One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: If you lose money to an APK scam, file a cyber complaint immediately and freeze accounts. You may also hold the bank liable for deficiencies if it activated internet banking without your consent. Legal action under BNS for cheating and the IT Act, along with a banking ombudsman complaint, can help recover losses.
Key Facts of the Case
- A senior citizen in Nagpur lost ₹9 lakh after installing a fraudulent APK disguised as an RTO app.
- The scam remotely activated internet banking on the victim's account without his knowledge or consent.
- The victim never held a debit card for that account and had explicitly avoided digital banking.
- Scammers added themselves as beneficiaries and withdrew ₹9 lakh via IMPS in back-to-back transactions.
- The cyber complaint was filed within 24 hours, and the scam accounts were temporarily frozen.
- A friend of the victim captured a photo of the person who withdrew cash from a scam account.
- The case highlighted serious lapses in the bank's security protocols for activating internet banking.
The Direct Legal Answer
The victim approached the Chamber of Advocate Sudhir Rao after initial police follow-ups yielded no progress. Advocate Sudhir Rao and his office argued that the bank's failure to verify the victim's identity before activating internet banking was a clear deficiency of service. The bank's system allowed new beneficiary additions and IMPS transfers without any cooling-off period, which the bank later admitted was an error. The office also leveraged the photo of the scanner as key evidence to trace the fraudulent beneficiary account.
The matter was taken up before the Banking Ombudsman under the Banking Ombudsman Scheme, 2006, and a criminal complaint was filed under the Bharatiya Nyaya Sanhita (BNS) for cheating and the Information Technology Act for unauthorized access. Advocate Sudhir Rao's expertise in handling cyber fraud and banking disputes was instrumental in securing a direction for the bank to compensate ₹8 lakh as a goodwill gesture, subject to ongoing criminal proceedings. The case shows that banks can be held liable when their internal security measures fail to prevent unauthorized transactions.
Can the bank be sued for activating internet banking without consent?
Yes. If the bank activated internet banking without the customer's knowledge or authorization, it can be held liable for deficiency of service under the Banking Ombudsman Scheme and the Consumer Protection Act. The bank owes a duty of care to prevent unauthorized access.
Is there a limit on IMPS withdrawals?
While IMPS transactions themselves have no statutory limit, individual banks impose daily transaction limits (usually ₹2–5 lakh per day). The fact that ₹9 lakh was withdrawn in quick succession without triggering any fraud alert suggests a systemic failure at the bank's end.
Advice in Such Cases
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
Also, preserve all evidence—screenshots of bank statements, SMS alerts, the APK file, and the photo of the scanner. Never delete these. Send a written complaint to the bank's nodal officer and demand a response. If the bank fails to act, escalate to the Banking Ombudsman. This is a domain where procedural nuances and bank circulars matter greatly; a general practitioner may miss key RBI guidelines on zero-liability for unauthorized transactions.
Applicable Sections of Law
- Section 316 BNS (Cheating): Punishes fraudulent inducement to deliver property.
- Section 318 BNS (Cheating by personation): Covers impersonation for financial gain.
- Section 66D of the IT Act, 2000: Penalizes cheating by impersonation using a computer resource.
- RBI's Master Direction on Digital Payment Security Controls: Requires banks to implement multi-factor authentication for internet banking activation.
These provisions and RBI circulars form the legal basis for both criminal prosecution and civil claims for compensation.
Punishment and Penalties
- Section 316 BNS: Imprisonment up to 7 years and fine.
- Section 318 BNS: Imprisonment up to 3 years and fine.
- Section 66D IT Act: Imprisonment up to 3 years and fine up to ₹1 lakh.
- Cognizable: Yes, police can arrest without warrant.
- Bailable: Yes, under BNS sections.
- Compoundable: No, these are non-compoundable offences.
Jurisdiction — Where to File the Case
For criminal proceedings, file an FIR at the police station where the fraud originated or where the victim resides. If the police refuse, approach the Magistrate under Section 175(3) BNSS. For the bank complaint, approach the Banking Ombudsman having jurisdiction over the bank's branch. The consumer forum jurisdiction is based on the value of the claim and the location of the bank branch.
What if Police Refuse to File FIR?
If the local police refuse to register your complaint for cyber fraud, you have options:
- Approach the Superintendent of Police under Section 173(4) BNSS for a direction to register FIR.
- File a private complaint before the Judicial Magistrate under Section 175(3) BNSS.
- Write to the Cyber Crime Cell directly—many states have online portals for cyber complaints.
- As a last resort, file a writ petition in the High Court seeking direction for FIR registration.
Rights of the Accused
- Right to remain silent and against self-incrimination under Article 20(3) of the Constitution.
- Right to legal representation under Article 22.
- Right to be produced before a Magistrate within 24 hours of arrest.
- Right to a copy of the FIR and to know the grounds of arrest.
- Right to seek bail under Sections 480/483 BNSS.
Bail Provisions
For offences under Sections 316 and 318 BNS, the offences are bailable. The accused can apply for regular bail before the Magistrate's court. However, given the fraud magnitude and possibility of flight risk, courts may impose conditions such as surrendering the passport and furnishing a surety. Anticipatory bail under Section 482 BNSS may be sought if there is a fear of arrest.
Quashing of FIR / Case
An FIR under the BNS and IT Act can be quashed by the High Court under Section 528 BNSS if no prima facie offence is made out, or if the matter is purely civil in nature. However, in an APK scam involving unauthorized transactions, quashing is unlikely unless the accused can prove that the victim voluntarily shared credentials—which is not the case here.
If You Are the Victim
- File a cyber complaint immediately at cybercrime.gov.in or in person at the nearest cyber police station.
- Send a formal written complaint to the bank's grievance officer and demand a transaction reversal under RBI's zero-liability guidelines.
- Preserve all evidence: the APK file, SMS logs, call recordings, and transaction screenshots.
- Approach a lawyer who specializes in cyber fraud and banking disputes—general practitioners may miss key regulatory arguments.
- Consider filing a complaint with the Banking Ombudsman if the bank does not respond within 30 days.
Documents You Must Keep Ready
- Aadhaar card and PAN card for identity verification.
- Bank statements showing all fraudulent transactions.
- Copy of the cyber complaint acknowledgment number.
- Written communication with the bank (emails, letters, or complaint references).
- Screenshots of SMS alerts received for the transactions.
- Copy of the APK file or the link from which it was downloaded (if available).
- Any photographs or CCTV footage of the scanner, if captured.
What Evidence Is Required?
- Digital evidence: the APK file, call logs, and SMS logs from the victim's phone.
- Bank transaction records showing unauthorized beneficiary addition and IMPS transfers.
- Cyber complaint acknowledgment and FIR copy.
- Witness testimony: the friend who photographed the scanner.
- Expert opinion on how the APK operated (from a forensic analyst if available).
- Primary evidence includes the original digital records; secondary evidence includes printed statements and screenshots.
How the Police Behave in Such Cases
Police in cyber fraud cases often show reluctance due to technical complexity. They may ask the victim to approach the bank first. However, since this is a cognizable offence, they must register an FIR. If they delay, your lawyer can write to the SP or file a private complaint. Persistence and proper documentation are key.
Timeline of Legal Process
- FIR registration: Within 24–48 hours if the police cooperate.
- Police investigation: 60–90 days for chargesheet filing.
- Cognizance by Magistrate: 1–3 months after chargesheet.
- Trial: 6 months to 2 years, depending on court workload.
- Banking Ombudsman complaint: Resolution within 3–6 months.
- Consumer forum case: 1–2 years for final judgment.
- Appeal: Adds 6–12 months at each level.
How Long Will the Investigation Take?
Cyber crime investigations are often slow. The police may take 3 to 6 months to trace the accounts and identify the scanner. However, if the accounts are frozen early and evidence is preserved, the trial can proceed faster. The bank complaint through the Ombudsman is usually quicker than a criminal trial.
Understanding the Costs
The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.
A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.
Can the Matter Be Settled Out of Court?
In cyber fraud cases, settlement is rare because the offence is non-compoundable. However, the victim can enter into a compromise with the accused for restitution of money, which may be considered by the court as a mitigating factor. The Banking Ombudsman facilitates settlement between the bank and the customer. Alternatively, mediation under Section 89 CPC can be explored for the civil claim against the bank.
Common Mistakes People Make
- Delaying the complaint—time is critical for freezing accounts.
- Deleting the APK file or clearing phone logs after the fraud.
- Calling the scanner or engaging in conversation without legal counsel.
- Posting details on social media, which can compromise evidence and alert the accused.
- Engaging a lawyer who does not regularly handle cyber fraud and banking disputes—this area requires understanding of RBI circulars, the IT Act, and forensic evidence, which a general practitioner may not have.
- Not sending a written complaint to the bank's grievance officer, which is a prerequisite for the Ombudsman.
FAQs People Normally Have
How long does it take to get money back from a cyber fraud?
If accounts are frozen quickly and the bank cooperates, partial recovery can happen in 3–6 months through the bank or ombudsman. Full recovery via court may take 1–2 years.
Is the bank always liable for unauthorized transactions?
Not always. Under RBI's zero-liability policy, the bank is liable if the fraud occurred due to a system failure and the customer reported it within 3 days. But if the customer shared OTP or credentials, liability shifts to the customer.
Can I sue the bank for negligence?
Yes. If the bank activated internet banking without the customer's consent, that is a clear deficiency of service. A consumer complaint under the Consumer Protection Act or a banking ombudsman complaint is the way forward.
What is an APK scam?
An APK (Android Package Kit) scam involves downloading a malicious app that gives scammers remote access to your phone. They can read SMS, access banking apps, and initiate fraudulent transactions.
Do I need a lawyer for the banking ombudsman complaint?
Not required, but highly recommended. A lawyer can present your case more effectively, especially when arguing technical points about bank negligence.
This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.
Advocate Sudhir Rao, Supreme Court of India
Facing a similar matter? Speak to a Delhi criminal defence lawyer — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.