Bank account frozen by a cyber complaint: the agency drill

You log into net banking on a Tuesday morning and every transaction fails. No warning message that makes sense, no missed call from the bank, just a current account that suddenly won't move money. Forty departures are live. Vendors are calling. And when you finally get the branch manager on the phone, the answer is a version of "there's a lien, it's linked to a cyber complaint, we can't tell you more."

This is a bank account frozen by a cyber complaint, and it is now a routine hazard of running a business that takes UPI and IMPS payments from strangers. Someone, somewhere, was scammed. The money moved through two or three accounts before landing in yours as a genuine payment for a genuine booking. Your bank doesn't get to judge that. It just gets a freeze instruction and acts on it, often against your whole balance, not the rupee amount in question.

This post is the drill: what actually happened to your account, how to find out which police station is behind it, the letters that get it unstuck, and the habits that stop it from happening to you again.

Why a stranger's fraud complaint can freeze money that is legally yours

When someone reports a cyber financial fraud through the National Cybercrime Reporting Portal or the 1930 helpline, the complaint routes into a system that can trigger a hold instruction to every bank the disputed money passed through, including yours, even if your agency is three or four hops downstream from the original victim (National Cyber Crime Reporting Portal, Indian Cybercrime Coordination Centre, I4C, Ministry of Home Affairs). The portal's Citizen Financial Cyber Fraud Reporting and Management System exists precisely to move fast across a chain of bank accounts, because fraud money is usually gone within hours if nobody acts. Your bank doesn't investigate before freezing. It gets told to hold, and it holds.

That is the uncomfortable part for a travel agency. You gave a real service in exchange for that money: you booked a flight, held a hotel, issued a visa appointment. None of that matters to the freeze itself, which is about the money's history, not your side of the transaction. Proving your side is real is what gets it lifted, but that happens after the fact, not before.

Picture your account carrying the working capital for 40 live departures in peak season. One inward credit gets traced back to someone else's NCRP complaint, and the bank locks the account. Every supplier payment you were about to make, unrelated to that one credit, now bounces. That's the real cost: not the disputed amount, but every transaction sitting next to it.

Lien mark vs full freeze: what actually happened to your account

A lien mark holds a specific sum against future debit while otherwise letting the account function; a full debit freeze stops the account from paying out at all, regardless of balance. Cyber-complaint holds in India are typically applied by the bank as one of these two bank-side actions on instruction from the police or the cybercrime portal, not as a formal court order at the outset (National Cyber Crime Reporting Portal, I4C). Which one you have decides how much of your money is actually stuck.

Check your net banking or ask the branch directly which of the two applies: a lien shows as a specific held amount against an otherwise-working account, while a full freeze fails every attempted debit, regardless of amount.

Agents report that banks frequently apply a hold against the entire balance rather than ring-fencing just the traced sum, which is disproportionate when the same account carries unrelated client and operating money too. Treat this as what agents commonly experience, not documented bank policy: confirm with your own branch and a CA rather than assume it, and push for the narrower version in every letter you write.

Careful: Don't wait for the bank to explain the freeze type to you unprompted. Branch staff dealing with a cyber-linked hold are often following an instruction from their own nodal or compliance desk and may not volunteer detail. Ask directly, in writing, which category applies and what the exact held amount is.

Step 1: find the police station and complaint reference behind the freeze

The bank will not proactively tell you which police station or portal complaint triggered your freeze. You have to extract it, in writing, before anything else can move, because every subsequent letter needs a complaint reference number to attach to.

1. Write to the branch manager asking for the freeze reference, the instructing authority (police station, cyber cell, or the NCRP-linked complaint), and the exact amount held. Ask for this in writing, not a phone call, so you have a paper trail.
2. If the branch stalls, escalate the same request to the bank's nodal officer for cyber-fraud or lien-related grievances. Every bank is required to maintain one; the branch can give you the contact, or it's listed on the bank's website.
3. Note the format: an NCRP complaint carries an acknowledgment number tied to the portal, and the police station handling it will have a corresponding FIR or complaint diary number once registered. You need both if you can get them.
4. If the bank still won't disclose the source after a written request and a reasonable follow-up window, an RTI application to the bank (if public sector) or a formal grievance escalation (private sector) is the last resort.

Nothing moves without this reference. The investigating officer's letter, the bank's letter, and the ombudsman escalation if it comes to that all cite this number.

Step 2: the written request to the investigating officer

Once you have the police station and complaint reference, write directly to the investigating officer (IO) with the evidence that your money was received in good faith for a real service. This letter is the one that can produce a no-objection or release communication the bank will actually act on.

The letter should attach:

• The booking ID and passenger name, matched against the name on the payment that triggered the freeze
• The invoice or quotation issued for that booking, showing the amount and the service
• Proof the service was delivered or is scheduled: hotel confirmation, ticket, visa appointment slip
• A clear, dated cover note explaining that the agency received this payment as consideration for a genuine travel booking and had no knowledge of any upstream fraud
• A specific request: either a no-objection letter to the bank releasing the funds, or written confirmation that the agency is not a suspect in the matter

Frame the request narrowly: you're not disputing the underlying fraud complaint, only establishing that your agency is a separate, uninvolved party that provided a real service, and asking for that to be documented.

Careful: The legal basis for the freeze and any eventual release sits under seizure and attachment provisions in the Bharatiya Nagarik Suraksha Sanhita (BNSS), which replaced the CrPC nationwide from 1 July 2024. Courts have distinguished seizure and attachment as separate steps under the new code (case law on BNSS seizure and attachment provisions, Indian Kanoon). Don't quote a section number to the IO or the bank from memory: have a lawyer confirm the exact provision your case falls under before you cite one in writing.

Step 3: the written request to the bank's nodal officer

Where the IO letter establishes your good faith to the investigation, the nodal officer letter escalates the same case inside the bank's own grievance channel and asks for action on the account itself. Send both. They serve different audiences and neither substitutes for the other.

Address this letter to the branch first, then, if there's no movement, to the bank's designated nodal officer for fraud or lien-related grievances. Reference the exact lien or freeze number the branch gave you in Step 1. Attach the same booking evidence you sent the IO, plus a copy of that letter as proof you've engaged the investigation directly. State plainly what you're asking for: either full release once the IO's no-objection comes through, or a partial defreeze of the disputed amount only, with the rest of the balance released immediately.

Keep every communication dated and sent by a traceable channel (email with read receipt, or registered post). This paper trail becomes essential if you need to escalate to the RBI Ombudsman later.

The partial defreeze route: getting everything except the disputed amount released

You don't need the whole freeze lifted to get your business moving again. Only the specific sum the bank has traced to the disputed transaction needs to stay held while the investigation continues; the rest of your balance is unrelated money and there's a documentary case for releasing it now.

Make this argument explicitly, don't wait for the bank to offer it. In your nodal officer letter, lay out the account's transaction history around the disputed credit, showing that the rest of the balance is unconnected bookings and operating funds. Ask the bank in writing to isolate the lien to the specific traced amount and release the remainder.

Example: Say your current account holds ₹18,40,000 against 40 live departures. One inward credit of ₹85,000 gets flagged and the branch freezes the entire balance. A partial-defreeze request, backed by booking-wise transaction evidence for the rest of the balance, is the difference between losing access to ₹18,40,000 and losing access to ₹85,000 while the investigation runs its course.

Banks don't always grant this without pushing back, and practice varies by bank and by branch. Push for it anyway, in every letter, and don't accept a full freeze as the only option without asking the question directly.

When the bank stalls: escalating to the RBI Ombudsman

If the bank doesn't act within a reasonable period after your written complaint, or its response doesn't actually resolve the freeze, you can escalate to the Reserve Bank of India's ombudsman mechanism through the Complaint Management System at cms.rbi.org.in, or the 24x7 helpline at 14448. Under the RBI Integrated Ombudsman Scheme, escalation to the ombudsman generally requires you to have first complained to the bank in writing and either received no response within 30 days, gotten a reply that doesn't resolve the issue, or had the complaint rejected outright (confirm the current wording and timeline on cms.rbi.org.in before you file, as scheme details are periodically updated).

This route addresses the bank's conduct and delay, not the underlying police freeze itself. The ombudsman can push the bank to act faster, communicate clearly, or apply the partial-defreeze logic properly. It cannot overrule an active police investigation. Keep that distinction in your escalation letter: you're asking the RBI to hold your bank to a reasonable service standard, not to rule on the fraud case itself.

The RBI's ombudsman mechanism today is a single unified window (the same Integrated Ombudsman Scheme covers what used to be separate schemes for banking, NBFCs, and digital transactions), so a business account holder, including an MSME travel agency, files through the same portal and contact centre as any other bank customer (RBI Complaint Management System).

Attach the original bank complaint and date, the bank's reply (or proof of no reply after 30 days), your IO letter, and your booking evidence. The stronger your paper trail from Steps 1-3, the faster this moves.

Prevention: the drill that stops this from happening again

You can't stop a stranger's fraud complaint from naming your account in a payment chain. You can control how much of your business that one freeze is able to take down.

• Never collect client money into the same account you use to pay suppliers and staff. A dedicated collections account means a freeze on inward client payments doesn't stop you paying vendors and salaries the same week. This is prudent banking hygiene reported in SME risk-management practice, not an RBI mandate, but it's the single most effective structural fix available.
• Tag every inward credit with a booking reference the day it lands. A spreadsheet row against each UPI/IMPS credit, matching it to a booking ID and passenger name, is the evidence pack a bank or an IO will ask for later. Building it after a freeze is far harder than building it in real time. This is the same habit that pays off in collecting advances through UPI, payment links or a gateway.
• Never accept payment into a personal or savings account for a business booking. Personal accounts have thinner transaction histories and no business paper trail to lean on if a credit is questioned.
• Keep signed quotations and confirmations for every booking, not just the payment. A payment record proves money moved. A quotation plus a confirmation proves what it was for.
• Watch for the upstream version of this risk too. The same payment chains that can freeze your account when someone else is defrauded are the ones criminals exploit directly against agencies, through fake payment screenshots at the counter and increasingly through supplier bank-detail fraud. If your agency has separately sent money to a fraudulent recipient, that's a different playbook: the first 24 hours after you've wired money to a fake supplier covers what to do when your agency is the one that paid out, not the one receiving a disputed credit.

None of this prevents the freeze outright. It shrinks the blast radius from "the whole agency stops" to "one account is stuck while the rest of the business keeps running."

Common questions

How do I unfreeze a bank account after a cyber crime complaint?

Get the police station and complaint reference from the bank in writing, send booking evidence to the investigating officer requesting a no-objection or release confirmation, escalate the same case to the bank's nodal officer asking for a partial defreeze of everything except the disputed amount, and go to the RBI Ombudsman via cms.rbi.org.in or 14448 if the bank doesn't respond within a reasonable period. There's no shortcut past the first step: without the complaint reference, none of the later letters have anything to attach to.

What does it mean when a current account is lien marked?

A lien mark holds a specific sum against future debit while the rest of the account can still function, as opposed to a full debit freeze that stops every transaction. For a travel agency, confirming which one applies decides whether your whole working capital is stuck or just the disputed amount. Ask the branch to state this explicitly in writing rather than assuming from a failed transaction alone.

What is an NCRP 1930 complaint account hold?

It's a freeze instruction that reaches your bank because a fraud victim reported the crime through the National Cybercrime Reporting Portal or the 1930 helpline, and the disputed money's transaction trail passed through your account at some point (cybercrime.gov.in). The hold doesn't mean your agency is suspected of anything; it means the portal's fraud-tracing mechanism flagged an inward credit for investigation, and your bank acted on that instruction before anyone verified your side of the transaction.

Does this only happen to large agencies?

No. Account size has nothing to do with it. Any agency that accepts UPI or IMPS payments directly from clients is downstream of whatever payment chain those clients used before the money reached you, and a small agency's account is exactly as freezable as a large one's. The prevention habits (a separate collections account, booking-tagged credits) matter more, not less, the smaller and more cash-flow-sensitive your operation is.

The short version

• A bank freezes an account on a police/portal instruction tied to someone else's cyber fraud complaint, often for the full balance, not just the traced amount, and the bank will not proactively explain why.
• Find out first whether you have a lien mark (partial hold) or a full debit freeze, and get the exact complaint reference from the branch in writing before doing anything else.
• Write to the investigating officer with booking evidence proving good faith, and separately to the bank's nodal officer requesting a partial defreeze of everything except the disputed sum.
• If the bank doesn't act within a reasonable period after a written complaint, escalate to the RBI Ombudsman at cms.rbi.org.in or 14448.
• Never collect client payments into the same account that pays your suppliers and staff, and tag every inward credit with a booking reference the day it lands.
• Confirm the current BNSS provisions, the ombudsman's exact timelines, and your specific bank's freeze practice with a CA or lawyer before you rely on any of this in a live situation.