AI voice cloning scam: legal remedies and recovery routes

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law

A cloned-voice fraud is not one legal problem; it is three. There is a crime to report, a debt to recover from the people who took the money, and a dispute with your own bank over who bears the loss. Each has its own forum, its own pace and its own standard of proof. Victims who understand this early recover more, because the criminal complaint preserves evidence, the civil claim preserves the right to the money, and the banking complaint preserves your leverage over the institution that can actually return the funds.

What this page does is map the three routes against each other — what each one asks for, what it can realistically deliver, and how they reinforce one another. It avoids promising outcomes, because recovery depends on facts no reader can see yet, and it avoids the trap of telling every victim to run all three. In many cases only two are worth the cost, and in some only one is.

The criminal route: cheating, impersonation and the IT Act

The criminal route exists to establish that a crime occurred and to identify and punish those who committed it. A caller who imitates a trusted voice and induces a transfer commits cheating under section 318 of the Bharatiya Nyaya Sanhita, 2023. Where the imitation is deliberate impersonation of a named person, the same Code's provision on cheating by personation is engaged. Where a threat or a coercive demand accompanies the cloned voice, section 351 of the BNS on criminal intimidation is added, and where forged documents or electronic records are used, section 336 on forgery becomes relevant.

The technical conduct sits in the Information Technology Act, 2000: using a computer resource to generate and deliver cloned audio, and using another person's electronic identity, engage the Act's provisions on computer-related offences and on identity, including sections 66C and 66D. This matters practically because the IT Act provisions are what allow the investigating agency to trace device, IP and account data rather than only the human caller.

The complaint itself is an FIR under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, and for a cyber offence it may be filed electronically under section 175(3) of the BNSS, 2023. Where the police decline to act, that same provision allows the aggrieved person to approach the magistrate. Electronic material — recordings, chats, statements — is proved under section 63 of the Bharatiya Sakshya Adhiniyam, 2023.

The civil route: pursuing the money itself

The criminal route punishes; it does not, by itself, put money back in your account. A civil claim does. Where the beneficiary of the fraudulent transfer can be identified, a suit for recovery of the amount lies against the recipient, on the footing that money paid under a deception was never lawfully received and cannot be retained. Where the recipient is a mule account holder who knowingly allowed the account to be used, the claim is stronger still, because the recipient participated in or facilitated the fraud rather than merely holding funds.

The civil route has real limits. It needs an identifiable defendant, it moves slowly, and it costs money to run, so it rarely makes sense for small sums. It becomes attractive where the amount is large enough to justify the expense and where the recipient is traceable — often after the police have obtained the beneficiary details. A criminal court can also order restitution or compensation in appropriate cases, but a civil claim is the cleaner route to a judgment for a specific sum.

Timing decides whether the civil route has any value at all. A suit filed against an unnamed "unknown person" is not a claim, it is a placeholder, and it will stall. The workable sequence is to let the criminal investigation produce the beneficiary name and account details, then move. That waiting period is not wasted time, because the same records also tell you whether the recipient was a knowing participant or an ordinary account holder whose details were misused — a distinction that changes both the strength of the claim and whether it is worth filing.

Where the loss is modest and the recipient turns out to be an innocent party, the honest advice is often to skip the suit and press the banking route instead. A civil claim that costs more than it can recover helps nobody except the lawyers on the other side.

The banking route: the RBI framework on unauthorised transactions

For many victims this is the only route that actually returns money, and it is the one most often neglected. The Reserve Bank of India's directions on customer protection and limited liability for unauthorised electronic transactions require the bank to investigate a reported unauthorised transaction and to fix liability within the framework those directions set. The customer's share of the loss turns on whether the loss resulted from the customer's own negligence and on how promptly the bank was informed.

The banking route has its own rules of evidence, and they favour the person who wrote rather than the person who phoned. A dated written notice stating that the debit was unauthorised, sent to the branch and to the nodal officer with an acknowledgement retained, is what starts the clock. A telephone call to customer care usually cannot be produced later. Where the bank refuses or drags its feet, escalation to the banking ombudsman is the next formal step.

Escalation matters because the framework is only as strong as its enforcement. If the bank's grievance officer does not resolve the complaint, the banking ombudsman is the next formal forum, and a complaint there is judged on the written record you have built. Banks respond to an ombudsman complaint differently from a customer call, which is why the paper trail from day one is not bureaucracy but the core of the remedy. A complaint that arrives with a dated chronology, an acknowledged notice and the transaction statement is treated very differently from a bare assertion that money was taken.

Which route fits which situation

How the three routes reinforce each other

These routes are not competitors; they feed one another. The FIR gives you a lawful basis to ask the bank and the beneficiary bank for records. The bank's investigation produces the beneficiary details your civil claim needs as a defendant. The written notice to the bank, acknowledged and dated, becomes proof of diligence that a civil court or an ombudsman weighs when it decides whether you behaved reasonably.

The sequencing that usually works is this: report on 1930 and notify the bank in writing on day one, so the money trail is caught while it is warm; file the FIR within the first few days, so the tracing powers of the investigating agency are engaged; then decide, once the beneficiary is known, whether a civil claim is worth the cost. Attempting the civil claim first, before anyone knows who received the money, is almost always premature.

The evidence all three routes depend on

All three routes draw on the same small packet of material, and gathering it once, properly, saves weeks later. The core items are the original call recording with the caller's number and the exact time; the bank alert and the full transaction statement showing the debit and the beneficiary reference; the written notice to the bank with its acknowledgement; the 1930 acknowledgement and the acknowledgement from cybercrime.gov.in; and a single dated chronology of events. Where the cloned voice imitated a known person, a short statement from that person confirming he did not make the call can be decisive.

Two habits protect this packet. Do not edit or re-record any original, because an electronic record is proved under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, and a copy made by playing a recording aloud is worth far less than the file itself. And keep everything in one place, physical or digital, because police, bank and court will each ask for the same set, sometimes months apart.

What decides the outcome

• Whether you authorised the debit. A payment you were tricked into making and a debit you never authorised are treated differently, and the bank will ask which this was.
• How fast you reported. The limited-liability framework weighs promptness heavily, and funds already layered are far harder to retrieve.
• Whether the recipient is identifiable. Recovery against a real, named account is possible; recovery against an emptied mule layer is not.
• The quality of the recording. The original call, with its timestamp and caller number, is the anchor of both the criminal and the civil case.
• Whether you can show diligence. Written notices, acknowledged, and a single dated chronology do more for a victim than a dozen telephone calls.
• The size of the loss. Small losses rarely justify a civil suit; large losses often make it worth the expense.
• Whether the imitated person confirms the call was fake. A short statement from the person whose voice was cloned is strong corroboration and is easy to obtain early.
• Whether other victims share the same caller number. Overlapping complaints strengthen tracing, though a victim should never delay a report to wait for others.

The law on fully synthetic, non-consensual voice imitation is still developing, and a court will look closely at the facts rather than at the label. Any assessment of which route to run must begin with the actual timeline — what was said, when, and what the bank was told.

Errors that weaken a legal remedy

• Filing only a police complaint and never notifying the bank in writing, then discovering the refund window has closed.
• Assuming the criminal case will return the money automatically. It usually does not.
• Filing a civil suit before the beneficiary is known, naming the wrong defendant, and losing on that ground alone.
• Editing or re-recording the voice call, which destroys its value as an original electronic record.
• Treating a call-centre assurance as a complaint, then having nothing in writing to prove it.
• Paying an advance "recovery agent" who promises to get the money back outside any legal route.

When a lawyer changes the picture

Legal help earns its cost at three moments: when the bank has refused a refund and needs a written liability argument, when the beneficiary has been identified and a civil claim becomes viable, and when the police have declined to register a complaint and a magistrate must be approached. If your matter is at any of those points, a cyber crime lawyer in Kolkata can review the record and advise which route to run, and for cases likely to end in a contested hearing it is worth understanding the criminal defence position early. For a first read of your documents you can simply contact the office; there is no obligation and no fee for that initial assessment.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Work from home scam legal remedies and recovery routes
• Trading app scam: legal remedies, FIR and civil recovery
• Electricity Bill Scam Legal Remedies and Civil Recovery
• Mutual fund scam: legal remedies, complaint and recovery
• Job Scam Legal Remedies: Criminal Complaint and Recovery
• Investment scam legal remedies: criminal and civil

Cyber crime lawyer in your city · Bank account freeze help · Contact