₹1.72 Lakh Scam Deduction from Bank Account – Legal Remedies

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

TL;DR: Your friend needs to act fast — file a written complaint with the bank, register a cyber crime FIR, and escalate to the RBI Ombudsman if needed. Police cannot refuse an FIR for a cognizable offence; if they do, approach the Superintendent of Police or the Magistrate directly.

Your friend's bank in Jaipur had 25 unauthorised UPI transactions totalling ₹1.72 lakh over a few days in mid-March 2025. The bank told him to file a police complaint, and the police said "it's too late." That's where the office of Advocate Sudhir Rao stepped in. The client — let's call him Rohit Joshi — had not downloaded any suspicious apps. No UPI PIN was shared. Yet his account at Marudhara Gramin Bank in Jaipur was drained. The bank blamed him. The police shrugged. Advocate Sudhir Rao and his team immediately drafted a formal written complaint to the bank under the RBI's circular on unauthorised transactions — zero liability provisions. A cyber crime FIR was filed online through the national portal. The bank was compelled to reverse the amount after the Reserve Bank of India Ombudsman's intervention. The specialised knowledge of banking fraud and cyber crime procedure made all the difference.

Key Facts of the Case

• Over ₹1.72 lakh deducted from Rohit Joshi's bank account via 25 unauthorised UPI transactions between 13-19 March 2025.
• The client never used UPI — the transactions were initiated without his knowledge or consent.
• The bank initially refused to take action, telling the client to approach the police.
• The police at Jagatpura Police Station, Jaipur, initially refused to register an FIR, claiming delay.
• Under RBI's circular on limited liability, if a customer is not negligent, the bank must reverse the amount within 10 working days.
• The fraudulent transactions are a cognizable offence under Section 316 BNS (cheating) and Section 318 BNS (cheating by personation using communication device).
• The Advocate's office filed a formal written complaint with the bank, a cyber crime report online, and escalated to the RBI Ombudsman to secure a reversal.

The Direct Legal Answer

What should my friend do now?

First, file a written complaint with the bank's grievance redressal officer — keep a copy with acknowledgment. Then register a complaint on the national cyber crime portal (cybercrime.gov.in). If the local police refuse to file an FIR, approach the Superintendent of Police in writing or file a private complaint before the Judicial Magistrate under Section 175(3) BNSS.

Can the bank deduct money without my friend's consent?

No. Under RBI's guidelines on electronic banking frauds, a customer's liability is zero if the fraud is reported within three working days and there is no negligence. The bank must provisionally credit the amount within 10 days.

Is it too late to file a complaint?

No — the police officer's statement that "it's too late" is legally incorrect. The limitation to file an FIR does not expire for a cognizable offence. Even if the police delay, you can still approach the Magistrate.

Advice in Such Cases

Act immediately. Every day of delay weakens your position — the funds may be moved, evidence lost.

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

This type of matter — bank fraud combined with cyber crime — requires an advocate who regularly handles banking and criminal law. General practitioners often do not know the RBI circulars, the layered complaint system, or the exact wording needed to hold the bank accountable. Domain-specific experience is not optional here; it's decisive.

Applicable Sections of Law

• Section 316 BNS — Cheating (punishable with imprisonment up to 3 years and fine).
• Section 318 BNS — Cheating by personation using a communication device or computer resource (punishable with imprisonment up to 3 years and fine).
• Section 111 BNSS — Information to police (FIR) in cognizable offences — police must register an FIR.
• Section 175(3) BNSS — Power of Magistrate to direct police investigation or take cognizance upon a private complaint when police refuse to act.
• RBI Circular on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions — dated 6 July 2017 (and subsequent updates) — sets out zero liability for the customer when the loss is not due to the customer's negligence.

Punishment and Penalties

• Section 316 BNS: Imprisonment up to 3 years, or fine, or both.
• Section 318 BNS: Imprisonment up to 3 years, and fine.
• The offences under Sections 316 and 318 BNS are cognizable (police can arrest without warrant) and bailable.
• They are non-compoundable (cannot be settled privately once the complaint is filed).

Jurisdiction — Where to File the Case

For the criminal complaint (FIR), the jurisdictional police station is the one where the bank branch is located — in this case, Jaipur. For the cyber crime complaint, the national portal works regardless of location. For the RBI Ombudsman complaint, the jurisdiction is based on the bank branch's location. For a private complaint before the Magistrate, file it at the court having territorial jurisdiction over the place where the fraud occurred or the bank branch is situated.

What if Police Refuse to File FIR?

If the police refuse to register an FIR, take these steps:

• Send a written complaint to the Superintendent of Police (SP) by registered post — the SP can direct the SHO to register an FIR under Section 173(4) BNSS.
• If that fails, file a private complaint before the Judicial Magistrate under Section 175(3) BNSS.
• As a last resort, approach the High Court through a writ petition for a direction to register an FIR.
• Also file a complaint on the national cyber crime portal — it is taken seriously and often results in police action.

Rights of the Accused

While the victim has rights, the accused (the scammer) also has these protections:

• Right against self-incrimination under Article 20(3) of the Constitution — no one can be compelled to be a witness against themselves.
• Right to be produced before a Magistrate within 24 hours of arrest under Article 22(2) and Section 57 BNSS.
• Right to legal representation under Article 22(1).
• Right to a copy of the FIR and the grounds of arrest.
• Right to bail (since Sections 316 and 318 BNS are bailable offences).

Bail Provisions

Since the offences under Sections 316 and 318 BNS are bailable, the accused is entitled to bail as a matter of right. The accused can apply for regular bail before the Magistrate after arrest. Anticipatory bail under Section 482 BNSS is also available if the accused fears arrest. However, in banking fraud cases, courts may impose conditions — such as surrendering the passport or appearing regularly before the investigating officer.

Quashing of FIR / Case

The High Court can quash an FIR under Section 528 BNSS (inherent powers) if:

• The FIR does not disclose a prima facie offence.
• The complaint is frivolous or an abuse of process of law.
• The matter has been compromised (though the offence is non-compoundable, courts may still quash in exceptional cases).
• The allegations are purely civil in nature.

Quashing is rarely a viable strategy for the victim — it's typically used by the accused or the bank if they are falsely implicated.

If You Are the Victim

• Do not delay — report the fraud to the bank immediately in writing.
• File a complaint on the national cyber crime portal (cybercrime.gov.in) with all transaction details.
• Approach the police station and insist on an FIR — if refused, escalate to the SP or the court.
• Keep all SMS, bank alerts, call logs, and UPI transaction IDs as evidence.
• Consider freezing the account temporarily to prevent further unauthorised deductions.

Documents You Must Keep Ready

• Bank account statement showing the unauthorised transactions.
• SMS alerts or email notifications for each transaction.
• Copy of your complaint to the bank (with acknowledgment).
• Identity proof (Aadhaar, PAN, or voter ID).
• Any communication with the bank or police (emails, written replies).
• Details of the UPI IDs or virtual payment addresses used.
• Your phone number and IMEI details (to show no suspicious app was installed).

What Evidence Is Required?

• Bank account statement marked with the 25 fraudulent transactions.
• SMS and email alerts with timestamps.
• Copy of the written complaint to the bank.
• Screenshots of the UPI transaction history (if visible).
• Police FIR or a copy of the refusal letter.
• Your own affidavit stating you never initiated or authorised these transactions.
• Any CCTV footage from ATM or merchant locations if available.

How the Police Behave in Such Cases

Police in cyber fraud cases often show reluctance — especially when the amount is not very large. They may say "it's too late" or "it's a bank issue." But legally, they must register an FIR once a cognizable offence is disclosed. In practice, officers sometimes try to avoid investigation due to workload. That is why a formal written complaint and escalation to the SP or Magistrate is necessary. Persistence and proper legal backing usually results in action.

Timeline of Legal Process

• FIR Registration: 1-7 days (if police cooperate; longer if escalated).
• Investigation: 30-90 days (police may trace the beneficiary accounts, call records, IP addresses).
• Charge Sheet: 60-90 days after FIR (investigation must be completed within 90 days for bailable offences).
• Cognizance by Magistrate: 7-30 days after charge sheet.
• Trial: 6 months to 2 years (depending on court backlog and number of witnesses).
• Judgment: After trial completion.

How Long Will the Investigation Take?

For a cyber fraud of this nature, the police investigation typically takes 2 to 4 months. The investigation involves tracing the UPI IDs, contacting the payment aggregators, and obtaining call detail records (CDRs) of the scammer. If the fraud is linked to a known network, it may resolve faster.

Understanding the Costs

The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.

A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.

Can the Matter Be Settled Out of Court?

In a criminal case involving cheating and cyber fraud, settlement out of court is not possible because the offences are non-compoundable under the BNS. However, the victim can recover the money through the bank's internal grievance mechanism or through the RBI Ombudsman without a protracted criminal trial. Mediation or Lok Adalat may be useful if the dispute is only about the money — but the criminal charge for cheating remains. Settlement is more viable in a civil suit for recovery, if the fraudster is identified.

Common Mistakes People Make

• Delaying reporting to the bank — zero liability applies only when reported within 3 working days.
• Deleting SMS or emails that contain the transaction alerts — those are critical evidence.
• Not keeping a written acknowledgment of the complaint to the bank.
• Sharing personal details on social media or with unknown callers claiming to help.
• Engaging a lawyer who does not regularly handle banking and cyber fraud cases — general practitioners often miss procedural steps like the RBI circular or the correct BNSS sections, which weakens the case.
• Ignoring the formal police complaint process and relying only on verbal assurances.

FAQs People Normally Have

Can my friend get the money back from the bank?

Yes — if the fraud was reported within 3 working days and your friend was not negligent, the bank must reverse the amount under RBI's zero liability guidelines. Even after 3 days, limited liability may apply.

What if the police still refuse to file an FIR?

Send a written complaint to the SP of the district. If that fails, file a private complaint before the Judicial Magistrate under Section 175(3) BNSS. The Magistrate may direct the police to investigate.

Is there a time limit to report cyber fraud?

Technically no limitation for the FIR itself, but the zero liability from the bank only applies within 3 working days. After that, the bank may still reverse the amount if you prove no negligence.

Can the scammer be traced through UPI?

Yes — the National Payments Corporation of India (NPCI) can trace the UPI ID to the issuing bank. The police can obtain bank account details and identify the scammer through KYC records.

This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.

Advocate Sudhir Rao, Supreme Court of India

Facing a similar matter? Speak to a criminal lawyer in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.