If you are stuck in such a situation, here is what to do.

Mr. Ajay Kumar, a resident of a metropolitan city, placed an order on a popular e-commerce platform called “SwiftDeal.” After receiving the product, he was not satisfied and initiated a return request through the app. Shortly after, he received a phone call from an individual who identified himself as a SwiftDeal representative. The caller asked for the reason for the return and then requested an OTP sent to Mr. Kumar’s phone to “process the return.” Unsuspecting, Mr. Kumar shared the OTP.

Immediately after sharing the OTP, he noticed that his return request on the SwiftDeal app was cancelled. A few moments later, a new return request was automatically generated. Believing it to be a technical glitch, he didn’t pay much attention. The next day, a delivery agent collected the item, and the return was marked as complete. However, the refund never arrived in his bank account. Upon checking his SwiftDeal account details, he saw the refund status as “successful.”

Confused, Mr. Kumar contacted SwiftDeal’s official customer support. They advised him to check his bank statement. The statement confirmed that no refund had been credited. A deeper look into his SwiftDeal payment settings revealed a shocking discovery: an unknown UPI ID had been added to his account. The scammer had used the OTP to gain access, add their own UPI ID, and divert the refund of approximately ₹2,500 to their account. SwiftDeal’s support confirmed he was a victim of a phishing scam, clarifying that they never ask for OTPs over the phone, but stated they could not help recover the funds. Mr. Kumar was also unable to remove the fraudulent UPI ID from his account.

Advice in such cases

• Immediately report the incident to the National Cyber Crime Reporting Portal (www.cybercrime.gov.in) or by calling the helpline number 1930. Time is critical, as a swift report can help freeze the fraudulent transaction.
• Inform your bank about the fraudulent transaction and the unauthorized UPI linkage. They may be able to provide further assistance or block future transactions.
• Gather all evidence, including screenshots of the order, the return request, the fraudulent UPI ID, call logs from the scammer, and your bank statement.
• File a formal complaint with the e-commerce platform, providing all details of the scam. While they may deny liability, a formal record is crucial.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think

Applicable Sections of Law

Such incidents involve multiple offences under Indian law. The primary legal provisions that can be invoked include:

• Section 318 of the Bharatiya Nyaya Sanhita, 2023 (BNS): This section deals with cheating. The scammer dishonestly induced the victim to share the OTP, which caused financial loss.
• Section 319 of the Bharatiya Nyaya Sanhita, 2023 (BNS): This pertains to cheating by personation, as the scammer pretended to be a representative of the e-commerce company.
• Section 66C of the Information Technology Act, 2000: This section addresses identity theft. By using the victim’s account credentials (facilitated by the OTP), the scammer committed identity theft.
• Section 66D of the Information Technology Act, 2000: This specifically covers cheating by personation using a computer resource or communication device, which is directly applicable here.

If you are the complainant

As the person who has been defrauded, you are the complainant. Your goal is to initiate legal proceedings to recover your money and ensure the perpetrator is punished.

• File an FIR (First Information Report) with the police, either online through the cybercrime portal or at your local police station’s cyber cell.
• Provide a detailed written complaint outlining the entire sequence of events with all the evidence you have collected.
• Follow up regularly with the investigating officer on the status of your case.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think

If you are the victim

Being a victim of a scam can be distressing. It’s important to act methodically to protect yourself and seek justice.

• Secure your accounts immediately. Change passwords for your e-commerce account, email, and any other linked accounts. Enable two-factor authentication wherever possible.
• Document everything. Keep a log of all communications with the e-commerce platform, the bank, and the police.
• Do not engage further with the scammer if they contact you again. Block their number.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think

How the police behave in such cases

The police response to cybercrime has evolved. Initially, you might face some reluctance at a local police station if they are not equipped with a dedicated cyber cell. However, reporting through the National Cyber Crime Reporting Portal (NCRP) is generally effective. Once a complaint is registered, it is assigned to the relevant state’s cybercrime unit. The police will typically issue notices to the e-commerce company, the payment gateway, and the bank associated with the fraudulent UPI ID to gather information. The process can be slow due to the technical nature of the investigation, which involves tracing digital footprints like IP addresses and phone numbers, which are often masked.

FAQs people normally have

Can the e-commerce company be held liable?
Proving direct liability can be challenging, as the company will argue that the user compromised their own security by sharing an OTP. However, they have a duty of care. If it can be proven that their system has a vulnerability that scammers are exploiting, or if they failed to provide adequate warnings, a case for negligence could be made in a consumer court.

Is it possible to get my money back?
Recovery is difficult but not impossible. If you report the fraud to the 1930 helpline immediately, there is a chance the funds can be frozen in the scammer’s account before they are withdrawn. If the money is already gone, recovery depends on the police successfully identifying and apprehending the fraudster and recovering the proceeds of the crime.

What evidence is required?

To build a strong case, you need to provide the following evidence:

• Screenshots of the transaction, order details, and the unauthorized UPI ID linked to your account.
• The mobile number from which the scammer called.
• A copy of your bank account statement showing the absence of the refund.
• The transaction ID of the fraudulent refund, if available from the e-commerce platform.
• Any email or message communication related to the order and return.

How long will the investigation take?

Cybercrime investigations are complex and can take a significant amount of time. The police need to coordinate with multiple private entities like telecom companies, banks, and e-commerce platforms to get information. Tracing the accused can take several months to over a year, depending on the complexity of the case and the sophistication of the scammer.

Advocate Sudhir Rao, Supreme Court of India