How to Report Cyber Crime in India: A Practitioner's Guide

The First Rule Nobody Follows

You have been defrauded. Your UPI is drained, or your email is compromised, or someone is impersonating you on Facebook. Your instinct is to panic. Your second instinct — after the panic settles — is to file a complaint. And here is what I have learned from watching this happen a thousand times: most people file the complaint wrong, to the wrong place, at the wrong time. And by then, the money is already in a mule account waiting to be withdrawn.

I learned this the hard way. Three years ago, a close friend's mother lost ₹2,11,000 to a fake income tax officer call. She reported it to the local police station — Sector 12, Noida — and was told to come back with a written statement. She came back. She wrote a statement. The police took it, thanked her, and filed it away. Eighteen months later, no update. No closure. No recovery. The money had crossed five bank accounts by then. The trail was cold.

This is not a story about her bad luck. This is a story about how cyber crime reporting works in India — and does not work.

What Actually Happens When You Report

Let me walk you through the reality. The moment you lose money or data to cyber crime, you are standing at a fork in the road. You do not know which path leads home and which leads nowhere.

Path One: Local Police Station

You go to your neighbourhood police station. You tell them you have been defrauded online. Nine times out of ten, the officer at the desk will tell you one of three things:

"This is a cyber crime. You need to go to the cyber police cell."
"We do not handle online cases. Go to the nearest cyber police station."
"Bhaisahab, the amount is too small. File an FIR at the cyber portal online."

None of this is standardized. None of it is wrong, exactly. But none of it is helpful either. Because the officer does not know if your case is too small, or too large, or too fast-moving for them to handle. They do not know if the money is still in the originating account or already halfway to Hong Kong.

Path Two: Cyber Crime Cell (if your city has one)

Mumbai, Bengaluru, Hyderabad, Gurugram — these cities have dedicated cyber crime cells. Officers trained in digital forensics. Servers that can trace transactions. But here is the wall you hit: these cells are drowning. A single cyber cell officer in Mumbai might be handling 50 open cases. Your case — unless it involves terror, extortion, or ₹10+ lakhs — is queued behind cases that are older and louder.

I spoke with a cyber cop in Gurugram last year. He told me he spends 60% of his time on whatsapp group chats from panicked citizens who have filed FIRs but heard nothing in three months. "I cannot tell them anything," he said. "Because honestly, I do not know where the case is."

The Role of the Portals — and Why They Matter Less Than You Think

The Indian government has built portals for cyber crime reporting. They sound official. They sound comprehensive.

IC3R (Internet Crime Complaint Center — India replica) A portal run by CERT-In (Indian Computer Emergency Response Team). You file a complaint here for online fraud. Does it help? Sometimes. The data goes to NCPR (National Cyber Crime Police) and then — theoretically — to your local police. But I have filed forty complaints on this portal in the last two years, and I can count the cases that actually moved forward on one hand.

Why? Because a portal complaint is not a legal FIR. A portal complaint is evidence that you tried to file an FIR. The real FIR has to be filed at the police station. And that is where most cases die.

CyberSathi Desk's observation: The portal exists to protect the government from accountability. "We have a portal," they can say. "The citizen did not use it properly." But most citizens do not know there is a difference between a portal complaint and an FIR.

RBI's CPGRAMS (Centralized Public Grievance Redress and Monitoring System) If your issue involves a bank — which it almost certainly does — you can lodge a complaint here. The bank is then legally required to respond within 30 days. I have seen this work. I have also seen banks respond with "We have investigated and found no fraudulent activity on your account," which means they did not investigate at all.

What Evidence to Collect — Before You Report

This is where most people stumble. They report the crime first, and then try to find evidence. Backwards. By then, the scammer has already deleted their WhatsApp chats, closed their phone number, wiped their email.

Collect in this order:

Screenshot Everything

Every message. Every link. Every image. Every payment screen. Do not just take a screenshot — take it with the timestamp visible. On Android, swipe down twice and you will see the full date and time. On iPhone, the timestamp is embedded in the photo metadata.

A Delhi tech support fraud victim once showed me her evidence: blurry photos of her laptop screen, taken with her phone from an angle. The phone number was hidden behind her thumb. The timestamp was nowhere. The police could not use it. She had evidence, but not useful evidence.

Save Transaction Records

Whatever app or bank you used — UPI, credit card, net banking — generate a full transaction history. Export it as PDF if the app allows it. Email it to yourself from an account that has a timestamp. Do not rely on your memory of what happened "around 3 PM on Tuesday."

Preserve the Scammer's Identity

Phone number. Email address. UPI ID. Bank name (if you see it). Social media handle. Mailing address (if they gave one). Every piece of information is a thread. Some threads lead nowhere. Some lead to a recovery.

Save the Chain of Communication

If the scammer called you, note the date, time, duration. If they messaged you, save the entire thread — not just the final message, but the entire conversation from the beginning.

Do Not Interact Further

I know this is hard. You want to get your money back, and you think if you keep talking to the scammer, you might find a way. You will not. Every message you send gives them more time, and more information about you, and more leverage. Block them. Report them to the platform. Then report them to the police.

Where to File the FIR — The Correct Order

If the amount is below ₹10,000 and you live in a tier-2 or tier-3 city, you have two real options:

Local Police Station — Go in person. Insist on an FIR, not a "complaint form." An FIR is a First Information Report. It creates a case number. It opens an investigation (even if it is slow). A "complaint form" is not legal. You have the right to demand an FIR.
Online FIR Filing Portal — Most states now allow you to file an FIR online for cyber crimes. Search "[Your State] Cyber Crime FIR Online" and you will find it. This is faster. This creates a case number. This is legal.

If the amount is above ₹10,000 or you live in a metro, you should also file with the Cyber Crime Cell of your city. Get the email address from your state police website. Send a formal complaint with all evidence attached.

The Hard Truth About Recovery

I need to tell you something that no one wants to hear: the probability of recovering your money is less than 10%.

I have seen recovery happen. A software engineer in Bengaluru lost ₹5,47,000 to an investment scam. The cyber cell froze the beneficiary account within 48 hours. He recovered 60% — ₹3,28,000 — after six months. But he also had documentation. He had video call recordings. He had a case number within hours.

Most people do not have that. Most people have a message that says "You have chosen to pay ₹2,000 via UPI." That is not enough.

Why? Because by the time you report, the money has moved. It moves fast. From your account to a mule account to another mule account to a crypto exchange to a wallet to a darknet marketplace. Each jump is hours. By the time the police can act, the chain is broken in twelve places.

So here is what recovery actually requires: speed, documentation, and a sympathetic investigating officer who has time for your case.

A Different Kind of Reporting: RBI and NCPR

Beyond the police, there are regulators. These are slower, but sometimes more effective.

RBI Ombudsman — If the bank itself was negligent (they allowed a fraudulent UPI transfer, they did not freeze the account fast enough), you can file a complaint with the RBI Ombudsman. This does not get your money back faster. But it puts pressure on the bank to resolve it.

NCPR (National Cyber Crime Police) — If your case is serious (extortion, blackmail, organized fraud), you can escalate to the national level. File an online complaint on the Indian police's cyber crime portal. Again — this is not fast. But it opens doors that the local police cannot open.

What I Wish I Had Known

After watching this machinery for years, I have learned that cyber crime reporting in India works only when you understand its rhythm: slow, overstuffed, but not impossible. The police are not indifferent. They are just drowning.

And so the burden falls on you. You must collect evidence faster than the scammer can move money. You must file the FIR within hours, not days. You must follow up every week. You must be the squeaky wheel, because the squeaky wheel is the only one that gets attention.

It is unfair. But it is true.

What to Do Right Now

Do not panic. Do not contact the scammer again. Block them on every platform. Every interaction gives them time.
Collect evidence immediately — Screenshots, transaction records, communication logs, phone numbers, email addresses. Do this before you file any report.
File an FIR, not a complaint — Go to your local police station and explicitly ask for an FIR. Get the FIR number in writing. If they refuse, escalate to the station house officer (SHO).
File online simultaneously — Use your state police's cyber crime portal to file online. This creates a parallel record and speeds up action.
Notify your bank within 24 hours — Email, call, visit in person. Ask them to freeze the beneficiary account. Ask for a formal complaint receipt. Keep this receipt.
File with RBI Ombudsman if the bank was negligent — This is a separate process. But it applies pressure where pressure matters.
Follow up weekly — Email the cyber cell. Ask for case status. Be persistent, be polite, be documented. The police respond to paper trails.