How to recover money lost to e-commerce fraud

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Online fraud

Money lost to an e-commerce fraud can sometimes be recovered, but recovery is not automatic and it is rarely quick. The outcome turns on three things: how fast the fraud is reported, whether the beneficiary account still holds the money, and whether the victim can produce a clean trail linking the payment to a false representation. The practical first step is to call 1930 and file on cybercrime.gov.in, then send a written complaint to the bank's nodal officer asking for the beneficiary account to be flagged. A criminal complaint under Section 66D of the Information Technology Act, 2000 and Section 318 of the Bharatiya Nyaya Sanhita, 2023 can run alongside a civil recovery claim.

This article is about recovery, not punishment. It sets out the four tracks available to a victim, the documents each track needs, the legal provisions that apply, and the factors that decide whether money actually comes back. It deliberately avoids promising a result. Banks, police and courts decide on the facts of each case, and a victim who understands the process makes better decisions in the first 48 hours, when most of the recoverable value is still within reach.

The four recovery tracks

The first track is the bank. Under the RBI's directions on unauthorised electronic transactions, a customer must be given a helpline and a clear process to report a fraud. The bank must acknowledge the report and examine whether the customer is liable. Where the fraud did not involve the customer's negligence, the bank's liability is limited. Where the customer shared an OTP, password or remote-access permission, the bank may treat the loss differently. The bank can also alert the beneficiary bank and request a freeze while the dispute is examined.

The second track is the criminal complaint. A report to 1930 and the cyber crime portal creates a record that the police can use to trace the beneficiary account, request KYC details and issue notices to the payment platform. If the police register an FIR under Section 173 of the BNSS, 2023, the investigation can lead to the identification of the seller or the mule account holder. A criminal case does not automatically return the money, but it gives the victim a legal basis to seek restitution and it often produces the account details needed for a civil claim.

The third track is a civil suit for recovery. A victim can sue the seller, the platform or an intermediary for the amount paid, depending on who made the false representation and who received the money. A civil suit can be filed even if the police case is slow. The standard of proof is different, and the court can order the defendant to repay the amount with interest if the claim is proved. The difficulty is identifying the defendant and enforcing a decree against a person who may have no visible assets.

The fourth track is the consumer forum. A genuine purchase that went wrong because of a deficient service, a misleading listing or a refusal to honour a refund can be taken to a consumer commission. The consumer route is usually faster and less expensive than a civil suit, but it is not designed for outright cheating. Where the seller never intended to deliver, the criminal route is the better fit.

What the law says

Section 66D of the IT Act, 2000 covers cheating by personation using a computer resource or communication device. The maximum punishment is three years imprisonment and a fine of one lakh rupees. Section 66C covers identity theft, which applies when the fraudster uses another person's name, photographs or documents to create a seller profile or a payment account. Section 66 covers unauthorised access to a computer resource and is used where an account is taken over.

Under the BNS 2023, Section 318 is the general cheating offence. Section 318(4) covers cheating and dishonestly inducing the delivery of property, with punishment that can extend to seven years and a fine. Section 316 covers criminal breach of trust where money or goods are entrusted and dishonestly misappropriated. Section 336 covers forgery of invoices, payment screenshots and delivery records. Section 351 covers criminal intimidation, which can arise when a seller threatens a buyer who asks for a refund.

The BNSS 2023 supplies the procedure. Section 173 requires the police to register an FIR for a cognizable offence. Section 175(3) allows a magistrate to direct an investigation when the police decline. Section 187 is the private complaint route. Section 35 governs arrest and its safeguards. Section 480 and Section 482 deal with plea bargaining and appeals, and Section 528 preserves the previous law for offences committed before the new codes. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 governs the admissibility of electronic records and requires a certificate from the person in charge of the device or account.

The RBI directions are not a criminal statute, but they are the strongest lever for a quick refund. They require the bank to treat a reported unauthorised transaction seriously, to investigate within a stated period and to limit the customer's liability where the customer is not at fault. The directions also require the bank to provide a complaint form and a acknowledgement. A victim who keeps a copy of the written complaint and the acknowledgement is in a much stronger position if the bank later denies receiving the report.

Step-by-step recovery procedure

1. Secure the account and stop the loss. Change passwords, revoke saved cards, cancel UPI mandates and remove any remote-access app the fraudster may have installed. Do this before writing long complaints, because an active mandate can take more money.
2. Call 1930 and file the portal complaint. Give the exact transaction reference, amount, date, seller name and listing URL. Save the acknowledgement number and download the complaint PDF.
3. Send the bank a written complaint. Address it to the nodal officer, mark a copy to the branch, and attach the 1930 acknowledgement, bank statement and payment screenshot. Ask specifically for the beneficiary account to be frozen and for the transaction to be treated as unauthorised.
4. File a police complaint. Go to the police station with the documents and ask for a receipt under Section 173 BNSS. If the police refuse, send the complaint to the Superintendent of Police and then use Section 175(3) or Section 187 BNSS before the magistrate.
5. Start the civil or consumer track if the seller is identified. A lawyer can advise whether a recovery suit, a consumer complaint or both are viable. The bank complaint and the criminal complaint continue in parallel.
6. Follow up on a calendar. Ask the bank and the police for written status updates at fixed intervals. A polite, documented follow-up is more effective than repeated phone calls with no record.

Routes, forums and what each can achieve

These routes are not alternatives in a strict sense. A bank claim can succeed while a criminal case is pending. A civil suit can be filed after the police identify the seller. A consumer complaint can be withdrawn if the facts turn out to be a cheating case. The important point is to keep the evidence consistent across every forum. A statement made to the bank that contradicts the police complaint gives the other side an easy argument.

What decides how much comes back

The first factor is the age of the transaction. A report made within hours gives the banks a real chance to freeze the beneficiary account. A report made after a week usually finds the account emptied. The second factor is the customer's conduct. If the customer shared an OTP, installed a remote-access app or ignored a bank warning, the bank may reduce or deny liability under the RBI directions. If the customer acted promptly and did not share credentials, the claim is stronger.

The third factor is the beneficiary account. A verified account with a real KYC record can be frozen and the holder can be traced. A mule account opened with a stolen identity is harder. The fourth factor is the platform's cooperation. A marketplace that holds the seller's KYC, bank details and listing history can provide evidence quickly. A payment link or a direct bank transfer outside the platform leaves less of a trail.

The fifth factor is the quality of the documents. A bank statement with the debit entry, the UPI reference, the chat showing the false promise and the listing screenshot with a URL form a chain. A complaint that says only that the seller cheated, without dates and amounts, is difficult to act on. The sixth factor is the amount. A large loss justifies a civil suit and sustained follow-up. A small loss may be pursued through the portal and the consumer commission, where the effort is proportionate.

The seventh factor is the identity of the defendant. If the seller is a company or a registered business, a civil decree is easier to enforce. If the seller is an unverified individual using a mobile number, enforcement may be impossible even if the case succeeds. A lawyer usually assesses recoverability before recommending litigation, because a judgment against an empty account helps no one.

Common mistakes

Do not pay a recovery agent. Genuine banks and lawyers do not ask for an upfront fee to retrieve stolen money. Do not file only a police complaint and skip the bank, because the bank is the only party that can freeze the account quickly. Do not wait for the marketplace's internal dispute to end before reporting to 1930. Do not delete the chat or the listing. Do not close the bank account or the card before the dispute is recorded, because the transaction history is evidence.

Do not exaggerate the loss or invent facts. A claim that cannot be supported by the bank statement damages credibility. Do not threaten the seller on social media. Do not send money to anyone who claims to be a police officer or bank official investigating the fraud. Do not assume that an FIR means the money will be returned; the criminal case and the recovery case are separate. Do not miss the bank's deadline for responding to a request for information.

When to involve a lawyer

Involve a lawyer when the bank rejects the liability claim, when the police do not register an FIR, when the seller is identified and a civil suit is being considered, or when the amount is large enough that the cost of a legal process is justified. A lawyer can draft the bank representation, the magistrate complaint and the recovery suit, and can prepare the Section 63 BSA certificate for electronic evidence. For a small, recent fraud with a cooperative bank and a clear portal complaint, the process may be manageable without a lawyer. For a disputed liability case or a case that needs a court order, early legal advice is worth taking. You can read more about the firm's cyber crime practice in Kolkata or use the contact page to discuss the facts.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• E-Commerce Sellers: Fraud, Duties and Legal Remedies
• E-commerce fraud: what it is and how it works in India
• Dark Patterns in E-commerce: What is Now Illegal?
• How to Recover Money Lost to Matrimonial Fraud in India
• How to recover money lost to vishing call fraud
• Smishing SMS fraud how to recover money: step by step

Cyber crime lawyer in your city · Bank account freeze help · Contact