channel, dispute the transfer and preserve the login alerts before the money is moved again. The 1930 report and the police complaint follow, but the bank's fraud team is the first responder.
A net banking fraud complaint process in India starts with the bank, not with the police station. The account holder must block the channel, dispute the transfer and preserve the login alerts before the money is moved again. The 1930 report and the police complaint follow, but the bank's internal fraud team is the first responder. The order matters because a net banking transfer is pushed to a beneficiary account and can be withdrawn within minutes.
Net banking fraud differs from card fraud in the evidence it leaves. The bank can see the login time, the device, the IP address, the payee addition and the OTP verification. The complaint should be built around those records. A general allegation that money was stolen is weaker than a statement that a new payee was added at a particular time and a transfer was made without the account holder's knowledge. The complaint is built on the IT Act 2000, the BNS 2023, the BNSS 2023, the BSA 2023 and the RBI's 2017 directions.
What the law says
The IT Act 2000 provides the computer-crime provisions. Section 66 covers computer-related offences, including unauthorised access to a computer resource. Section 66C covers identity theft, which applies when a person dishonestly uses another person's electronic signature, password or unique identification feature. Section 66D covers cheating by personation by using a computer resource. In a net banking case, the fraudster uses the login ID, password or OTP to impersonate the account holder, so Sections 66C and 66D are usually central.
The BNS 2023 provides the general criminal offences. Section 318 deals with cheating and dishonestly inducing delivery of property. Section 316 deals with criminal breach of trust where a person entrusted with property misappropriates it. Section 336 deals with forgery, which can apply where fake payee details or fake receipts are used. Section 351 deals with criminal intimidation where threats follow the fraud. The police may register the case under the BNS provisions and the IT Act provisions together.
The BNSS 2023 governs procedure. Section 173 requires the police to record information about a cognizable offence. Section 175(3) allows a magistrate to order an investigation in certain circumstances. Section 35 deals with arrest and its safeguards. Section 187 deals with remand and the limits on detention. Sections 480, 482 and 528 deal with the powers of magistrates and higher courts at different stages. A complainant who is turned away at the police station should ask for the refusal in writing and use Section 175(3).
The BSA 2023 governs electronic evidence. Section 63 makes electronic records admissible when the statutory certificate and conditions are satisfied. Net banking statements, login alerts, SMS messages, email headers, screenshots of the fake page and the call log are electronic records. The certificate should be prepared early, because banks and telecom providers may retain logs only for a limited period.
The RBI's 2017 directions on customer protection for unauthorised electronic transactions set the bank's obligations. They require a reporting channel, acknowledgement, investigation and a liability decision based on negligence. They also provide for provisional credit in certain cases. The directions are not criminal law, but they give the account holder a structured way to push the bank and a ground for escalation if the bank does not respond.
Before you file the complaint
Secure the account first. Change the net banking password from a device that was not used in the fraud. Revoke access to unfamiliar devices and linked applications. Check the list of registered payees and remove any payee you do not recognise. If the account is joint, tell the other holder. If the fraud involved a SIM swap, contact the telecom provider and ask for the number to be restored and for the SIM change record.
Do not delete anything. The SMS alerts, the email from the bank, the call log and the fake page are evidence. If the fraudster is still in contact, stop responding and do not confront them. A confrontation can prompt the withdrawal of the money or the deletion of the account. Save the chat and the caller's number, but do not call back.
Step-by-step net banking fraud complaint process
- Call the bank's 24-hour helpline. Ask for net banking to be blocked and for the transaction to be disputed. Give the transaction reference, amount, time and beneficiary account if it is visible. Note the call time and the reference number.
- Ask for a hold or recall request. Ask the bank to contact the beneficiary bank and request a freeze or recall while the dispute is investigated. The bank may not guarantee a hold, but the request should be recorded.
- Call 1930 and use cybercrime.gov.in. Report the transaction, the beneficiary account, the phone numbers involved and the fake URL or app. Save the acknowledgement number and the PDF receipt.
- Write to the bank's nodal officer. Send a short email with the account number, the transaction details, the 1930 acknowledgement and a clear statement that the transfer was not authorised. Ask for a written acknowledgement and a complaint number.
- File an FIR or a police complaint. Go to the police station with jurisdiction or use the online system. Under BNSS Section 173, the officer must record the information. Keep the FIR copy and give the FIR number to the bank.
- Preserve the evidence. Download the statement, keep the login alerts, screenshot the payee addition and the fake page, and preserve the call log. Prepare a BSA Section 63 certificate when the electronic record is to be produced in court.
- Follow up with both banks. Ask your bank whether the beneficiary account has been flagged. Ask the beneficiary bank, through your bank, whether the funds are still available. Keep every reply in writing.
- Track the timelines and escalate. If the bank does not acknowledge or decide the complaint, use its internal grievance process and then the RBI's grievance mechanism. Keep a single timeline sheet of calls, emails and ticket numbers.
Documents and timeline table
| Stage | Authority | Documents | What you get |
|---|---|---|---|
| Block the channel | Bank helpline | Account number, registered mobile | Blocking reference |
| Dispute the transfer | Bank's dispute team | Transaction reference, statement | Ticket number |
| National report | 1930 and cybercrime.gov.in | Transaction and suspect details | Acknowledgement number |
| Bank escalation | Nodal officer | Written complaint and 1930 receipt | Complaint number |
| Police complaint | Police station | Written complaint and documents | FIR or complaint receipt |
| Grievance | RBI grievance mechanism | Bank's rejection or silence | Order or advice |
The RBI's 2017 directions expect the customer to report within three working days for zero liability. The bank is expected to resolve the complaint within ninety days. These are outer timelines, not guarantees. The police investigation runs on a separate timeline, and the bank's decision does not depend on the police filing a charge sheet.
A practical sequence is to block the channel within minutes, file the 1930 report within hours, send the nodal officer email the same day and file the FIR within the week. The bank's provisional credit decision may come within ten working days in a zero-liability case. If the money has moved to a second account, the freeze request becomes time-critical and should be repeated in writing.
What the bank will ask
The bank will ask whether the login was made from a known device, whether the OTP was shared, whether the payee was added by the customer and whether the customer had ever transacted with the beneficiary before. It will also ask for the FIR copy and the 1930 acknowledgement. The answers should be consistent and factual. If the customer shared the OTP after a phone call, that should be stated clearly, with the caller's number and the time.
The bank may also ask for a written indemnity or a declaration. The customer should read the document before signing. A declaration that the customer authorised the transaction can damage the dispute. A declaration that the transaction was unauthorised is different from a declaration that the customer was careless. The wording matters, and a copy should be retained.
What decides the outcome
The first factor is the speed of the report. A complaint made within minutes gives the bank a chance to freeze the beneficiary account. A complaint made after several days usually finds the money withdrawn. The timestamp on the first call and the 1930 report are the key evidence of speed.
The second factor is negligence. If the customer shared the password or OTP, installed a remote-access app or approved a payment to a fraudulent merchant, the bank may apply limited liability. The RBI's 2017 directions distinguish between a third-party breach where the customer is not negligent and a case where the customer's own act enabled the fraud. The bank's authentication logs will show whether the login and the OTP were valid.
The third factor is the beneficiary account. If the account is a mule account, the bank may be able to freeze it and return the available balance. If the money has moved through several accounts, recovery depends on how quickly the police and the banks trace the chain. The complaint should identify the beneficiary account and the transaction reference so that the freeze request is precise.
The fourth factor is the bank's compliance with the RBI directions. If the bank failed to acknowledge the complaint, failed to investigate within the timeline or failed to give reasons, the customer can argue that the process was defective. That argument supports an escalation and, in an appropriate case, a consumer or civil claim.
A fifth factor is the quality of the complaint itself. A complaint that lists the login time, the device, the new payee, the transaction reference and the beneficiary account is easier to investigate than a general allegation. The bank and the police work from records. If the complaint gives them the exact reference numbers and a short chronology, the freeze request and the liability review move faster.
Common mistakes to avoid
- Calling the police before calling the bank, when the bank could still freeze the transfer.
- Giving the wrong beneficiary account number or omitting the transaction reference.
- Deleting the fake link, SMS or call log before the bank reviews the dispute.
- Sharing the OTP or password again when the fraudster calls back.
- Signing a bank declaration without reading it.
- Filing only a bank complaint and not an FIR, or the reverse.
- Failing to change the password after the fraud, which allows a second transfer.
When to involve a lawyer
Many account holders can complete the first stages without a lawyer. Legal help is useful when the bank denies liability, when the amount is large, when the beneficiary is identified and the police need to be pushed, or when the bank's records are incomplete. A cyber crime lawyer in Kolkata can review the bank's decision and draft the escalation. For urgent coordination between the bank, the 1930 portal and the police, the cyber crime legal services in Kolkata page explains the practical support available. The aim is to preserve the record and choose the right forum, not to guarantee an outcome.
Need help with a cyber crime matter?
Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.
Call +91-9007000603 WhatsAppFrequently asked questions
What is the first step in a net banking fraud complaint?
Call the bank's 24-hour helpline and ask for net banking to be blocked and the transfer to be disputed. Get a reference number and the time of the call. Then report on 1930 and cybercrime.gov.in. The bank can request a freeze only if it receives the complaint before the money is withdrawn.
Which documents are needed for a net banking fraud complaint?
Keep the bank statement, the transaction reference, the login and SMS alerts, the 1930 acknowledgement, the written complaint to the nodal officer and the FIR copy. If a fake page or app was used, save the URL, screenshot and call log. A BSA Section 63 certificate may be needed for court.
Can the bank freeze the beneficiary account after a net banking fraud?
The bank can ask the beneficiary bank to freeze or recall the funds, but it cannot guarantee a freeze. The request is more likely to succeed if it is made quickly and includes the transaction reference and beneficiary account. The police can also request a freeze after the FIR is registered.
How long does a net banking fraud complaint take?
The RBI's 2017 directions expect the bank to resolve the complaint within ninety days. A provisional credit decision may come within ten working days in a zero-liability case. The police investigation can take longer. The bank's timeline and the criminal timeline run separately, so the customer should follow both.
What if the police refuse to register my net banking fraud complaint?
Ask the officer to record the complaint under BNSS Section 173 and give you a copy. If the officer refuses, request the refusal in writing. You can then approach the magistrate under BNSS Section 175(3) with the written complaint and the supporting documents.
Does sharing an OTP affect my net banking fraud complaint?
It can. The bank may treat the shared OTP as customer negligence and apply limited liability under the RBI's 2017 directions. If you were deceived by a fake bank official, state the caller's number, the time and what you were told. The bank will still check whether the authentication was valid.
Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.
Related articles
Cyber crime lawyer in your city · Bank account freeze help · Contact