If money has just left your bank account because of an online scam, one of the first numbers to call in India is 1930. The Cybercrime Helpline 1930 is designed to get financial cyber fraud reported quickly enough for police, banks and financial intermediaries to try to stop the stolen money from moving further through the financial system.
That distinction matters. Calling 1930 does not automatically reverse a UPI transfer, register an FIR or guarantee that your money will return. It starts an emergency reporting and fund-tracing process linked to the National Cyber Crime Reporting Portal and the Citizen Financial Cyber Fraud Reporting and Management System, or CFCFRMS.
The system has become increasingly important as online financial fraud has grown. The Ministry of Home Affairs said that by June 30, 2026, more than ₹11,158 crore had been “saved” in more than 32.80 lakh complaints through CFCFRMS. Government data also show that more than 65.89 lakh financial-fraud complaints involving over ₹55,050 crore were reported on NCRP between 2021 and 2025.
“Saved”, however, should not be confused with “refunded”. Money placed on hold may still have to go through verification, investigation and the applicable restoration procedure before it reaches a victim.
What is the Cybercrime Helpline 1930?
1930 is India’s national helpline for reporting cyber-enabled financial fraud. It operates within the cybercrime-response framework of the Ministry of Home Affairs’ Indian Cyber Crime Coordination Centre, or I4C.
The underlying CFCFRMS system was introduced in 2021 to enable rapid reporting of financial fraud and to prevent fraudsters from siphoning away stolen funds. The National Cyber Crime Reporting Portal, meanwhile, allows citizens to report cybercrime online.
Under the January 2, 2026 Standard Operating Procedure for NCRP-CFCFRMS, calls to 1930 are handled by the police of the concerned State or Union Territory. When a qualifying cyber-enabled financial crime is reported, transaction information can be entered into CFCFRMS so that action can begin across participating financial institutions.
This makes 1930 particularly relevant when money has actually been transferred, debited or fraudulently taken.
When should you call 1930?
Call 1930 as soon as you discover that you have lost money, or an unauthorised financial transaction has occurred, through a cyber-enabled fraud.
That can include fraud involving UPI, internet banking, cards, wallets, fraudulent investment schemes, fake customer-care representatives, impersonation scams, phishing, fraudulent shopping transactions or so-called digital arrest scams.
Do not wait until you have reconstructed every detail of the fraud.
The objective of immediate reporting is to reach the financial system while some or all of the money may still be traceable. Fraud proceeds can be transferred through several beneficiary or mule accounts, withdrawn, spent or otherwise moved out of the accessible financial system.
If the money is still available somewhere along that transaction trail, the system may be able to place the relevant amount on hold.
What information should you keep ready before calling 1930?
The most useful information is the information that identifies the transaction.
Keep your mobile number, bank or wallet details, UPI ID where relevant, transaction ID or UTR/RRN, transaction date and amount ready. For card-related fraud, the relevant card information may also be required. Preserve screenshots of transaction confirmations, bank messages and other evidence.
Older official NCRP instructions specifically listed the complainant’s mobile number, bank/wallet/merchant information, account or UPI details, transaction ID, transaction date and supporting screenshots among the information needed for financial-fraud reporting.
Also preserve the scammer’s phone numbers, WhatsApp or Telegram details, URLs, email addresses, QR codes, payment requests, chat history and any fake documents sent to you.
Do not delete the conversation simply because it is embarrassing or threatening. Those records may later help investigators reconstruct what happened.
What happens when you call Cybercrime Helpline 1930?
The 2026 NCRP-CFCFRMS SOP gives a clearer picture of the process.
1. Your transaction details are recorded
According to the SOP, the police officer handling the 1930 call records the reported transaction and basic personal information.
Before sending the complaint into CFCFRMS, the officer is required to satisfy himself or herself that the information discloses a cyber-enabled financial crime. The SOP specifically cautions against pushing motivated or unrelated complaints into the financial-fraud system.
2. You receive a 14-digit acknowledgement number
For a complaint initiated through 1930, the 2026 SOP says the complainant receives a 14-digit acknowledgement number starting with “3”, through an SMS carrying the relevant NCRP header.
This number matters. Keep the SMS and acknowledgement number safely.
The message directs the complainant to submit the complete details of the fraud on the National Cyber Crime Reporting Portal using that acknowledgement number.
3. Complete the complaint on the NCRP portal
Do not treat the phone call as the end of the process.
Follow the instructions received through the official NCRP communication and complete the requested fraud information on the “National Cyber Crime Reporting Portal”
Earlier NCRP instructions required callers to complete their portal complaint within 24 hours. The January 2026 SOP now expressly states that the SMS following a 1930 complaint will contain instructions to submit the complete fraud details on NCRP using the acknowledgement number. Because the current SOP wording is the safer authority, victims should follow the deadline and instructions contained in their acknowledgement message rather than postponing the filing.
4. Police can push the complaint into CFCFRMS
Once the reported facts indicate a cyber-enabled financial crime, the complaint can enter CFCFRMS.
This is the part of the system designed to trace the financial trail.
The 2026 SOP provides for notices to concerned banks and financial intermediaries for holding the reported amount while the transaction trail is established. If the money has moved again, subsequent transaction information can be updated so the trail can continue.
5. The beneficiary bank may put the money on hold
Suppose ₹80,000 is fraudulently transferred from your account to Account A.
If the relevant amount remains available when the complaint reaches the beneficiary institution, the bank or financial intermediary may place the reported amount on hold in accordance with the process laid down under the SOP.
If Account A has already sent the money to Accounts B and C, the system is designed to follow that transaction trail. If the proceeds have already exited the financial system, that information is recorded instead.
This explains why speed matters.
But it also explains why no legitimate authority can promise that calling within a particular number of minutes will guarantee recovery.
Does calling 1930 freeze the scammer’s entire bank account?
Not necessarily.
The 2026 SOP is built around proportionality and tracing the reported proceeds. It provides for putting the reported amount on hold and contains separate procedures governing suspension of digital banking services and seizure of accounts or property.
Those actions are legally different.
A “hold” or lien over a specified amount should therefore not automatically be described as the permanent freezing or confiscation of an entire account.
The distinction has become increasingly significant because cyber-fraud proceeds can pass through multiple accounts, sometimes creating disputes involving downstream account holders. The January 2026 SOP includes a dedicated grievance mechanism for issues involving holds, account freezes and lien markings.
Does a 1930 complaint automatically become an FIR?
No.
A cybercrime complaint, a CFCFRMS action and an FIR are not the same thing.
The Ministry of Home Affairs says that cybercrime incidents reported through NCRP, their conversion into FIRs and subsequent investigation, arrests, chargesheets and resolution are handled by the concerned State or Union Territory law-enforcement agencies under applicable law.
The 2026 SOP also contains provisions for FIR or e-FIR registration in circumstances where freezing, suspension of digital banking services or return of reported money is contemplated.
So a 1930 acknowledgement is valuable evidence that the incident was reported, but it should not be represented as an FIR number.
Should you also report the fraud to your bank?
Yes.
Reporting to 1930 should run alongside an immediate complaint to your bank, card issuer, wallet provider or other payment service involved.
Ask the institution to record the fraud or unauthorised transaction and give you a complaint/reference number.
This can be especially important for unauthorised electronic banking transactions.
RBI’s customer-protection framework provides zero liability in specified situations, including certain third-party breaches where neither the bank nor customer is at fault and the customer notifies the bank within three working days of receiving the transaction communication. Different liability rules apply where the customer has been negligent, including by sharing payment credentials.
That banking-liability process is separate from whether police eventually trace and recover money from a fraudster.
RBI’s digital-payment authentication framework has also moved on since older cyber-safety guides were published. Its 2025 Directions, effective for compliance from April 1, 2026, require at least two distinct authentication factors for covered domestic digital-payment transactions, subject to specified exemptions, with at least one factor dynamically created or proven for digital payments other than card-present transactions. The framework does not abolish SMS OTP.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
Can money actually be recovered after a 1930 complaint?
It can, but recovery is not guaranteed.
The first objective of CFCFRMS is to stop reported fraud proceeds from disappearing. Getting money placed on hold and getting that money restored to the victim are separate stages.
This is one of the biggest points missing from simplified explanations of 1930.
The government reported that more than ₹11,158 crore had been saved across more than 32.80 lakh complaints by June 30, 2026. That figure is evidence of funds intercepted through the system, not a promise that every rupee was immediately returned to the original complainants.
What is the Money Restoration Module?
A major change arrived in 2026.
The Ministry of Home Affairs confirmed that the Money Restoration Module (MRM) became functional in April 2026 as part of the new NCRP-CFCFRMS framework. Its purpose is to speed up restoration of defrauded money that has been held or otherwise secured for victims. A separate Grievance Redressal Module addresses disputes concerning frozen accounts and lien-marked amounts.
The420.in has separately explained the current restoration workflow in its guide, “Scammed and Money Frozen? This Government Module Could Help You Recover It”
https://the420.in/cyber-fraud-money-restoration-module-frozen-funds-online-refund-request/
Under the 2026 SOP, several processes can be used for interim custody or restoration depending on the circumstances. For a single victim, the SOP provides a process under Section 106(3) of the Bharatiya Nagarik Suraksha Sanhita for an amount below ₹50,000 that has been put on hold. Amounts above ₹50,000 have additional procedural requirements under the stated process, including connection with an FIR.
The420.in has also covered the ₹50,000 mechanism in “Cyber Fraud Victims Can Recover Up to ₹50,000 Without Court Orders Under New Rules”
https://the420.in/national-crime-reporting-portal-money-restoration-module/
Again, eligibility for a particular restoration route depends on the facts and procedural status of the complaint. A portal request itself does not guarantee payment.
What laws can apply to an online fraud?
There is no single “1930 offence”.
The criminal provisions depend on what the fraudster actually did.
For incidents after the new criminal laws came into force on July 1, 2024, cheating can engage Section 318 of the Bharatiya Nyaya Sanhita, 2023, while Section 319 deals with cheating by personation.
Cyber-enabled impersonation and identity misuse may also attract provisions of the Information Technology Act, 2000. Section 66C addresses identity theft involving fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature, while Section 66D deals with cheating by personation using a communication device or computer resource.
Which provisions belong in an FIR is a matter for the investigating authorities based on the evidence. Victims do not need to correctly identify every penal section before making an emergency 1930 report.
What should you do immediately after discovering cyber fraud?
The practical sequence is simple: stop further access to your money, report the transaction and preserve the evidence.
Call 1930 immediately. Notify your bank or payment provider through its official fraud-reporting channel. Complete the complaint through the official NCRP instructions and preserve the acknowledgement number. Save transaction IDs, UTRs, account details, screenshots, phone numbers, messages, emails and URLs.
If you installed a suspicious remote-access or APK application, or disclosed credentials, secure the affected banking and digital accounts using a clean device and the service provider’s official channels.
Do not send another payment because someone claims it is required to “release”, “verify” or “recover” the first amount.
And never pay a supposed police officer, bank employee or recovery agent who promises guaranteed recovery from a 1930 complaint.
Is 1930 available for all cybercrime complaints?
1930 is specifically central to rapid reporting of cyber-enabled financial fraud. Other forms of cybercrime can be reported through the National Cyber Crime Reporting Portal and the appropriate police authorities. The official NCRP also provides a separate facility for reporting suspicious identifiers such as phone numbers, WhatsApp or Telegram handles, URLs, email addresses and social-media URLs.
Can I call 1930 after several days?
You can still report the fraud. A delayed complaint should not be abandoned simply because time has passed. However, the purpose of the financial-fraud system is rapid intervention, and the possibility of placing money on hold depends in part on where the proceeds are when action reaches the relevant financial institutions.
Does calling 1930 guarantee a refund?
No. 1930 begins a reporting and intervention process. Whether money can be held and ultimately restored depends on the transaction trail, availability of funds, verification, investigation and the applicable legal procedure.
What is the acknowledgement number used for?
It identifies the NCRP complaint and is used for completing and tracking the complaint and, where applicable, accessing later processes connected with the case. Under the 2026 SOP, a complaint initiated through 1930 generates a 14-digit acknowledgement number starting with “3”.
Should I call my bank first or 1930 first?
Do both immediately rather than treating them as alternatives. 1930 connects the incident to the national cyber-financial-fraud response system, while reporting directly to your bank creates the institution’s own fraud record and can affect your rights in cases involving unauthorised electronic transactions.
Can someone else report the cyber fraud for me?
The 2026 SOP provides for an NCRP complainant to be the victim or a person acting on the victim’s behalf. Identity and complaint details still have to be provided and verified through the system.
If money is put on hold, when will I get it back?
There is no universal recovery time. A hold prevents the relevant money from moving further; restoration is a separate process. The applicable route depends on the amount, whether there is a single or multiple victims, FIR status, investigation and other factors under the 2026 SOP.
Where should I go next after filing the complaint?
Keep your NCRP acknowledgement number, bank complaint number and evidence together. Track and complete the complaint through the “National Cyber Crime Reporting Portal” (https://reference-url-citation.invalid/25). Where funds have been put on hold and the case is eligible, follow the current Money Restoration Module process. If the NCRP response is inadequate, the portal also publishes State and UT nodal and grievance officer details for escalation.
The most useful rule is also the simplest: after a financial cyber fraud, report first and reconstruct the full story afterwards. The 1930 system is built around speed because money can move through several accounts far faster than a conventional police complaint can be processed.
About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.
Click Here For The Original Source.
