TeamViewer hacked and money stolen: legal recovery steps
By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Online fraud
Call 1930 first, then the bank. A debit after a deceptive remote session is an unauthorised transaction under the RBI framework, not a payment you authorised, because consent obtained by deception is no consent at all. Report within three working days and the customer's liability is zero.
Money debited after a TeamViewer session is recoverable in three separate ways, and they are not alternatives. You recover from the bank by establishing that the transaction was unauthorised and reported in time. You recover from the fraudster by a criminal case that ends in a freezing order or a restitution direction. You recover from nobody if the first twenty-four hours are spent drafting a long email instead of calling 1930. The legal position is that a payment made after a deceptive remote session is not a payment you authorised in law, even though your finger tapped the button, because section 318 of the Bharatiya Nyaya Sanhita, 2023 treats inducement by deception as cheating.
That last point is where most bank disputes are lost. The bank's first response is a screenshot of a successful OTP entry and a sentence saying the customer shared credentials. The OTP was real. The question is whether it was procured by deception, and whether the bank's own systems did what the RBI requires them to do. Those are answerable questions, and answering them needs records, not indignation.
The first sixty minutes, in strict order
Everything below is designed so that each step creates a record the next step needs. Do them in this sequence even if you are panicking, and write the time next to each one as you finish.
- Stop the session. Disconnect the machine from the internet. If the intruder is still connected, the debits may still be running.
- Call 1930. Give the UPI ID or account number, the amount, the exact time and the reference number of each debit. Ask for the complaint reference and write it down. The helpline can raise a freeze request to the beneficiary bank while the funds are still in the chain.
- Call the bank's fraud line and block the channel. Ask for the card or UPI to be hot-listed, not merely blocked for one transaction. Change the net banking password from a different device.
- Email the nodal officer. Subject line: unauthorised electronic transaction, report within RBI timelines, account number, date. Attach nothing yet except a list; send the evidence bundle within 48 hours with a covering index.
- File on cybercrime.gov.in. The portal complaint is what links the 1930 call to an investigating officer.
- Preserve the device. Do not reset it. Copy the TeamViewer logs, the browser history and the SMS inbox to external media, and photograph the screen if a remote session indicator is still visible.
What the law says about the money
Section 66D of the Information Technology Act, 2000 covers cheating by personation using a computer resource or communication device, which is the correct charge when someone poses as a bank official, a support engineer or a relative. Section 66 covers the unauthorised access itself. Where the intruder obtained your credentials through a phishing page, section 66C applies. The substantive cheating offence is section 318 of the BNS 2023, and where the money was entrusted rather than induced, section 316. Section 308 covers extortion if you were threatened into transferring funds.
On the banking side, the governing instrument is not the IT Act but the Reserve Bank's framework for unauthorised electronic transactions, issued in 2017 and supplemented by the 2019 harmonisation of turn-around times and customer compensation for failed transactions, along with the Master Direction on digital payment security controls. The framework divides liability by fault and by speed of reporting. Where the fraud is not due to the customer's negligence and the customer reports within three working days, the customer's liability is zero. Where reporting is delayed beyond three but within seven working days, liability is capped at a limited amount fixed by the circular. Beyond that, liability is determined under the bank's board-approved policy, and the customer's own conduct becomes the central issue.
| When you reported | Who bears the loss | What the bank will check |
|---|---|---|
| Within 3 working days | Bank, where the customer was not negligent | Whether credentials were shared voluntarily |
| Between 4 and 7 working days | Split, with a cap on customer liability | The transaction trail and the delay explanation |
| Beyond 7 working days | Per the bank's policy | Customer negligence and contributory conduct |
| Any time, bank's system failed | Bank | Whether the bank's controls met RBI directions |
Two procedural rights sit on top of this. First, the bank must give you a written response to a complaint about an unauthorised transaction, with reasons, and must not simply close the ticket. Second, if the response is unsatisfactory or delayed, the Reserve Bank Integrated Ombudsman Scheme, 2021 gives you a free escalation route before any litigation. An ombudsman award is binding on the bank to the extent provided in the scheme, and the process does not stop you from suing for the balance.
If the bank says you authorised the payment
This is the standard defence and it is not unbeatable. Authorisation in law requires a free and informed consent. A person who reads out an OTP because a caller claimed to be from the bank's fraud desk did not consent to a transfer to a mule account. The burden then shifts to what you can prove about the deception: the incoming call number, the call duration, the caller's script, the app that was installed, the SMS header of the OTP, and the gap between the OTP generation and the debit.
Ask the bank, in writing, for four things: the transaction log with the IP address and device identifier, the beneficiary account details as recorded, the audit trail of the OTP delivery, and the name of the officer who decided your complaint. Banks resist producing these, but a written request from a lawyer, or an application before the magistrate or the ombudsman, usually produces them. If the beneficiary account was opened recently, or the same account received several complaints, that pattern supports the argument that the bank's onboarding controls failed.
What the bank's own investigation looks like
Most banks run a two-stage process: a nodal officer verifies that the complaint is genuine and that the timeline is within the RBI framework, then a fraud risk team examines the transaction for customer negligence. The second stage is where cases die, because the file often contains nothing except the transaction record. Sending a chronology, the call detail record, and a short statement of what you were told on the call materially changes that file. Keep the statement factual: what the caller said, what you did, what you saw on screen, and when you realised.
The criminal track, and where the money actually sits
A fraud complaint moves from the cyber crime portal to a police station, then to an investigating officer who writes to the beneficiary bank for the account details and requests a lien on the balance. If funds remain, the account is frozen and the money can be returned during trial on an application for release of property, or at the end of the case. If the funds were layered through several accounts, the trail lengthens and the chance of recovery falls sharply.
This is why the 1930 call is not a formality. The helpline's freeze request reaches the beneficiary bank through the payment network's fraud registry, and a hold placed in the first hours can preserve the balance before withdrawal. Once the money is withdrawn at an ATM or converted through a merchant terminal, the criminal case may still end in conviction, but restitution depends on the convict's assets.
| Stage | Who acts | Realistic timing | What you should do |
|---|---|---|---|
| Freeze request | 1930 cell and beneficiary bank | Hours to 2 days | Give exact reference numbers |
| FIR and investigation | Police station, IO, bank | Days to weeks | Supply the bundle, follow up in writing |
| Charge sheet | IO to magistrate under BNSS s 187 | Months | Track the case number |
| Restitution or release | Magistrate | After charge or trial | File an application with proof of ownership |
| Ombudsman or suit | RBI ombudsman or civil court | Weeks to years | Keep the bank's written rejection |
What decides the outcome
Four variables decide almost every case. The first is the delay between debit and report, which is objective and unforgiving. The second is whether you handed over the OTP, the password or remote access voluntarily; if you did, the case turns on deception and the quality of your records. The third is whether the bank complied with its own security and customer-protection obligations, which is a question of documents the bank holds. The fourth is whether the beneficiary account still has money in it.
Notice what is not on that list: how convincing you are, how much you lost, or how sympathetic the officer feels. A small loss reported in an hour with clean records moves faster than a large loss reported in a month with a story. Build the file accordingly.
Quantum changes the forum as well as the effort. A few thousand rupees is usually resolved inside the bank's grievance system or the ombudsman scheme. A loss running into lakhs justifies a freezing application and a parallel civil suit for recovery against the beneficiary, because the criminal case belongs to the State and any compensation you receive depends on the court's direction under the BNSS. Where the bank's own vendor or employee was involved, the claim may also lie against the bank for breach of the security obligations in the RBI's digital payment directions, which is a separate cause of action from the fraud itself.
Common mistakes after a remote-access debit
- Calling the number the fraudster gave you for the bank's fraud desk. That number belongs to the same group.
- Filing a police complaint but never writing to the bank, or writing to the bank but never filing the portal complaint. Both are needed; each supplies the other's missing proof.
- Accepting a verbal "we will investigate" and closing the ticket. Insist on a written decision with reasons.
- Deleting the TeamViewer app and the SMS thread to clean up the phone. The SMS header, timestamp and reference number are evidence.
- Paying a recovery service that asks for an upfront percentage. No lawful recovery process requires advance payment to a private agent.
- Settling with the bank for a fraction without a written reservation of rights, then discovering the ombudsman route is closed.
When to involve a lawyer
If the amount is small and the bank has accepted liability, you do not need counsel. A lawyer earns the fee when the bank has rejected the claim in writing, when the police have not registered an FIR and you need an application under section 175(3) of the BNSS 2023, when the money is large enough that a freezing application must be argued urgently, or when the bank is blaming you for a data breach you did not cause. The same applies if you are the account holder whose account received the funds and you are now facing a freeze you did not expect.
For the procedural map, start with the cyber crime lawyer in Kolkata page. If a family member has been named as an accused rather than a victim, the criminal defence section is the more relevant route, and a bail application may need to be moved quickly.
Need help with a cyber crime matter?
Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.
Call +91-9007000603 WhatsAppFrequently asked questions
Can money debited after a TeamViewer session be refunded by the bank?
Yes, where the transaction was unauthorised and you reported within three working days without having shared credentials voluntarily. Under the RBI framework the customer's liability is zero in that case. If you handed over an OTP after a deceptive call, the claim turns on proving the deception.
What is the first thing I should do after the debit?
Call 1930 before writing any email. The helpline can raise a freeze request to the beneficiary bank while the funds are still traceable. Then block the payment channel with your bank, email the nodal officer with the reference number, and file on cybercrime.gov.in the same day.
How long does a bank take to decide an unauthorised transaction claim?
The RBI framework requires banks to resolve complaints within a defined turn-around time, generally within ten working days of receiving the complaint, with a written reasoned decision. If the bank fails to respond or rejects the claim, you can escalate to the RBI Integrated Ombudsman under the 2021 scheme.
Is the OTP I shared enough for the bank to deny liability?
Not automatically. The bank still has to show that the payment was authorised in law, and consent obtained by deception is not valid consent. Your call records, the caller's claims and the timing between OTP delivery and debit are the evidence that decides the dispute.
Which sections apply to a TeamViewer banking fraud?
Section 66D of the IT Act, 2000 covers cheating by personation using a computer resource, section 66 covers unauthorised access and section 66C covers identity theft. The substantive offence is section 318 of the BNS 2023, with section 308 where the transfer was obtained by a threat of harm.
Can I get the money back if it has already been withdrawn?
Recovery then depends on the criminal case and on the accused's assets, not on a bank reversal. If the beneficiary account was frozen with a balance still in it, you can apply to the magistrate for release of the property. If the funds were withdrawn in cash, restitution is much harder and slower.
Do I need a lawyer to file the cyber crime complaint?
No. The 1930 call, the portal complaint and the nodal officer email can all be done by you. A lawyer becomes necessary when the bank rejects the claim in writing, when the police refuse to register an FIR, or when a freezing or release application has to be argued before a magistrate.
Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.
Related articles
Cyber crime lawyer in your city · Bank account freeze help · Contact