How to Report a Cyber Crime in India: Where to Go, What to Expect

The Call That Changes Everything

Mumbai, 11 p.m. on a Wednesday. Rajesh — a 52-year-old accountant — realized his bank account had ₹2.3 lakhs missing. Not in instalments. All at once. His fingers shook as he dialled the bank's fraud helpline. They told him to file a police complaint. The police station asked him to file an online report with the cyber cell. The cyber cell told him to contact the bank again.

This is not a bug in the system. This is the system.

I have watched this happen to dozens of people. The anger comes first — white, hot, articulate anger. Then confusion sets in, followed by a slow realization: no one is coming to help. Not immediately. Not predictably. And certainly not on your timeline.

The fact is, reporting cyber crime in India requires you to know more than most victims know when they are panicking at midnight. You need to know which police station to approach. You need to know what documents to bring. You need to know that filing a complaint does not mean an investigation is beginning — it means you have joined a queue.

This is what I have learned from working with victims, watching police handle these cases, and pushing for accountability when nothing moves.

Understanding the Reporting Hierarchy

When to File Online vs. In-Person

India has three primary reporting channels. Each serves a different crime, and each has different timelines.

The National Cyber Crime Reporting Portal (cybercrime.gov.in) exists for online offences. Phishing. UPI fraud. Social engineering. Data theft. If the crime happened over the internet and you can describe it in detail without naming a specific police officer, start here. You fill a form. You upload screenshots. Within 72 hours, your complaint is assigned to a police unit in the jurisdiction where the crime originated or where you reported it.

I have seen this work. I have also seen complaints disappear into the system for six months without update.

If the fraud involves physical loss — cash withdrawal at an ATM, sim swap at a mobile store — you need the local police station. Go in person if you can. Do not email. Do not call and hope someone logs it. Walk in during daytime hours (mornings are better), ask for the desk officer, and say: "I need to file an FIR for cyber fraud." They will direct you to the cyber cell if your station has one. If not, they will log it as a general complaint and forward it to cyber specialists in your district.

The Cyber Crime Cell or Cyber Police Station is the specialized unit that investigates these cases. In major cities like Delhi, Mumbai, Bengaluru, Hyderabad, the cyber cells are separate units with trained officers. In smaller cities, there is one designated officer — sometimes a sub-inspector who handles cyber cases alongside theft complaints and traffic violations. Your local police station will route you here.

Why three channels? Because the law was written in layers, and the system was built without talking to itself.

What Happens After You Report

The First 24 Hours

You will not hear from anyone in the first 24 hours. This is normal. It is also infuriating.

What the police should be doing: the moment your complaint is logged, the FIR is filed. The FIR has a number. This number matters — keep it. The cyber cell accesses your complaint, verifies the details, and begins preliminary inquiries with the bank or payment platform involved.

What actually happens: your complaint sits in a folder. The officer assigned to your case is handling 47 other complaints. Your call came in on a Tuesday evening when the station was understaffed. You will not be contacted unless you follow up.

Here is what I tell victims: do not wait for the police to contact you. On day two, call the cyber cell yourself. Ask for the status of your FIR. Use the FIR number if you have it. The officer handling your case may not remember you, but the number will be in the system.

Days 3 to 7: Documentation and Bank Coordination

If your complaint involves a bank or UPI fraud, the police will contact your bank's fraud department directly. This is where things can accelerate or stall, depending on how organized your bank is and how much pressure the police apply.

The bank can freeze accounts tied to the fraud. This takes 24 to 48 hours. If the scammer moved the money quickly (which they usually do), it will have left your bank already, gone through multiple accounts, and possibly converted to cryptocurrency. The freeze may prevent no further loss, but it creates a paper trail that helps investigation.

Here is the critical part: ask your bank for a chargeback or reversal claim. This is separate from the police investigation. The bank has up to 90 days to investigate if you claim fraud. During this time, the money may be recovered — not because the police found the scammer, but because the banking system reverses the transaction. This is rare when UPI is involved (UPI transactions are harder to reverse than card transactions), but it is not impossible.

You will need to provide the bank with:

Your FIR number and copy of the complaint
Screenshots of all suspicious transactions
Screenshots of any communication with the scammer
A detailed timeline of events

Do not assume the bank knows what you know. Write it out. Date it. Send it via email so there is a record.

The Frustrating Middle: Weeks 2 to 6

Nothing happens. You call the cyber cell. They say "investigation is ongoing." You ask what that means. They do not have a clear answer. Is the officer assigned to your case actually investigating, or is he handling admin work? Is he trying to identify the scammer's bank account, or has the trail gone cold?

I have watched this period test people's patience more than the initial fraud itself. The loss of money is sharp and sudden. The silence that follows is a slow erosion of hope.

What you can do during this period:

Contact CERT-In (cert-in.org.in) if the fraud involved a data breach or malware. CERT-In is India's nodal agency for cybersecurity. They will not investigate your personal case, but they will flag patterns.
If investment fraud is involved, file a separate complaint with SEBI (the Securities and Exchange Board of India).
If your SIM was compromised, file a complaint with TRAI (Telecom Regulatory Authority of India).
Document every contact you make with the police. Note the date, time, name of the officer (if given), and what was discussed. This will matter later if your case goes cold.

When the Police Investigation Stalls

After six weeks, many victims ask me: "Is this case being investigated, or am I being ignored?"

You can push back.

File a petition with the DCP (Deputy Commissioner of Police) in your jurisdiction if your local cyber cell is not responding. Write a simple letter. State that you filed a complaint on [date], the FIR number is [number], and you have not received updates in [number of weeks] despite following up twice. Ask for a status update and a timeline for investigation.

Mail this letter to the DCP's office — registered post if possible. Keep a copy. The DCP's office maintains a grievance register. Your letter will be logged, and it creates pressure on the investigating officer to respond.

I have seen this work. Not every time. But often enough to recommend it.

If the scam involved more than ₹10 lakh, you can also approach the Central Bureau of Investigation (CBI). The CBI handles large-scale cyber fraud cases. You cannot file directly with CBI; you petition the police to refer your case to CBI. This is rare and happens only if the police department agrees or if you approach the CBI with significant evidence of a multi-state or international crime.

The Hard Truth About Closure

Most cyber crime cases in India do not result in arrests. I do not have exact statistics — the government does not publish them clearly — but I will tell you what I have seen: of 100 cyber fraud complaints filed in a major city in a year, perhaps 15 result in FIR charges being pressed, and perhaps 3 result in conviction.

Why? Because the scammer is often overseas or using routed accounts across multiple states. Tracking them requires coordination between multiple police departments, banking channels, and possibly Interpol. The police have limited resources. Your case competes with 50 others on the same officer's desk.

The recovery rate is even lower. You are more likely to recover your money from the bank's fraud reversal policy than from the police investigation. And that probability is still less than 30%.

I know this is not what you want to hear. But this is what the ground reality is.

Does this mean you should not report? No. Reporting creates an official record. It prevents the scammer from committing fraud without any trace. It allows CERT-In and RBI to identify patterns and issue warnings. It protects the next person.

But you should report with clear eyes. Know that the police are doing their best with insufficient resources. Know that investigation will be slow. Know that your money is likely gone. And know that your role is not to wait passively — it is to document, follow up, and push when silence stretches too long.

Practical Steps to Report Cyber Crime in India

File online at cybercrime.gov.in within 24 hours of discovering the fraud. Screenshot everything before you do — bank messages, transaction details, scammer communications. These screenshots are evidence; cybercrime.gov.in will accept them as attachments.
Visit your local police station in person if money was withdrawn from an ATM or if SIM swap occurred. Ask specifically for the cyber cell or a cyber-trained officer. Insist on receiving an FIR number in writing before you leave.
Contact your bank's fraud department on the same day. Provide the FIR number once you have it. Request a reversal claim and chargeback if the bank allows it. Follow up in writing via email with all details.
Keep a log of every police interaction. Record the date, time, name of the officer (if given), and what was discussed. Email yourself these notes so there is a timestamp.
Follow up with the cyber cell every 7 days for the first month, then every 2 weeks. A call is sufficient, but email is better — there is a record. Ask specifically: "Has the investigating officer made contact with the scammer's bank? Have they identified the accounts involved?"
If there is no progress after 6 weeks, write a petition to the DCP. Keep it brief and factual. Send it registered post. This escalates your case and creates accountability.
If the fraud involved investment promises or stock schemes, file a parallel complaint with SEBI at sebi.gov.in. If a SIM was compromised, file with TRAI at trai.gov.in. Multiple complaints create pressure and improve chances of action.