Trading app scam: legal remedies, FIR and civil recovery

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber law

The legal remedies for a trading app scam in India fall into three tracks that run at the same time: a criminal complaint that investigates and punishes the fraud, a civil or recovery action that tries to bring the money back, and a regulatory route against the bank through which the unauthorised payment moved. None of them is a complete answer on its own. A criminal conviction does not automatically return the money, and a civil decree is worth little if the defendant cannot be found. Choosing correctly, and fast, is what separates a recovered loss from a written-off one.

The strongest position belongs to a victim who does three things in the first week: reports the transaction on 1930 so the destination account can be frozen, gives the bank a written dispute under the Reserve Bank of India framework limiting customer liability, and preserves the digital record so it survives scrutiny under section 63 of the Bharatiya Sakshya Adhiniyam, 2023. The sections that follow set out each track, what it can realistically achieve, and the order in which to use them.

The criminal track: what the FIR charges

The criminal complaint is the anchor of everything else. It is what gives the police power to obtain bank records, ask the destination banks to hold balances, and trace the chain of beneficiaries through know-your-customer data. At the drafting stage, the key sections are these:

• IT Act 2000, section 66D — cheating by personation using a computer resource or communication device, the natural charge for a fake app that impersonates a real broker.
• IT Act 2000, sections 66 and 66C — unauthorised access to a computer resource and identity theft, where credentials are misused or identity documents are fabricated.
• BNS 2023, section 318 — cheating, the general offence of inducing delivery of property by deception, and section 316 — criminal breach of trust where the money was entrusted and then misappropriated rather than merely obtained.
• BNS 2023, section 336 — forgery, covering fabricated account statements and KYC documents, and section 351 — criminal intimidation, which applies where persons posing as recovery or enforcement officials threaten the victim.

The complaint is filed at the cyber crime police station with territorial jurisdiction, or by giving information that must be reduced to writing under BNSS 2023, section 173. Where the police refuse to register, the victim has a remedy: a complaint before the Magistrate under BNSS section 175(3) asking for a direction to investigate. This step is not a formality; refusal at the police station stall is the single most common reason these cases die early.

The civil track: suing to recover the money

A criminal case punishes; it does not usually pay. If the money has been traced to a person or an entity that can be identified, a parallel civil suit for recovery can be filed against them. Two features make the civil route practical in a fraud of this kind. First, once funds are traced to a particular account holder, a suit can claim that money as money had and received, and a court can attach the balance. Second, interim relief is available: an application for attachment before judgment can hold the funds while the case proceeds, so that a defendant cannot dissipate what has been traced.

The limits are real. A suit needs an identifiable defendant with assets in India. A suit also takes time, and the money is usually held by account holders who are themselves either participants or careless. Where the fraud ring operates from abroad, enforcement becomes the central difficulty rather than the legal claim. For larger losses, the civil route is nevertheless worth pursuing, because a decree against a mule account holder is a legally enforceable claim that can follow that person for years.

What each track has to prove

The three remedies are not just different forums; they demand different proof, and understanding the difference prevents wasted effort.

The criminal case

Here the prosecution must show deception, dishonest intention and a loss caused by that deception. Your screenshots, the app details, the payment records and the correspondence with the support desk all go to establishing the inducement. The identity of the accused is the police’s task, traced through the accounts, and your complaint need only describe the conduct and the loss accurately.

The civil suit

A recovery suit focuses on the money, not the intent. It asks the court to find that a specific sum belonging to you is now held by a named defendant without lawful cause, and that it should be returned. Bank statements showing the transfer, the trace report or account details, and evidence that the defendant had no entitlement to the funds are the core. A parallel application for attachment before judgment asks the court to freeze that fund so it is still there when the decree is passed.

The bank claim

The regulatory claim turns on the character of the transaction and the promptness of your report. The bank statement, the portal acknowledgement with its timestamp, and the written dispute are the material. If the bank cannot show that you authorised the debit, the framework pushes the loss onto the institution.

The regulatory route: making the bank pay

Separately from the criminal and civil tracks, the victim can hold the bank accountable for an unauthorised debit. The Reserve Bank of India has issued directions on limiting the liability of customers in unauthorised electronic banking transactions, and the framework works on a simple principle: liability is allocated according to fault and speed. Where the loss arises from a third-party breach and the customer has not been negligent, the customer’s liability can be nil. Where the customer’s own negligence contributed, liability shifts toward the customer. Where the bank’s systems failed, the bank bears the loss.

Practically, this means the complaint to the bank is not a request for a favour but an assertion of a right. The written dispute should state the transaction details, the date of reporting, the acknowledgement number from the cyber portal and an express request for a chargeback under the framework. If the bank refuses, the escalation is to the Principal Nodal Officer and then to the integrated banking ombudsman. A refusal that ignores the framework is a strong ground before the ombudsman.

Remedy, forum and what each one actually delivers

Why a criminal complaint alone rarely returns the money

This is the point most victims do not realise until months have passed. The criminal law is designed to establish guilt and impose punishment, not to restore property. Even where an offender is convicted, restitution depends on the police and the court tracing assets to that person, which is exactly the step that fails when the money has already been layered through multiple accounts. That is why the criminal complaint must be paired with a freeze request made immediately and, where a defendant can be named, with a civil claim.

The two tracks also feed each other. Evidence gathered in the criminal investigation, such as bank statements showing the movement of funds, strengthens the civil suit; the freeze request made at the report stage is what preserves the fund the civil suit can then claim. A victim who files only a criminal complaint often watches the case proceed against an accused who has nothing left to repay.

The order of operations that works

1. Report on 1930 the same day and lodge a complaint on the national cyber crime portal. Note every reference number.
2. Send the bank a written dispute citing the RBI limited liability framework and request a chargeback.
3. Register an FIR under BNSS section 173, or move the Magistrate under section 175(3) if the police decline.
4. Preserve digital evidence and arrange a certificate under BSA section 63 for anything you may need to prove in court.
5. Once a beneficiary account is identified, evaluate a civil suit and an application for attachment before judgment.
6. Escalate to the banking ombudsman if the bank refuses a refund on a claim that is genuinely unauthorised.

What decides the outcome

Four factors dominate. The first is the speed of reporting, because only funds that are frozen can be refunded or decreed. The second is fault: whether the customer entered the OTP or authorised the transfer determines liability under the RBI framework more than any other fact. The third is traceability, which depends on how far the money has been layered and whether the account holders are real people. The fourth is documentation, because both courts and ombudsmen decide on what is on paper. A victim with a dated complaint, a portal acknowledgement and bank correspondence is far ahead of one who made a phone call and nothing else.

Two further considerations quietly shape results. The first is whether the victim’s own conduct looks reasonable in hindsight — a person who ignored repeated warnings, or who pressed on after a withdrawal was refused, is examined more closely. The second is the value involved. Smaller losses are usually resolved by a refund or a freeze, while larger sums make the civil and criminal tracks worth the cost. Lawyers assess these honestly rather than promising a figure; the amount of money that can realistically be traced back is the ceiling on any recovery.

A criminal case can convict the person who took your money without ever returning it. Recovery follows the funds, not the verdict.

When to bring in a lawyer, and why timing matters

Small losses are often resolved by the report and the bank complaint alone. A lawyer adds value when the bank has refused a refund on an unauthorised debit, when the police have declined to register an FIR, when the amount justifies a civil suit or an attachment, or when a person is wrongly drawn into an investigation as an alleged beneficiary. Because the different tracks have different deadlines and different evidentiary standards, coordinating them early matters. Working with an experienced cyber crime lawyer in Kolkata lets the criminal complaint, the bank dispute and any civil claim reinforce each other rather than conflict. If the loss is significant or the institutions have gone silent, it is worth discussing the facts with the office before the paper trail goes cold.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Work from home scam legal remedies and recovery routes
• Mutual fund scam: legal remedies, complaint and recovery
• Loan app harassment: legal remedies and recovery options
• Job Scam Legal Remedies: Criminal Complaint and Recovery
• Investment scam legal remedies: criminal and civil
• Instant loan app fraud: legal remedies and civil recovery

Cyber crime lawyer in your city · Bank account freeze help · Contact