Deepfake fraud how to recover money in India step by step

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber crime

Deepfake fraud uses a synthetic video or cloned voice to make you believe you are speaking to someone you trust, and then asks for money. Recovery depends on reporting within hours, claiming against your bank under the RBI directions, and preserving the original file before the sender deletes it.

Deepfake fraud is a payment fraud in which a synthetic video, a morphed image or a cloned voice is used to impersonate someone the victim trusts: a relative, a company director, a bank official, a police officer or a public figure. The victim is induced to transfer money, share an OTP or approve a payment because the person on the screen appears to be real. Legally this is cheating under Section 318 of the Bharatiya Nyaya Sanhita, 2023 and, where a person is impersonated, cheating by personation under Section 319. The use of a computer resource to commit the impersonation also brings in Section 66D of the Information Technology Act, 2000.

Recovery follows the same three tracks as any other electronic payment fraud, but the evidence problem is different. In an ordinary vishing or smishing case the victim still holds the message or the call log. In a deepfake case the fraudulent artefact is often a video sent on a messaging app that deletes itself, or a live call that leaves no recording. Preserving that artefact, or proving it existed, becomes the centre of the case.

What counts as deepfake fraud

The technology is not the offence. What makes it a fraud is the lie and the money that follows. The recurring patterns in Indian complaints are these:

A short video call showing a relative or friend in distress, asking for an urgent transfer for a medical bill or an accident.
A video conference in which a company director appears to instruct an employee to move funds, sometimes with several synthetic participants on the call.
A morphed or fabricated intimate video sent to the victim with a demand for payment to prevent its circulation.
A fake endorsement video of a well-known investor or actor, used to draw people into an investment group.
A synthetic voice note on a messaging app, in the exact tone of a family member, asking for money to be sent to a new account.

The common thread is that the request for money comes with an emotional or hierarchical pressure that discourages verification. The victim is not careless in the ordinary sense; the victim is responding to what appears to be a person they know, in a medium they have learned to trust.

How the fake is made, in plain terms

Modern tools take a handful of photographs, a short audio sample or a few seconds of video and generate new footage of the same face speaking words the person never said. A voice can be cloned from a greeting on a voicemail, a social media video or a customer-service call. The output is convincing in a short, low-resolution call, which is precisely why the fraud works on a phone screen and often fails when examined frame by frame.

This matters for evidence. The artefact itself can be examined for inconsistencies in lip movement, lighting, hair edges and blink patterns, and the metadata may show the application used. But once the message has been deleted or the call has ended without a recording, that analysis is lost. The victim's own account of what was said, supported by the transaction record, then becomes the only bridge between the fraud and the money.

Verification habits matter more than suspicion. A family member asking for money after a video call should be reached on the number already saved in your phone, not the number that called. An employer instructing a transfer on a video conference should be confirmed through a second channel that the fraudster does not control. These steps feel excessive at the moment and obvious afterwards, which is exactly why fraudsters build urgency into the script.

The law that applies

Under the Information Technology Act, 2000, Section 66 covers computer-related offences, Section 66C covers identity theft where another person's electronic signature, password or unique identification feature is dishonestly used, and Section 66D covers cheating by personation using a computer resource. Section 66E covers violation of privacy where an image of a private area is captured or transmitted without consent. Where the fabricated material is obscene or sexually explicit, Section 67 applies; where it involves a child, POCSO applies and the penalties are far heavier.

Under the Bharatiya Nyaya Sanhita, 2023, the relevant provisions are cheating under Section 318, cheating by personation under Section 319, criminal breach of trust under Section 316, forgery under Section 336, using a forged document under Section 338, criminal intimidation under Section 351, and defamation under Section 356 where a fabricated video is circulated to damage reputation. The Digital Personal Data Protection Act, 2023 is also engaged where a person's voice or face is processed without consent, though its enforcement machinery is still developing.

On procedure, the Bharatiya Nagarik Suraksha Sanhita, 2023 applies. Section 173 provides for the FIR, including in electronic form and as a zero FIR. Section 175(3) allows a Magistrate to direct an investigation. Section 35 requires notice of appearance before arrest for offences punishable with less than seven years. Electronic records, including video files and call detail records, are governed by Section 63 of the Bharatiya Sakshya Adhiniyam, 2023. Banks act under the Reserve Bank of India's directions on unauthorised electronic transactions, which limit customer liability where a report is made promptly.

What to do first, in order

Stop the payment if it has not settled. Call 1930 and ask for a freeze request on the beneficiary account, and note the acknowledgement number.
Secure the account: change the password, revoke active sessions and, if card details were shared, block the card.
Preserve the artefact before it disappears. Screen-record the video call if it is still live, save the media file rather than only screenshotting it, and export the chat with its timestamps.
Write to your bank's nodal officer for electronic-banking fraud on the same day, with the transaction reference and the complaint number.
File the complaint on cybercrime.gov.in and then a written FIR at the police station or cyber cell with territorial jurisdiction.
If the material is being used for extortion, do not pay. Paying confirms that the material has leverage and typically leads to a second demand.
If the police do not act, apply to the Magistrate under Section 175(3) of the BNSS for a direction to investigate.

Evidence: the part most victims get wrong

The file, not the story, is what proves the deepfake. Save the file first and write the story afterwards.

What you should hold, in original form wherever possible:

The media file itself, saved to a separate device, with its file name and creation time intact.
The chat or email that delivered it, exported rather than screenshotted, so that the sender identifier and timestamps survive.
The bank statement showing the debit, with the UTR or reference number.
The call detail record for the number that called, obtainable from your operator on a police request.
Any demand message that followed the payment, which establishes the extortion or the intent.

Do not run the file through editing software, do not re-save it, and do not send it to strangers who offer to analyse it. Each of those steps changes the hash value of the file and gives the defence an argument that the artefact was altered before it reached the court.

Which forum does what

Forum	What it can do	What it cannot do
1930 helpline	Request a freeze on the beneficiary account	Investigate or prosecute
Bank nodal officer	Reverse or credit an unauthorised debit	Recover money already withdrawn
Police or cyber cell	Register an FIR, seize devices, trace accounts	Order compensation
Magistrate	Direct investigation, order production of records	Try the offence
Civil court	Decree for recovery, interim injunction on assets	Punish the offender

What decides the outcome

Four things drive the result. The first is whether the money was still in a downstream account when the freeze request arrived. The second is whether the payment was authorised by you in a technical sense: a UPI transfer you keyed in yourself is treated differently from a card debit processed without authentication. The third is the quality of the artefact and the metadata, because without it the case rests on your testimony alone. The fourth is whether the accused can be linked to the receiving account, the device or the messaging account.

Banks tend to treat a deepfake payment as customer-authorised, because the customer did press the buttons. The counter-argument is that the authorisation was obtained by deception and is therefore not a true authorisation. That argument is stronger where the bank's own systems failed to flag an unusual payee or an unusual amount, and weaker where the customer ignored warnings the app displayed.

On the criminal side, the question that decides the charge is intent. A fabricated video made as a joke or a satire is not the same as one made to extract money. The prosecution therefore leans on the demand messages, the timing of the transfer and the number of people targeted. Where the same artefact was sent to several victims, that pattern itself becomes evidence of a designed scheme rather than an isolated impulse.

What the law does not yet settle

Whether a platform must proactively detect synthetic media is not settled in Indian law, and the obligations of an intermediary under the Information Technology Act are still being worked out in practice. Whether a person whose likeness is used without any financial loss can claim damages without proving reputational harm is also fact-specific. A victim should not wait for these questions to be resolved before filing, because the evidence degrades with every day that passes and the money moves faster than the case does.

Common mistakes

Deleting the video or chat out of shame before saving it, which destroys the best evidence.
Paying the extortion demand once, which invites further demands and is hard to explain later.
Reporting only to the platform and not to 1930 or the bank, so no freeze is attempted.
Re-encoding the video to send it on WhatsApp, which changes the file and weakens its value.
Waiting for the police to trace the money before filing the bank claim, when the two should run together.
Assuming the offence is only defamation, when the payment itself makes it cheating.

When to involve a lawyer

A first complaint can be filed without legal help. A lawyer becomes necessary where the material is being circulated and an urgent takedown or injunction is needed, where the bank rejects the liability claim, where the accused must be traced through a Section 175(3) direction, or where a recovery suit has to be filed before limitation expires. A cyber crime lawyer in Kolkata can move the Magistrate and the Calcutta High Court for interim protection, and can coordinate the criminal complaint with the bank claim. Where a deepfake has been used to implicate you, see our page on criminal defence and on civil litigation for a defamation action.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

How do I recover money sent because of a deepfake video call?

Call 1930 immediately so a freeze request reaches the receiving bank, then claim against your own bank under the RBI directions on unauthorised transactions, and file a criminal complaint on cybercrime.gov.in and at the police station. Save the video file before anything else. The freeze is only effective while the money remains in a downstream account.

Is deepfake fraud a criminal offence in India?

Yes. Using a synthetic video or cloned voice to impersonate someone and induce a payment is cheating under Section 318 and cheating by personation under Section 319 of the Bharatiya Nyaya Sanhita, 2023. It is also cheating by personation using a computer resource under Section 66D of the Information Technology Act, 2000, with forgery provisions applying where a fabricated document or file is used.

What should I do if someone threatens to circulate a deepfake video of me?

Do not pay. Save the message and the file, report on 1930 and cybercrime.gov.in, and file a police complaint. If the material is sexually explicit, Section 67 of the Information Technology Act applies and, where a child is involved, POCSO. You can also seek an urgent injunction and a takedown direction through the court rather than negotiating with the extortionist.

Can the bank refuse a refund for a deepfake fraud payment?

The bank may argue that you authorised the transfer yourself, because you pressed the buttons. Your answer is that the authorisation was obtained by deception. The bank's position weakens where its systems failed to flag an unusual payee or amount. Under the RBI directions, prompt written reporting reduces your share of the liability, so report the same day.

How do I preserve deepfake evidence correctly?

Save the original media file to a separate device without re-saving or editing it, export the chat rather than screenshotting it, and keep the bank statement with the transaction reference. Do not re-encode the file to send it over a messaging app, because that changes the file and gives the defence an argument that it was altered before reaching court.

Can I file both a criminal case and a civil suit for deepfake fraud?

Yes. The criminal complaint addresses the cheating and the impersonation, while a civil suit can seek recovery of the amount, damages for defamation and an injunction against further circulation. The two run on different standards of proof and are generally permitted together. Limitation for the civil claim runs from the date of the loss, so it should not wait for the criminal trial.

What if the deepfake video was made using my face but I never lost money?

You still have remedies. A fabricated video circulated to damage your reputation engages defamation under Section 356 of the Bharatiya Nyaya Sanhita, 2023, and privacy provisions under Section 66E of the Information Technology Act, 2000 where a private image is involved. You can seek an injunction restraining circulation and a direction to the platform to remove the material.

How long does a deepfake fraud investigation usually take?

There is no fixed timeline, because it depends on how quickly the accounts are traced and whether the accused can be identified. The freeze and the bank claim move faster than the investigation. A civil recovery suit has its own schedule. What you control is the quality of the evidence you preserve in the first forty-eight hours, which sets the pace for everything after.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact