All articles
Cyber Law

Reporting online fraud in India: the first 24 hours

Almost everything that determines whether money is recoverable after an online fraud happens in the first day — most of it in the first hour.

6 min read
A laptop screen displaying a security warning in a darkened room

Financial cybercrime is a race against transfer. Money moved out of your account is typically layered through a chain of mule accounts within hours and withdrawn shortly after. Freezing it depends on flagging the transaction before it moves again, which is why the reporting timeline dominates every other consideration.

Report first, investigate later

The common and costly instinct is to spend the first hours trying to understand what happened — re-reading messages, checking whether a call was genuine, waiting to see if a reversal appears. Every one of those hours reduces the chance of recovery. Report immediately and work out the details afterwards.

Do not wait until you understand the fraud to report it. Understanding it is not a prerequisite; speed is.

What to preserve, and how

Digital evidence is fragile and easy to spoil. Screenshot rather than describe. Capture full email headers, not just the visible message. Note exact timestamps. Do not delete the fraudulent messages, and do not reply to them. If a device may be compromised, avoid using it for the reporting itself.

Transaction identifiers — UTR numbers for bank transfers, transaction IDs for UPI or card payments — are what actually let a bank trace and attempt to freeze funds. They are the single most useful thing you can have ready when you call.

Non-financial cybercrime

Not every online offence involves money. Harassment, stalking, impersonation, and the non-consensual sharing of intimate images are all reportable through the same national portal, which provides a dedicated route for reporting crimes against women and children, including anonymously.

For content hosted on a platform, the platform's own takedown process runs in parallel with a police complaint and is often faster. Use both. Preserve evidence of the content before requesting removal, because takedown destroys it.

On jurisdiction

Cybercrime complaints are not confined to the police station nearest the offender, which is usually unknown anyway. You can report from where you are. Do not let uncertainty about the right jurisdiction delay a report — the portal and helpline are designed to route it.

A note on this article. Litior is a legal technology platform, not a law firm, and nothing above is legal advice for your situation. It is general information about how a process commonly works in India. Statutory limits, forums and filing deadlines change, and the right answer for any particular matter depends on its facts — speak to a qualified advocate before acting.

Reading about it only gets you so far.

Every matter turns on its own facts. Describe yours and Litior will point you to advocates who practise in that area, in the right forum, near you.