Online financial scams in India: how six frauds work and what to do in the first hour

In 2025, people in India filed 24,02,579 complaints of financial fraud on the National Cyber Crime Reporting Portal and reported ₹22,495 crore lost, according to figures the Ministry of Home Affairs (MHA) gave Parliament in February 2026. In 2021 the portal received 2,62,846 such complaints. The schemes change names often, but most follow a few patterns that the Indian Cyber Crime Coordination Centre (I4C), the Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI) and the National Payments Corporation of India (NPCI) describe in their own warnings.

Most of these frauds do not break into a bank’s systems. They persuade the victim to act: read out an OTP, enter a UPI PIN, approve a payment, install an app or move money to “verify” it. When RBI released its BE(A)WARE booklet in March 2022, it said a root cause analysis of complaints to its Ombudsman offices found that customers sharing confidential information, knowingly or unknowingly, is one of the major causes of financial fraud.

This piece explains six scams that government agencies and regulators warn about, the red flags for each, what to do in the first hour if money has gone, and what RBI’s rules say about who bears the loss, including revised rules and a new compensation scheme for transactions from 1 January 2027. The short version: no Indian agency arrests anyone over a video call, no genuine bank asks for your OTP or PIN, you never need a PIN to receive money, and if money has gone, call 1930 and your bank at once.

The scale of the problem in official numbers

I4C’s National Cyber Crime Reporting Portal (NCRP), at cybercrime.gov.in, takes complaints about all types of cybercrime. Its Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS), launched in 2021, is for immediate reporting of financial frauds so that funds can be stopped before fraudsters siphon them off. The toll-free helpline 1930 helps people lodge these complaints.

MHA notes that the data is dynamic, and these are amounts reported by citizens, not losses confirmed after investigation. In practice, there were more than nine times as many complaints in 2025 as in 2021, and the amount reported jumped in 2024 and stayed near that level in 2025.

Fast reporting is what lets money be stopped. MHA told the Rajya Sabha in July 2026 that more than ₹11,158 crore had been saved through CFCFRMS in more than 32.80 lakh complaints up to 30 June 2026. Frozen money is not returned money, though. For the financial years 2023-24 to 2025-26, MHA reported more than 53,87,905 cyber fraud complaints, more than 1,81,271 FIRs, more than ₹56,087 crore reported, more than ₹9,079 crore marked as lien (held in the accounts that received it) and more than ₹206 crore refunded.

MHA has since issued a standard operating procedure covering lien removal and restoration of defrauded money, and made a Money Restoration Module functional from April 2026. In practice, a victim should not count on recovery alone; prevention, and the bank liability rules explained below, matter at least as much.

Six scams the government warns about

Each pattern below comes from an official advisory, caution or reply to Parliament. The details vary; the core of each scam does not.

1. “Digital arrest”

MHA issued an alert on 14 May 2024 about a large number of complaints of intimidation, blackmail, extortion and “digital arrests” by cyber criminals posing as police, the Central Bureau of Investigation (CBI), the narcotics department, RBI, the Enforcement Directorate (ED) and other agencies. I4C’s advisory TAU/ADV/003 of 6 March 2025 sets out how it works:

• The call. The caller claims to be from the police, CBI, RBI, the telecom department or ED. The numbers are often spoofed.
• The accusation. A courier parcel in the victim’s name holds drugs, fake passports or SIM cards; their Aadhaar or mobile number has been used in a crime; or drug money has reached their account. Sometimes a relative is said to be in custody or in an accident.
• The “custody”. Some victims are made to stay on video calls until the demands are met, before a set made to look like a police station.
• The demand. Money is demanded to “settle” the matter or to avoid exposure in a made-up case.

The advisory states: “There is no concept of Digital Arrest under any Indian Laws.” It adds that real law enforcement will not arrest anyone digitally, and asks people to verify the caller by contacting their nearest police station directly, to speak to relatives and friends before transferring money, and to report at once on 1930 or cybercrime.gov.in. MHA describes these operations as organised online economic crime run by cross-border syndicates.

The government has also gone after the tools. MHA told the Rajya Sabha in March 2025 that I4C had blocked more than 3,962 video-calling IDs and 83,668 messaging accounts used for digital arrests. The Department of Telecommunications (DoT) said in April 2025 that a system commissioned on 17 October 2024 to block incoming international calls that display Indian mobile numbers had cut such calls by almost 97%. The National Crime Records Bureau does not keep separate data on digital arrest scams. In practice, an official-sounding accusation, a video call you are told not to leave and a demand for money make up the scam, whichever agency’s name is used.

2. Fake investment and trading apps, and “VIP” groups

SEBI’s caution of 11 April 2025 (PR No. 22/2025) reports an increase in securities market frauds on social media, messaging platforms and app stores. It lists unregistered advice from entities that falsely claim SEBI registration or show fake SEBI certificates; platforms and chat channels that impersonate registered entities and promise assured or risk-free returns; ads that pull investors into private groups such as “VIP group” or “Institutional Trading group”; and fake apps offering an institutional trading account, discounted IPOs or block trades, or sure-shot IPO allotment.

SEBI’s guide on fake trading app scams traces the stages: a social media hook, trust built by fake “experts” and early tips that work, a fake app showing profits, pressure to invest more, and finally blocked withdrawals with excuses and fees. Its red flags include app links or APK files from outside official app stores, payments to third-party accounts and promises of guaranteed returns.

Two points follow. Anyone dealing with an unregistered entity loses the protections available under SEBI and the exchanges, including the SCORES complaint system. And checking takes minutes: registered intermediaries and authorised trading apps are listed on SEBI’s websites, and from 1 October 2025 registered intermediaries that collect money from investors use validated UPI IDs with the “@valid” handle, shown with a thumbs-up icon in a green triangle and verifiable through SEBI Check (SEBI PR No. 31/2025). For forex trading, RBI keeps an Alert List of unauthorised entities and platforms, and says an entity missing from it should not be assumed to be authorised.

3. Part-time job and task scams

MHA described the task scam in a release of 6 December 2023, after I4C identified more than 100 websites involved in organised investment and task-based part-time job frauds, which the Ministry of Electronics and Information Technology (MeitY) blocked. The steps: targeted “work from home” advertisements, aimed mostly at retired employees, women and unemployed young people; a chat with an “agent” who sets tasks such as liking videos or rating places on maps; a small commission, then requests to invest more to earn more; and, once a larger sum is deposited, the deposits are frozen.

I4C’s advisory of 8 April 2025 describes a “CAPTCHA-filling” variant in which victims pay registration or training fees, are refused payouts and then face demands for taxes or processing charges. Its red flags: upfront payment, unrealistic earnings, delayed or denied withdrawals and heavy emphasis on referrals. RBI’s rule is simple: a genuine company offering a job will never ask for money. MHA suggests checking the receiver’s name in the UPI app; a random individual may mean a mule account.

That links to a second trap, being recruited as a “money mule”. RBI says fraudsters pay people a commission to receive and pass on money, and that when the fraud is reported the mule becomes the target of police investigation for money laundering. MHA warns that transactions with unknown accounts can lead to accounts being blocked and other legal action.

4. KYC update messages and phishing links

RBI repeated its caution against frauds in the name of KYC updation on 2 February 2024. Unsolicited calls, SMS or emails manipulate customers into revealing login details or installing unverified apps through links, usually with false urgency and threats that the account will be frozen, blocked or closed. RBI’s advice: contact the bank directly, using a number from its official website, and never share login details, card information, PINs, passwords, OTPs or copies of KYC documents with unknown people.

The BE(A)WARE booklet adds the related tricks: fake bank websites, calls from people posing as bankers or officials, fake customer care numbers planted in search results, screen-sharing apps and duplicate SIMs. It states that bank officials, RBI and any genuine entity never ask for passwords, card details, CVV or OTP, and that customer care numbers are never in the form of mobile numbers.

5. UPI “collect requests” and QR codes

This trick targets people selling things online. RBI describes fraudsters posing as buyers who send a UPI “request money” and insist that the seller enter the UPI PIN, which sends money to the fraudster. NPCI’s fraud awareness page describes a QR code version in which the “buyer” refunds a small first scan to build trust, then asks for larger ones, calling each debit a “system error”.

One rule defeats all of these: the UPI PIN is entered only to make a payment, never to receive one, and no QR code needs to be scanned to receive money. NPCI has also removed one tool. By a circular of 29 July 2025, it directed banks, payment service providers and UPI apps to ensure that no person-to-person (P2P) collect transaction is initiated, routed or processed on UPI beyond 1 October 2025. The circular deals only with P2P collect requests. In practice, a request from an individual to “approve” a payment should no longer reach you through UPI, but QR codes and links from strangers still can.

6. Loan app scams

RBI’s booklet describes fake advertisements for cheap loans without collateral, followed by demands for “processing fees”, GST or advance EMIs before the fraudster disappears, and apps offering instant loans with “limited period offers”. Its precaution: banks and NBFCs deduct a processing fee from the sanctioned loan and never ask for an advance fee before processing an application.

The RBI (Digital Lending) Directions, 2025 of 8 May 2025 make an illegitimate app easier to spot. The loan must be paid into the borrower’s own bank account; repayments must go directly to the lender without any third-party pool account; fees due to a lending service provider are paid by the lender, not collected from the borrower; and lending apps must not access files and media, contact lists, call logs or telephony functions (paragraphs 9 and 12). Since 1 July 2025 RBI has published a directory of digital lending apps deployed by regulated entities, built from what lenders submit, without further validation. A Ministry of Finance reply of 21 July 2026 says MeitY has blocked 87 illegal loan apps under section 69A of the Information Technology Act, 2000.

Check whether it could be a scam

Pick the situation closest to yours and tick every warning sign that applies. The checker shows which official warning it matches, what the regulator or I4C says, how to verify and what to do now. It cannot confirm that any particular caller, app or person is genuine.

If money has gone: the first hour

RBI’s rules require banks to tell customers that the longer they take to notify the bank, the higher the risk of loss. The first hour is about stopping further debits and flagging the money while it may still be in the system.

1. Call 1930 or file at cybercrime.gov.in. The helpline facilitates prompt reporting and, where possible, freezing of fraudulent transactions (PIB backgrounder, 7 October 2025). On the portal, financial frauds go under “Report Other Cybercrimes”; you receive an acknowledgement number to track the complaint.
2. Report the transaction to your bank on its 24×7 channel. Banks must offer round-the-clock reporting (such as phone banking, SMS, e-mail, IVR, a toll-free helpline and the home branch), let you respond to the transaction alert itself, send an immediate acknowledgement with a complaint number, and act at once to prevent further unauthorised transactions. RBI’s booklet also advises blocking the card and freezing debits in the linked account.
3. Write down both complaint numbers with the date and time of each report. Under RBI’s rules, the time you report can decide your liability.
4. Keep the evidence. The portal’s FAQs list bank statements, receipts, emails, web addresses, chat transcripts, screenshots, videos and images.
5. Secure the phone and number. If your phone has had no network for a long time, ask your operator whether a duplicate SIM has been issued. Suspected fraud calls and messages can be reported through Chakshu on DoT’s Sanchar Saathi portal.
6. Escalate if needed. If the bank does not reply within 30 days, or you are not satisfied with its reply, you can complain free of charge to the RBI Ombudsman at cms.rbi.org.in, within 90 days of that period ending or of the bank’s last reply, whichever is later (RBI FAQs on the Integrated Ombudsman Scheme, 2026).

Who bears the loss: RBI’s liability rules

Whether a bank must make good a fraudulent electronic transaction depends on whose fault it was and how quickly it was reported. RBI’s rules, first issued in 2017, now sit in the RBI (Commercial Banks – Responsible Business Conduct) Directions, 2025. On 24 June 2026 RBI issued Third Amendment Directions that replace them for transactions on or after 1 January 2027, with matching amendments for other types of banks (press release). Under both, the burden of proving customer liability lies on the bank.

Transactions up to 31 December 2026

Liability is zero where the bank contributed through fraud, negligence or deficiency, whether or not the customer reported it, and in a third-party breach (the fault lies with neither bank nor customer but elsewhere in the system) reported within three working days of receiving the bank’s communication. Where the loss is due to the customer’s negligence, such as sharing payment credentials, the customer bears the whole loss until reporting it; the bank bears any loss after that. For a third-party breach reported in four to seven working days, liability for each transaction is the lower of its value and this limit:

After seven working days, liability follows the bank’s Board-approved policy, which it must publish. Working days are counted on the home branch’s schedule, leaving out the day the communication was received. The bank must credit the amount (a “shadow reversal”) within 10 working days of being notified, value-dated to the transaction date, and resolve the complaint within its policy timeline, which cannot exceed 90 days. It may waive liability at its discretion, even where the customer was negligent (paragraphs 66 to 73).

Transactions from 1 January 2027

The revised rules cover “fraudulent” transactions: those carried out by a third party using credentials obtained from the customer by fraudulent means, those the customer approved under coercion or duress from a third party, and unauthorised transactions, including those caused by the bank’s negligence or a third-party breach. A third-party breach includes a deficiency of intermediaries such as third-party application providers, payment aggregators, payment gateways and telecom service providers.

• Bank negligence: zero liability and reversal, reported or not. It includes not sending mandatory alerts, not providing 24×7 reporting channels, not acting diligently on a customer’s notice, and system failures, security breaches or internal frauds.
• Third-party breach: zero liability if reported to the bank within five calendar days of the transaction; after that, the bank’s policy.
• Customer negligence: the customer bears the loss until reporting it, except the part covered by compensation. It includes not taking reasonable care of a PIN, password or OTP, not notifying the bank promptly, ignoring specific, directed and clear warnings from the bank that a transaction is likely a scam, downloading malicious apps, and not updating a changed mobile number or email address.
• Timelines: a response within 45 calendar days for a domestic fraud and 60 for a cross-border one; a shadow reversal within five calendar days for credit cards; reasons for any rejection; and SMS alerts for every transaction above ₹500.

The new compensation for small-value frauds (paragraph 76T) applies where a bona fide victim who is an individual, including a sole proprietor, loses up to ₹50,000 (gross) through customer negligence and reports the fraud both on NCRP or 1930 and to the bank within five calendar days. The victim gets 85% of the net loss (gross loss minus recoveries) or ₹25,000, whichever is less, once in a lifetime, within five calendar days of applying. For a domestic fraud, RBI bears 65% of the net loss and the customer’s bank and the bank that first received the money 10% each; from a net loss of ₹29,412, the ₹25,000 is split ₹19,118, ₹2,941 and ₹2,941. The scheme covers frauds occurring up to one year from 1 January 2027. RBI’s feedback statement adds that the lifetime limit applies across banks, that the ₹50,000 limit applies to the gross loss in a complaint even if it spans several transactions, and that merchant disputes and cheques are outside these rules.

Worked example

Today’s rules. A customer with a regular savings account finds a debit of ₹40,000 on 15 October 2026 that she did not make, and gets the bank’s SMS alert the same day. The bank later finds that neither she nor the bank was at fault, so it is a third-party breach.

• If she reports it within three working days, her liability is nil and the bank must credit ₹40,000 within 10 working days.
• If she reports it on the fifth working day, her liability is the lower of ₹40,000 and the ₹10,000 limit for a savings account: ₹10,000. The bank bears ₹30,000.
• If she reports it after seven working days, the bank’s Board-approved policy decides.

Rules from 2027. In March 2027 a customer reads out an OTP to a caller posing as her bank and loses ₹40,000. She reports it on 1930 and to her bank within three calendar days, and ₹15,000 is recovered before compensation is paid.

• Net loss: ₹40,000 − ₹15,000 = ₹25,000.
• Compensation: the lower of 85% × ₹25,000 = ₹21,250 and ₹25,000, so ₹21,250.
• Who pays: RBI 65% × ₹25,000 = ₹16,250; her bank ₹2,500; the beneficiary bank ₹2,500.
• Her remaining loss: ₹25,000 − ₹21,250 = ₹3,750.

This matches RBI’s own Illustration 1 in the Directions. Had nothing been recovered, she would receive ₹25,000 and bear ₹15,000. Had she lost ₹60,000, no compensation would be payable, because the gross loss would exceed ₹50,000.

Calculate your liability under RBI’s rules

Enter the date and amount of the fraudulent transaction and choose how it happened. For a transaction up to 31 December 2026, add the working days taken to report and the account type; from 1 January 2027, add the calendar days, whether you also reported on 1930 or the portal, and any amount recovered. The bank decides the category on the facts; the calculator shows what the rules provide for each.

Check before you pay or invest

I4C says its suspect database is built from public complaints, is not complete and may contain errors, so a clean result is not proof of safety.

What to do

1. Keep your mobile number and email address up to date with your bank and read every alert. From 2027, not updating a changed number counts as negligence.
2. Never share an OTP, PIN, password or CVV. Banks, RBI and genuine entities do not ask for them.
3. Take customer care numbers only from official websites, never from search results.
4. Install apps only from official app stores, never on a stranger’s instructions, and avoid screen-sharing apps while paying.
5. Remember that scanning a QR code and entering the UPI PIN are for paying, not receiving.
6. Pay no upfront fee for a job, loan or prize, and treat assured returns as a warning.
7. Never let anyone use your account to receive or pass on money.
8. If a caller claims to be from the police or another agency, hang up, check with your police station and talk to your family before moving money.
9. If money goes, call 1930 or file at cybercrime.gov.in and report to your bank at once.

For businesses, the liability rules apply to all bank customers, but the 2027 compensation is limited to individuals, including sole proprietors; companies, LLPs and firms should not count on it. This piece explains the rules in general terms; for a large loss or a disputed bank decision, take advice from a lawyer or your adviser.

What the rules don’t say yet

• Payments made willingly after being deceived. RBI’s March 2026 draft listed a transaction made when a customer “is tricked into willingly sending money to a scammer who is posing as a legitimate recipient”. RBI’s feedback statement says such transactions were moved into the definition of a fraudulent transaction, but the final definition names only credentials obtained by fraud, approval under coercion or duress, and unauthorised transactions. Whether money paid into a fake trading app or a task scam is covered is not clear from the text.
• Payments made under a “digital arrest”. These fit the “coercion or duress” limb, but the Directions do not say which liability category they fall into. The bank classifies each complaint and must prove any customer liability.
• Late reports. Beyond seven working days today, or five calendar days from 2027, liability for a third-party breach depends on each bank’s policy.
• After 2027. When it issued the draft, RBI said the compensation would be reviewed after a year, aiming to increase banks’ share and reduce or eliminate RBI’s. The Directions do not say what follows.
• Wallets and non-bank services. These Directions apply to banks; this piece does not cover non-bank payment companies.
• Refunds of frozen money. The MHA releases cited here give no time limit for returning frozen money to victims.

Frequently asked questions

Can the police or CBI place me under “digital arrest” on a video call?

No. I4C’s advisory says there is no concept of digital arrest under any Indian law and that real law enforcement will not arrest you digitally. End the call, contact your nearest police station directly, and report the call on 1930 or cybercrime.gov.in.

A buyer has sent me a QR code so that I can receive payment. Should I scan it and enter my PIN?

No. RBI and NPCI both say the UPI PIN is entered only to pay and that no QR code needs to be scanned to receive money. If an app asks for your PIN, you are sending money.

I shared an OTP and money was taken. Will my bank refund it?

Under the current rules, a loss caused by sharing credentials falls on you until you report it, although the bank may waive your liability. For frauds from 1 January 2027, if you are an individual, the gross loss is up to ₹50,000 and you report on 1930 or the portal and to your bank within five calendar days, you may receive 85% of the net loss, up to ₹25,000, once in your lifetime.

My money was frozen after my 1930 complaint. When will I get it back?

A lien holds the money; it is not a refund. For 2023-24 to 2025-26, MHA reported more than ₹9,079 crore marked as lien and more than ₹206 crore refunded. Its standard operating procedure covers lien removal and restoration of money to rightful claimants. Complaints are handled by State or Union Territory police, so follow up through the portal and with them.

Someone has offered me a commission to receive money in my account and pass it on. Is that a problem?

Yes. RBI warns that such “money mules” become the target of police investigation for money laundering, and MHA warns that transactions with unknown accounts can lead to accounts being blocked and other legal action. Refuse, and report the offer on cybercrime.gov.in.