You wired ₹6 lakh to a fake supplier: the first 24 hours

You get an email, or a WhatsApp message, from a supplier you have worked with for two seasons: "our bank account has changed, please use these details for the balance payment." You wire ₹6,00,000 for a group departure's hotel and vehicle block. This is cyber fraud, and three hours later the real supplier calls asking where the payment is. The account you paid into was never theirs.

This happens to established agencies, not careless ones. What decides whether any of that ₹6 lakh comes back is not how angry you are, it is how fast you move and how much paperwork you generate in the first 24 hours. Recovery runs on a strict sequence: report, document, escalate, and only then, if it comes to that, sue.

This post is that sequence, in order, with the exact fields your bank's nodal officer needs and a recent court ruling on whether your whole operating account gets frozen over one bad transaction, at the worst time if you are funding live departures out of it.

The first 60 minutes: call 1930 before you do anything else

Call the national cyber fraud helpline, 1930, the moment you realise the transfer went to a fraudulent account. It is the fastest way to get an alert flagged with the beneficiary's bank before the money is withdrawn or moved further (I4C, Ministry of Home Affairs). Have the transaction UTR, the beneficiary's account number and IFSC, the amount, and the exact time of transfer ready before you dial. Every minute spent hunting for these details on the call is a minute the fraudster has to move the money out.

Be honest about what this call does and does not do. Cyber police cannot freeze an account themselves; they can only push an alert to the paying and beneficiary banks, who then decide whether to act. The "golden hour" language is trade-press shorthand, not a legal deadline written in any statute (Free Press Journal). Treat it as "report immediately," not as a guarantee.

The line itself is overloaded: 1930 logged close to 3.24 crore calls in calendar 2025, nearly one every second nationally (The New Indian Express). If it is busy, do not keep retrying. Move straight to the portal complaint below; it runs in parallel, not after.

File on cybercrime.gov.in and keep the acknowledgement number

File a complaint on the National Cyber Crime Reporting Portal, cybercrime.gov.in, under the Financial Fraud category, not general cybercrime. The acknowledgement number the portal issues is the single reference every later step, your bank, the police, the RBI Ombudsman, will ask for first (National Cyber Crime Reporting Portal).

Do this the same day as the 1930 call:

1. Select Report Financial Fraud on the homepage, not the general cybercrime path.
2. Enter transaction details exactly as they appear on your bank statement: UTR, amount, date, time, beneficiary account and IFSC.
3. Upload proof: the fraudulent "changed bank details" message, your original correspondence with the real supplier, and your bank's payment confirmation.
4. Save the acknowledgement number the moment it is issued. Screenshot it. You will re-enter it into several more forms over the next month.

If the fraudulent contact came by email, this is the same pattern covered in the "bank details changed" email fraud that drains agencies: a request that looks routine, arrives from a plausible address, and asks you to redirect a payment you were already expecting to make.

Email the bank's nodal officer the same day, with the UTR

Send a written dispute email to your paying bank's nodal officer or fraud desk the same day, even after the 1930 call and the portal filing. The bank's internal fraud team works on its own trigger, and a written record with the UTR is what actually starts that process. A phone call alone rarely counts as a formal dispute.

Every bank publishes a nodal officer contact for this; search "[your bank name] nodal officer fraud complaint" if you don't already have it. The email needs these fields, in order, so the fraud desk can act without a follow-up call:

Subject: Fraud Alert - Request to Lien Disputed Amount - UTR [xxxxxxxxxxxx]

1. Account holder name and account number (your agency's account)
2. Transaction UTR / reference number
3. Date and exact time of transfer
4. Amount transferred
5. Beneficiary account number and IFSC code
6. Beneficiary bank name (if known)
7. NCRP acknowledgement number (from cybercrime.gov.in)
8. Brief description: "Payment made to an account fraudulently
   presented as [supplier name]'s updated bank details via
   [email/WhatsApp] dated [date]"
9. Explicit request: "Please place a lien/hold on the disputed
   amount at the beneficiary end, and confirm the status of this
   hold in writing"
10. Your contact number and an alternate contact for follow-up

Line 9 matters more than it looks. Asking specifically for a lien on the disputed amount, not a general "please help," is what lets you point back to your own written request if the bank later freezes more than the case justifies.

NCRP complaint to FIR: what actually has to happen

A portal complaint and an FIR are not the same thing. Only an FIR gives police the standing to formally investigate and compel the beneficiary bank to hand over account-holder details. In some states the conversion now happens automatically; in most, it still needs a station visit.

A growing number of states have rolled out "e-Zero FIR," where a financial-fraud complaint on NCRP above a state-set threshold auto-registers as an FIR without a visit. Rajasthan set its threshold at ₹1 lakh and above (Free Press Journal); Punjab launched its own mechanism at ₹5 lakh in late July 2026 (The New Indian Express). Thresholds are state-specific, can change, and as of August 2026 there is no national rule, so confirm the current position for your own state.

Where e-Zero FIR is not available, take your acknowledgement number to the local cyber police station and ask for it to be converted into an FIR in person. A real FIR is what allows police to summon the beneficiary bank for account-holder KYC, and a copy of it is what your own bank and, later, the RBI Ombudsman will ask you to produce.

Careful: Have the police describe the offence as cheating or criminal breach of trust and let them cite the correct provision under the Bharatiya Nyaya Sanhita. Do not draft the section number yourself or take one from a template online; get it confirmed by the officer or a lawyer at the time of filing.

Why the whole account gets a lien, and how to get it narrowed

Banks are not supposed to freeze your entire operating account over one disputed transaction. A Rajasthan High Court ruling on 23 August 2026 held that where the disputed amount is identifiable, only that sum should be placed under lien, and the rest of the account must keep operating; a full freeze is meant for exceptional cases, such as a mule account or a named accused with material evidence (LiveLaw). The judgment ties this to a national SOP dated 2 January 2026, describing it as requiring grievance redressal on frozen funds; confirm the issuing authority and full text with your bank or lawyer, since only the court's summary is publicly available.

In practice, banks over-freeze anyway; it is operationally simpler to lock an entire account than to isolate one disputed sum inside it. If that happens while you are meant to be paying vendors for a live departure, write to the nodal officer citing the Rajasthan High Court order by name and date, and ask in writing for the freeze to be narrowed. Keep a copy; it is your evidence trail if you need to escalate. The agency drill for a bank account frozen by a cyber complaint covers this scenario in more depth.

If the bank misses its own timelines: escalating to the RBI Ombudsman

If your bank has not resolved your written complaint within 30 days, or resolves it unsatisfactorily, escalate to the RBI Ombudsman through the Complaint Management System at cms.rbi.org.in, or call RBI's toll-free helpline, 14448 (Reserve Bank of India). The CMS filing needs your account details, complaint category and reference numbers, and issues its own tracking number on submission (Free Press Journal).

Before it reverses or unfreezes anything, expect your bank to ask for the FIR (or the NCRP acknowledgement), your KYC documents, and a written dispute letter matching what you sent the nodal officer. That is why this sequence keeps producing the same document trail: it is the same file the bank, the police and the Ombudsman all end up asking to see.

One honest caveat. RBI's 2017 customer-liability rules, giving zero liability if an unauthorised transaction is reported within three working days, apply to money someone else moved out of your account without your knowledge (Reserve Bank of India). A wire you sent yourself, to an account you were tricked into believing was your supplier's, is different: an authorised but induced payment. That circular's zero-liability protection was not built for this. Your realistic path to recovery depends almost entirely on how fast the beneficiary bank freezes the receiving account before it is withdrawn, not on this rule.

When a criminal complaint is the wrong tool, and a recovery suit is the real one

An FIR pressures the beneficiary bank and puts the fraudster's account under scrutiny, but it does not by itself put ₹6 lakh back in your account once the money has moved on. Criminal proceedings punish the offence; they are not a mechanism to recover your money.

If the trail leads to an identifiable local party, a civil recovery suit, often preceded by a formal demand notice, becomes the more realistic route to funds back. This runs on the same logic as chasing an unpaid sub-agent or supplier through a structured recovery ladder: a documented demand first, escalating pressure, legal action last. The two tracks are not mutually exclusive; keep the FIR alive for the pressure it applies while your lawyer separately assesses a civil claim against a named, findable party.

None of this replaces vetting a new supplier before you wire anything at all. Had the "changed bank details" message arrived before a first payment rather than midway through an existing relationship, a fake-DMC fraud checklist would have caught most of what went wrong here.

Common questions

Why is my bank account frozen for no reason

It is rarely "no reason": most unexplained freezes trace back to a cyber-fraud alert against your account, a KYC mismatch, or a lien request tied to a transaction that passed through it. Ask your branch in writing for the specific reason and the reference number behind the freeze.

Can you sue a bank for freezing your account

You can challenge an unjustified or disproportionate freeze, and courts have recently sided with account holders where a bank froze an entire account instead of only the disputed sum. Start with a written escalation to the nodal officer and the RBI Ombudsman before litigation; most freezes get narrowed or lifted at that stage.

cybercrime.gov.in complaint status

Log back into the portal with the mobile number you used to file, and check status against your acknowledgement number under complaint tracking. Status can lag while it sits with the assigned officer, so a written follow-up to your bank's nodal officer keeps pressure on the case that the status page alone will not.

The short version

• Call 1930 within minutes with the UTR, beneficiary account/IFSC, amount and time ready. It is urgency, not a legal deadline: cyber police cannot freeze funds themselves.
• File on cybercrime.gov.in under Financial Fraud the same day, and save the acknowledgement number. Every later step asks for it first.
• Email the bank's nodal officer the same day with the UTR and an explicit request to lien only the disputed amount, not the whole account.
• Convert the NCRP complaint to an FIR, automatically via e-Zero FIR where your state offers it (thresholds vary and change), or in person at a cyber police station otherwise.
• If your whole account gets frozen anyway, cite the Rajasthan High Court's disputed-amount-only lien ruling in writing when you push back.
• If your bank sits on the complaint past 30 days, escalate to the RBI Ombudsman at cms.rbi.org.in or call 14448.
• An FIR pressures the system; it does not guarantee recovery. Where the trail leads to an identifiable party, a demand notice and civil recovery suit are the actual path to getting the money back.