How to Report Cyber Crime in India: A Ground Reality Guide

The Phone Call Nobody Wants to Make

Mumbai, 2:47 a.m. on a Thursday. Rajesh — a 34-year-old accounts manager — had just realized his Paytm wallet was ₹47,000 lighter than it was ninety minutes ago. Not missing. Drained. He had clicked a link in a WhatsApp message from "ICICI Bank Customer Care." He had typed the OTP. He had lost nearly half a month's discretionary spending in the time it took to make a cup of tea.

What he did next — or rather, what he fumbled through doing next — is what I want to talk about today. Because here is the fact: most Indian cyber crime victims do not report. Not because they are ashamed (though many are). Not because they have given up hope (though many have). They do not report because they do not know where to report, to whom, or what will happen if they do.

I have been watching this pattern for years. A victim calls their bank. The bank says "file an FIR." The victim goes to the police station. The police station says "this is not our jurisdiction — go to cyber cell." The victim finds a cyber cell number at 11 p.m., it rings out, and by Friday morning they have convinced themselves the money is gone and the matter is closed.

It is not closed. The report matters. And there is a path. Let me walk you through it.

Why You Are Not Reporting (And Why You Should)

Before we talk about where, let us talk about why reporting feels impossible.

First: you feel stupid. You clicked a link. You gave an OTP to someone who sounded like they were from the bank. These are failures of judgment that feel personal, permanent, and humiliating. So many victims I have spoken to say the same thing: "I do not want to go to the police and hear them tell me I was an idiot." I understand that feeling. I have felt it. The police station is not a safe place for shame — you will hear worse there, probably from other officers, and you will hear it while you are already fractured.

Second: you have heard — or you believe — that reporting will not help. That Indian police do not have the resources. That cyber crime is too vast. That the money is gone and will stay gone. That the scammer is in Pakistan or Nigeria or somewhere equally unreachable. These beliefs are partly true. But partly true is not entirely true. And partly is sometimes enough.

Third: you do not know where to report. Is it the local police? The cyber cell? The bank? Some national helpline? The confusion is deliberate — not malicious, but structural. India's cyber crime reporting framework is split across multiple agencies with overlapping mandates, and nobody — not the government, not the banks, not the RBI — has made it simple for a victim to understand which door to knock on first.

Let me simplify it. Here is what I know from years of watching this actually happen.

The Three Doors: Where to Report in India

Door One: Your Bank (Immediate, Same Day)

Call or message your bank first. Not the police. Not cyber cell. Your bank.

Why? Because your bank has a fraud helpline. Because they need to freeze or reverse the transaction immediately — and they can only do that if they know about it within a few hours. Because most banks have 24-hour cyber fraud teams now, even if the call quality is terrible and you will wait for 40 minutes.

What to do:

• Find the fraud helpline number on your debit card or your bank's app. Write it down now, while you are reading this, not when you are panicked.
• Call and report the transaction. Say: "I did not authorize this transaction. It was fraud."
• They will ask you to block your card, change your password, and file a dispute claim.
• They will give you a dispute reference number. Write it down. You will need it later.
• The bank will typically reverse the money within 5-7 working days if you file the complaint within 24 hours. If you wait 48 hours, the reversal window closes. This is a hard rule.

Rajesh did this. The ICICI helpline took his call at 3:15 a.m. By 3:22 a.m., his card was blocked. The dispute was filed. Three working days later, ₹47,000 was back in his account. The bank recovered it because the transaction had not yet fully settled — the money was still in transit, technically, in the banking system. If he had waited until morning to sleep on it, the money would have moved. It would have been unretrievable.

Door Two: Cyber Crime Reporting Portal — CERT-In (Within 24 Hours)

India's cyber crime reporting framework has a central portal: the CERT-In portal at cybercrime.gov.in. This is where you report if the bank cannot reverse the transaction.

What CERT-In does:

• Receives your report of fraud, phishing, malware, data theft, or extortion.
• Shares it with the relevant law enforcement agency (police cyber cell, CBI, or others).
• Logs it into a national database that helps law enforcement track patterns and arrest scammers.
• Is technically available 24/7, though the investigation timeline is slow.

What to do:

• Go to cybercrime.gov.in. Click "Report." Or call the national cyber crime helpline: 1930 (toll-free, 24 hours). Yes, 1930 — it is a real number.
• You will need: your bank name, transaction ID, date, amount, the scammer's phone number or email, and the link you clicked (if you remember it).
• The report is anonymous if you choose. You do not have to give your name. But if you give your name and phone number, the cyber cell can contact you for further investigation.
• You will receive a ticket number. Keep it.

A warning: CERT-In is a portal, not a cure. It does not recover your money. It does not arrest anyone in the next week. What it does is create an official, documented report that your city's cyber cell receives and acts on — sometimes immediately, sometimes over months. The ticket proves you reported it. It matters for your own records.

Door Three: Local Police / Cyber Cell (File an FIR if the Amount Is Significant)

If your bank cannot reverse the transaction, and if the amount is above ₹25,000 (roughly speaking — it varies by state), you should file an FIR at your local police station or cyber crime cell.

Why this matters:

• An FIR (First Information Report) is an official criminal complaint. It starts an investigation.
• It is on record. If the scammer is ever caught, and if other victims have also filed FIRs, the case becomes stronger.
• It allows you to file a claim under cyber insurance (if you have it) and claim the loss as a deduction in income tax (for individuals) or as a bad debt (for businesses).

What to do:

• Go to your local police station or cyber crime cell. Ask for the cyber crime officer.
• Bring: your bank statement, the dispute reference number from your bank, screenshots of the message you received, your phone, and any written communication from the scammer.
• File an FIR. You will get a copy. Read it carefully. If it has errors, ask them to correct it immediately.
• The FIR generates an FIR number. This is your proof of reporting. Keep it.
• Do not expect the money back immediately. Expect the investigation to take weeks or months. Expect most cases to go nowhere. This is the hard truth. But if the scammer is part of a ring, and if the ring is raided, the money might be recovered — it happens, though rarely.

Here is what most people do wrong: they go to the police station and file an FIR expecting the money to be returned in two weeks. When it is not, they assume the police are corrupt or incompetent and stop checking. The truth is slower and less dramatic: the police file the FIR, they send it to the cyber cell, the cyber cell adds it to their queue of 200 other cases, and sometimes — sometimes — months later, an arrest is made, and victims are notified.

The Complication: What Happens to Your Report

I need to be direct here. Filing a report does not guarantee recovery. It does not guarantee investigation. It does not guarantee arrest.

Why? Because:

• Most cyber crime is cross-border. A scammer in Pakistan or Nigeria is not easily extradited. CERT-In and the police can report the IP address and the transaction to Interpol, but tracking the scammer is a global effort, and most small-value frauds (under ₹2 lakh) do not warrant that effort.
• Domestic scammers often use SIM cards bought with fake KYC. The SIM is used for 48 hours and then discarded. Tracking it requires coordination between the police and telecom companies. This coordination is slow.
• The police are under-resourced. A cyber cell in Delhi might have 15 officers handling 800 cases a year. Math does not work.

But here is what I have also seen: when five victims from the same scam ring file FIRs on the same day, the police notice. When the amount is ₹10 lakh or more, the CBI gets involved. When the scammer has been operating for years and has hundreds of victims, arrests happen.

Your report is one thread in a tapestry. Alone, it may not be enough. But it adds weight.

A Philosophy Arrives

I realize now, after years of watching this, that most victims do not report because they feel — at the moment of fraud — that reporting is an act of futility. That the system is too broken, the scammer too distant, the loss too small. So they do nothing, and the scammer goes to the next victim. And the next. And the system does not break any further than it already is — it just stays broken.

Reporting does not fix the system. But it documents the break. And documentation is how systems eventually mend.

What to Do Right Now

1. Save your bank's fraud helpline number today. Do not wait. Write it down, screenshot it, email it to yourself. Most banks have it on their app or card. ICICI: 9840039840. SBI: 1800-425-3800. HDFC: 1800-270-3333. Axis: 1860-500-5555. Keep these open in a note.

2. If you have been defrauded, call your bank within the next hour. Not tomorrow. Not after you sleep. The transaction reversal window is 24 hours from the moment of fraud. After that, the money is gone.

3. File a report on cybercrime.gov.in or call 1930. Do this within 24 hours as well. You do not need a lawyer. You do not need permission. You do not need to feel confident. Just report it.

4. If the amount is ₹25,000 or more, file an FIR at your local cyber cell or police station. Bring your bank statement and dispute reference number. Get the FIR number in writing.

5. Keep all documents. Bank statement, dispute reference number, FIR number, CERT-In ticket number, screenshots of the fraudulent message. Store them in a folder. You may need them for insurance claims or tax deductions.

6. Do not send money to recover your money. If someone calls you claiming they can help recover the amount in exchange for a "processing fee", it is another scam. These are called "recovery scams." Hang up.

7. Follow up. After 10 days, call your bank for the status of the dispute. After 15 days, visit the cyber cell and ask for the status of the investigation. Persistence has a small effect. It reminds the system that you are watching.

The system is broken, yes. But it is broken in ways that can sometimes be worked around. Reporting is the first step to working around it.