Vishing call fraud legal remedies: FIR, bank and court

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law

A vishing call is a fraud call in which someone impersonates a bank, police or telecom official and takes your card details or OTP. Your remedies are three and they run at the same time: a police complaint, a bank liability claim under RBI directions, and a civil suit for recovery where the money has moved on.

A vishing call is a voice call in which a fraudster impersonates a bank officer, a police officer, a telecom executive or a courier employee and extracts your card number, CVV, UPI PIN, net-banking password or a one-time password. The conduct is cheating by personation using a computer resource under Section 66D of the Information Technology Act, 2000, and it is equally cheating under Section 318 of the Bharatiya Nyaya Sanhita, 2023. Your legal remedies are three, and they run in parallel rather than one after another: a criminal complaint, a liability claim against your own bank under the Reserve Bank of India's directions on unauthorised electronic transactions, and a civil suit for recovery where the money has already left the banking chain.

These routes are not alternatives to each other. The criminal complaint is what freezes money still lying in a mule account. The bank claim is what restores your own account under the limited-liability rules. The civil claim preserves a recoverable debt against whoever remains traceable. Because the evidence for all three is the same bundle of call records, messages and bank entries, pursuing them together costs little more than pursuing one of them properly.

How a vishing call actually runs

The call usually arrives from a number that looks like a bank helpline, an IVR that plays a recorded greeting, and then a human agent who already knows your name, your last four card digits or your branch. That partial data is usually sourced from a data leak, which is why the caller sounds credible. The script then builds urgency: a blocked account, a failed KYC, a suspicious transaction, a parcel held at customs, or a fake police case. The demand at the end is always one of four things: your full card number with expiry and CVV, your UPI PIN, a remote-access application installed on your phone, or an OTP read aloud.

Some red flags are worth memorising:

No bank, police station or telecom operator ever asks for a PIN, CVV, password or OTP on a call.
Spoofed caller ID can display any number, including a genuine helpline printed on your card.
A demand to install a screen-sharing or remote-access app is a fraud in itself.
A threat of immediate arrest over the phone is not how Indian criminal procedure works.
A request to keep the call secret from family or branch staff is a control tactic.

Vishing is now delivered through automated systems as often as through live callers. A recorded message or a synthetic voice can play the same script to hundreds of numbers at once, and only the few who respond are handed over to a human operator. The same technology allows a fraudster to display a number that belongs to someone else, which is why the number on your screen is never proof that the call is genuine.

Legally, the moment you are induced by a false representation to part with a credential, the transaction is not authorised by you in any meaningful sense. The bank's defence is often that the customer shared the OTP and therefore authorised the debit. The answer is that deception induced that act, and deception is precisely what Sections 66D and 318 cover.

What the law says

The Information Technology Act, 2000 provides the cyber-specific offences. Section 66 covers computer-related offences generally, Section 66C covers identity theft by dishonest use of another's electronic signature, password or unique identification feature, and Section 66D covers cheating by personation using a computer resource or communication device. Where a fake document or a forged bank page is used to induce payment, the forgery provisions of the Bharatiya Nyaya Sanhita, 2023 apply, principally Section 336 for forgery and Section 338 for a forged document. Cheating is Section 318, cheating by personation is Section 319, criminal breach of trust is Section 316, and criminal intimidation is Section 351.

On procedure, the Bharatiya Nagarik Suraksha Sanhita, 2023 governs. Section 173 provides for the registration of an FIR in a cognizable case, including its electronic form, and it permits a zero FIR so that a victim is not turned away for lack of territorial jurisdiction. Section 175(3) allows a Magistrate to direct an investigation where the police decline. Section 35 requires a notice of appearance before arrest in offences punishable with less than seven years. Section 482 preserves the inherent powers of the High Court. Electronic evidence, including call detail records, screenshots and bank statements, is admissible under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023.

The banking side is governed by the Reserve Bank of India's directions on limiting customer liability in unauthorised electronic banking transactions. In substance, they place the loss on the bank where the fraud arose from a deficiency in the bank's systems, and they limit the customer's liability where the customer reports promptly. Reporting quickly, in writing, is what converts a disputed debit into a bank liability claim.

The criminal route, step by step

Call the national cyber-fraud helpline 1930 at once and record the acknowledgement number the operator gives you. This single call is what triggers a request to the beneficiary bank to freeze the receiving account.
File a complaint on cybercrime.gov.in. The portal generates a complaint number that can be quoted to the bank, to the police and to the court.
Write to your bank's nodal officer for cyber and electronic-banking frauds, by email and by a written letter to the branch, attaching the transaction reference numbers.
File a physical FIR at the police station with jurisdiction over the account or the device used, or at a cyber cell. Carry the complaint numbers from steps one and two. If the station refuses, that refusal is itself a matter you can put in writing for the Superintendent of Police.
Preserve the evidence before it rotates out of your phone: full screenshots including the header showing the number and timestamp, the outgoing call log, any SMS or WhatsApp messages, and the bank statement entries.
If the police delay registration, move the Magistrate under Section 175(3) of the BNSS for a direction to investigate.
Follow the money. The investigation branch traces the first, second and third beneficiary accounts; the earlier the complaint, the more of the trail survives.

Where the money goes and why the first day matters

Once you share an OTP or approve a collect request, the money does not stay put. It is usually moved within minutes into a first-layer mule account, then split across a second layer of accounts held by people recruited with small commissions, and often converted into cryptocurrency or withdrawn in cash. A freeze can catch the first layer only if the request reaches the beneficiary bank while the balance is still sitting there. This is why the helpline call and the bank nodal-officer email must go out the same day. After a week, the trail may still exist on paper, but not in the account.

The bank route and the money

The bank claim and the police complaint support each other. The bank cannot verify a fraud claim without a complaint reference, and the police cannot freeze a third account without the bank's transaction trail. Where your own bank was defrauded into releasing money because of a weakness in its systems, the RBI directions point to zero liability for the customer. Where the loss was caused by the customer's own negligence in sharing a credential, liability is apportioned, and prompt reporting operates in the customer's favour.

Route	Forum	What it delivers
Criminal complaint	Police station, cyber cell, 1930, cybercrime.gov.in	Freeze of mule accounts, investigation, prosecution
Bank liability claim	Branch, nodal officer, then the banking ombudsman	Reversal or credit of the unauthorised debit
Civil recovery suit	Civil court or High Court	A decree for the sum, costs, and tracing of assets
Magistrate direction	Jurisdictional Magistrate under BNSS Section 175(3)	Compels a police investigation where none starts

The civil recovery route

A criminal conviction does not by itself return your money. Where the mule account holders and the mastermind are identified, a civil suit for recovery, and where a written promise or instrument exists, a suit on the instrument or a complaint under Section 138 of the Negotiable Instruments Act, 1881, may be available. Where the persons are unknown, a suit against the unknown defendants describing the accounts can be filed and, once the police identify the holders, the plaint is amended. Civil and criminal proceedings on the same facts are generally permissible, because the standards of proof differ.

Where an accused is identified and assets are traceable, interim relief against the transfer of those assets can be sought along with the suit, so that a decree is not later rendered hollow. Attachment in the criminal proceedings and a civil injunction can both be pursued at the same time.

What decides the outcome

Three factors carry the most weight. The first is speed of complaint, because a freeze is only useful while the money is still in a downstream account. The second is the quality of your own evidence: the call log with the number and duration, the recording if you have one, the messages, and the bank statement. The third is the character of the debit: whether it was a card-not-present transaction with a 3-D Secure failure, a UPI collect request you were tricked into authorising, or a plain transfer you yourself keyed in. Courts and banks read these differently, and the weaker your transaction trail, the more the outcome turns on the strength of your prompt reporting.

A court also weighs whether the victim was careless. If you read out a PIN to a caller claiming to be from your bank, the bank will argue negligence. If the debit happened through a cloned card or a technical failure the bank could have prevented, the bank will be told to absorb the loss. Whichever it is, the documents you filed on day one are the record a court will look at, so a short and clear complaint beats a long and emotional one.

Common mistakes

Waiting days to report, which pushes the loss onto the customer under the liability rules.
Reporting only to the bank and never filing a police complaint, which leaves no criminal reference.
Deleting the fraudulent messages out of embarrassment before taking screenshots.
Approaching a recovery agent who promises to retrieve the amount for an advance fee; this is a second fraud on the same victim.
Assuming a civil suit is unnecessary once an FIR exists, and losing the limitation period.
Not noting the acknowledgement numbers, which makes every later escalation harder to prove.

When to involve a lawyer

You can file the first three steps yourself. A lawyer becomes useful when the police delay registration, when the bank rejects the liability claim, when a notice of appearance is issued to you as an accused, or when the money must be recovered by suit. A cyber crime lawyer in Kolkata can prepare the Section 175(3) application, the bank representation and the plaint as one consistent set of documents, and can appear before the Magistrate or the Calcutta High Court as required. If you are on the other side of the complaint, see our note on criminal defence and on bail applications.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What is the first thing I should do after a vishing call fraud?

Call the national cyber-fraud helpline 1930 immediately and note the acknowledgement number. That call is what triggers a request to freeze the receiving bank account. Then file a complaint on cybercrime.gov.in for a second reference number, and write to your bank's nodal officer. Speed matters more than anything else, because money is only recoverable while it sits in downstream accounts.

Is a vishing call an offence under Indian law?

Yes. Impersonating someone to obtain credentials over a call is cheating by personation using a computer resource under Section 66D of the Information Technology Act, 2000. The same conduct is cheating under Section 318 of the Bharatiya Nyaya Sanhita, 2023, and cheating by personation under Section 319. Where fake documents or bank pages are used, the forgery provisions also apply.

Can my bank refuse to refund money taken in a vishing call?

The bank can refuse if it can show the loss arose from your negligence in sharing a credential, because the Reserve Bank of India's directions apportion liability in that situation. However, prompt written reporting operates in your favour and narrows your liability. Where the loss resulted from a deficiency in the bank's own systems, the same directions point to zero customer liability.

What evidence should I preserve after a vishing fraud call?

Screenshot the call log showing the number, date and duration, and any messages in full with the header visible. Keep the fraudulent SMS or WhatsApp thread, the bank statement showing the debit, and any recording of the call. Do not delete the thread. Electronic records are admissible under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, provided the original device and records are preserved.

What can I do if the police refuse to register my complaint?

Ask for the refusal in writing and send a written complaint to the Superintendent of Police concerned. If no investigation begins, you can apply to the jurisdictional Magistrate under Section 175(3) of the Bharatiya Nagarik Suraksha Sanhita, 2023, for a direction to investigate. In an urgent matter involving a freeze, the application can be moved quickly with the bank transaction trail attached.

Can I recover the money through a civil suit as well as a criminal case?

Yes, a civil suit for recovery can run alongside the criminal case, and the two are not barred by each other because the standards of proof differ. A criminal case aims at conviction, not at returning your money. Where the account holders become known, they can be sued for the sum with interest and costs. Mind the limitation period for the suit.

How quickly must I report a vishing fraud to limit my liability?

Report as soon as you discover the debit, without waiting for the bank to investigate. Under the Reserve Bank of India's directions, the longer a customer delays reporting an unauthorised electronic transaction, the larger the share of the loss the customer may bear. A same-day report by phone, portal and written notice gives the strongest possible position when liability is decided.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact