Net banking fraud: what it is and how it works

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Cyber crime

Net banking fraud is the unauthorised use of a bank's online banking channel to move money, change account settings or obtain account data. The fraudster may use stolen credentials, a compromised device, an intercepted OTP or a fake bank page. The customer usually discovers the loss when an SMS alert arrives or when the balance is checked. By then, the money may have moved through several accounts.

It is different from card fraud in one important way. A card transaction can often be stopped at the merchant or through a chargeback, but a net banking transfer is usually pushed directly to a beneficiary account. The speed of the transfer and the number of intermediary accounts determine how much can be frozen. That is why the first hour after the fraud matters more than the first week. The conduct is dealt with under the IT Act 2000, the BNS 2023, the BNSS 2023 and the BSA 2023.

What net banking fraud actually is

Net banking fraud is not a single offence in the IT Act 2000. It is a set of acts that may attract several provisions: unauthorised access to a computer resource, identity theft, cheating by personation, and criminal breach of trust where a person entrusted with credentials misuses them. The common thread is that the bank's online channel is used without the account holder's authority.

The fraud can be external or internal. In an external case, a third party obtains the login ID, password, MPIN or OTP through deception or malware. In an internal case, a person who has lawful access, such as a family member or an employee, misuses the credentials. The legal consequences differ, but the bank's liability rules and the evidence required are similar. The customer's first task is to establish that the transaction was not authorised.

How the fraud runs

Most net banking fraud follows a predictable sequence. The fraudster first obtains a piece of information, then creates a reason for the customer to act, then captures the authentication, and finally moves the money. The sequence is useful because each stage leaves evidence that the bank and the police can request.

Phishing links and fake bank pages

A phishing message imitates the bank's website or app. It may arrive by SMS, email or a search advertisement. The page asks for the login ID, password and OTP, and the fraudster captures them in real time. The customer sees a routine error or a redirect to the real bank site, while the transfer is completed in the background.

Vishing calls and screen sharing

A caller claims to be from the bank's fraud department and says the account is at risk. The caller asks the customer to install a remote-access app, share the screen or read out the OTP. Once the screen is shared, the fraudster can see the password and the OTP as they are entered. The call often ends with a request not to disclose the call to anyone.

SIM swap and OTP interception

In a SIM swap, the fraudster obtains a duplicate SIM or ports the number to a new SIM. The bank's OTP then goes to the fraudster's phone. The customer notices a loss of network service, which is the warning sign. The bank may not know that the SIM has changed unless the customer reports it quickly.

Malware and banking trojans

Malware can be installed through a fake app, a malicious download or a link in a message. A banking trojan can overlay a fake login screen on the real app, capture the credentials and forward the OTP. It can also hide the SMS alerts so that the customer does not see the debit. The device itself becomes the crime scene.

Account takeover through reused passwords

If the same password is used on a bank account and on a breached website, a credential-stuffing attack can succeed without any phishing. The fraudster tries the leaked password on the bank's login page. This is why a unique password and two-factor authentication matter. The bank's logs will show a login from a new device or location.

Fake merchant and investment links

Some frauds begin with a payment request rather than a login page. The customer is told to pay for an investment, a job, a courier or a marketplace order. The payment page looks legitimate, but the beneficiary account belongs to a mule. The bank sees an authorised transfer, while the customer believes the payment is protected.

Why net banking fraud is hard to trace

The first difficulty is speed. A net banking transfer can be completed in seconds. The beneficiary account may be a mule account opened with a stolen identity, and the money may be withdrawn or transferred again before the bank receives the complaint. The trail exists, but it moves faster than a normal investigation.

The second difficulty is authentication. The bank's records may show that the login and the OTP were valid. The fraudster relies on this to argue that the customer authorised the transaction. The customer then has to show that the credentials were obtained by deception, which is why the call log, the phishing URL and the device details are important. The bank's log alone does not tell the whole story.

What the law says

The IT Act 2000 is the primary computer-crime statute. Section 66 covers computer-related offences, including unauthorised access and damage. Section 66C covers identity theft, which applies when a person dishonestly uses another person's electronic signature, password or unique identification feature. Section 66D covers cheating by personation by using a computer resource. A net banking fraud that begins with a fake bank page usually falls within Sections 66C and 66D, and often Section 66 as well.

The BNS 2023 provides the general criminal offences. Section 318 deals with cheating and dishonestly inducing delivery of property. Section 316 deals with criminal breach of trust. Section 336 deals with forgery, which is relevant when fake documents or fake payment receipts are used. Section 351 deals with criminal intimidation where the fraudster threatens the victim after the theft. The police may register the case under the BNS provisions and the IT Act provisions together.

The BNSS 2023 governs the procedure. Section 173 requires the police to record information about a cognizable offence. Section 175(3) allows a magistrate to order an investigation in certain cases. Section 35 deals with arrest and its safeguards. Section 187 deals with remand and the limits on detention. Sections 480, 482 and 528 deal with the powers of magistrates and higher courts at different stages. The complainant's entry point is usually Section 173, but Section 175(3) matters when the police do not register the case.

The BSA 2023 governs electronic evidence. Section 63 makes electronic records admissible when the statutory certificate and conditions are satisfied. Net banking statements, SMS alerts, email headers, screenshots of the fake page and the call log are all electronic records. The certificate should be prepared early, because the bank's logs and the telecom records may be retained for a limited period.

The RBI's 2017 directions on customer protection for unauthorised electronic transactions set the bank's obligations. They require a reporting channel, acknowledgement, investigation and a liability decision based on negligence. They also provide for provisional credit in certain cases. The DPDP Act 2023 adds data-protection obligations on entities that process personal data, and a bank's failure to protect customer data can be relevant to a complaint, although it does not replace the criminal remedy.

Red flags to watch for

• A call or message that creates urgency and asks you to act within minutes.
• A request to install a remote-access app or share your screen with a 'bank official'.
• A link whose domain is slightly different from the bank's official domain.
• A sudden loss of mobile network service, which may indicate a SIM swap.
• An OTP you did not request, followed by a debit alert.
• A request to transfer money to a 'safe account' or a 'verification account'.
• A payment page that asks for net banking credentials outside the bank's app.
• An email or SMS that uses your name but not your customer ID or registered contact details.

What to do first

1. Call the bank's 24-hour helpline. Ask for the net banking channel to be blocked and for the transaction to be disputed. Note the time and the reference number.
2. Call 1930 and use cybercrime.gov.in. Report the transaction, the beneficiary account if known, the phone numbers and the fake URL. Save the acknowledgement number.
3. Change the password and revoke device access. Use a different device if possible. Enable two-factor authentication and check for unfamiliar payees or linked accounts.
4. Write to the bank's nodal officer. Attach the 1930 acknowledgement, the transaction details and a written statement that the transfer was not authorised.
5. File an FIR or a police complaint. Under BNSS Section 173, the police must record the information. Ask for a copy. If the officer refuses, request the refusal in writing and approach the magistrate under BNSS Section 175(3).
6. Preserve the evidence. Do not delete the SMS, email, call log or fake page. Screenshot the transaction and the login alerts. Keep the device available for examination.
7. Follow up with the bank and the police. Ask the bank to confirm whether the beneficiary account has been flagged. Give the FIR number to the bank and the bank's complaint number to the police.

Offence and provision table

The table is a starting point, not a charging decision. The police decide which provisions fit after the investigation. A single fraud can involve several accused persons, including the caller, the account holder who lent the mule account and the person who withdrew the money.

What decides the outcome

Speed decides the most. A report made within minutes gives the bank a chance to freeze the beneficiary account, while a delayed report usually finds the money withdrawn. The authentication record decides the next stage: if the login and OTP were valid, the customer must explain how the credentials were obtained. The bank's compliance with the RBI's 2017 directions and the quality of the police complaint then shape the liability decision and the chance of tracing the funds.

Common mistakes

• Waiting for the bank to reverse the transfer before calling 1930.
• Deleting the fake link or the call log because it looks suspicious.
• Sharing the OTP or the password again when the fraudster calls back as a 'bank official'.
• Filing a complaint only with the bank and not with the police, or the reverse.
• Not changing the password after the fraud, which allows a second transfer.
• Confronting the beneficiary account holder directly.
• Assuming that a small amount is not worth reporting.

When to involve a lawyer

Many net banking fraud complaints can be started by the account holder without legal help. A lawyer is useful when the bank denies liability on the ground that the credentials were valid, when the amount is large, when the beneficiary is identified and the police need to be pushed, or when the bank's records are incomplete. A cyber crime lawyer in Kolkata can review the bank's decision and draft the escalation. For general guidance on how cyber cases move through the system, the cyber law blog is a useful starting point. The aim is to preserve the record and to choose the right forum, not to promise a particular result.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Work From Home Scam: What It Is and How It Runs
• Trading app scam: what it is and how the fraud runs
• Stock market scam: how the fraud actually runs in India
• Sextortion: What It Is and How the Fraud Actually Runs
• Net banking fraud complaint process: steps and timeline
• Mutual fund scam: what it is and how the fraud runs

Cyber crime lawyer in your city · Bank account freeze help · Contact